300-710 SNCF Practice Test 18 — 15 Questions

Question 1

Which menu path in the Cisco Secure Firewall Management Center (FMC) is used to configure the connection to Cisco Threat Response or Cisco SecureX?

Accepted Answer

System > Integration > SecureX. Integration with Cisco SecureX (Threat Response) is configured under System > Integration on the FMC interface.

Answer

Devices > Device Management > Threat Intelligence

Answer

Objects > Object Management > Cloud Services

Answer

Policies > Access Control > Security Intelligence

Question 2

An engineer is troubleshooting a Cisco ISE and Secure Firewall pxGrid integration. The administrator notices that user group memberships are not populating correctly on the FTD, even though IP-to-user mappings are visible. What is the most likely reason user group information is missing?

Accepted Answer

ISE is not configured to include user group attributes in pxGrid publication feeds, or the FMC requires direct LDAP/AD integration to resolve user group hierarchies.. While pxGrid shares IP-to-user mappings, user group attribute resolution often relies on Active Directory integration or LDAP directory configurations mapped within ISE or synchronized via Active Directory Agent / ISE Active Directory attribute retrieval. If ISE is not configured to publish user group attributes over pxGrid or if the FMC lacks AD LDAP integration to resolve the groups, group-based rules will fail.

Answer

The FMC eStreamer service is blocking group attribute propagation.

Answer

User groups can only be resolved via RADIUS accounting attributes, making pxGrid fundamentally incompatible with user group filtering.

Answer

The FTD Snort engine must be configured with a local flat file containing all user group names.

Question 3

An administrator is troubleshooting Cisco ISE pxGrid integration with Secure Firewall Management Center. Which TWO issues commonly prevent successful pxGrid registration and trust establishment? (Choose two)

Accepted Answer

The FMC client certificate is pending manual approval in the Cisco ISE pxGrid Services client management console.. pxGrid integration issues frequently stem from certificate validation errors (missing CA chains) or unapproved client registrations on the ISE pxGrid dashboard.

Answer

The FTD device is missing an Active Directory domain join account.

Answer

The eStreamer service port 8302 is blocked on the ISE server.

Answer

The Snort engine on the FTD is disabled.

Question 4

An administrator configures Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO features help ensure that syslog messages are transmitted securely and reliably across untrusted networks? (Choose two)

Accepted Answer

Enabling TLS encryption for syslog transmission to protect sensitive log contents in transit.. Reliable syslog uses TCP and TLS encryption to secure and guarantee delivery of syslog messages.

Answer

Configuring SNMPv3 privacy and authentication parameters on the syslog server.

Answer

Configuring the syslog server IP as a secondary management gateway.

Answer

Enabling SSH tunneling on UDP port 514.

Question 5

An enterprise integrates Cisco Secure Firewall Threat Defense with Cisco ISE via pxGrid. The security team notices that user identity mapping is intermittent for wireless clients roaming across different access points. Which TWO factors should be verified to ensure robust identity continuity during wireless roaming? (Choose two)

Accepted Answer

Ensure that ISE session updates and RADIUS accounting interim updates are properly configured on the wireless controllers.. Roaming wireless clients require rapid RADIUS accounting updates and ISE session continuity to update pxGrid mapping without delays.

Answer

Disable the Snort engine during wireless handover events.

Answer

Ensure the FTD is configured as an SXP speaker for wireless SSIDs.

Answer

Configure static ARP entries for all wireless client MAC addresses on the FTD.

Question 6

An administrator wants to ensure that all security event logs from Cisco Secure Firewall Threat Defense are exported reliably and in real time to external security analytics tools. Which TWO deployment and configuration practices should be implemented? (Choose two)

Accepted Answer

Configure Reliable Syslog (TCP with TLS) in FTD Platform Settings to ensure encrypted and guaranteed log delivery.. Reliable and real-time log export requires configuring both eStreamer for FMC-level event streaming and Reliable Syslog (TCP/TLS) for platform syslog export.

Answer

Rely solely on local FTD disk storage and export logs via manual SCP once a week.

Answer

Disable the Snort engine to prevent log buffer congestion.

Answer

Configure SNMPv1 traps to poll event counters every 60 seconds.

Question 7

An organization mandates that all integration traffic between Cisco Firepower Management Center and Cisco SecureX must be inspected. Which cloud connection mechanism does FMC use to communicate with SecureX threat intelligence and telemetry?

Accepted Answer

Outbound HTTPS REST API communication to Cisco SecureX cloud endpoints.. FMC connects outbound to Cisco SecureX using HTTPS (TCP port 443) via public cloud APIs and messaging fabric.

Answer

Direct syslog forwarding over TCP 6514 to the SecureX collector.

Answer

Inbound SSH tunneling initiated by the SecureX cloud connector.

Answer

Bidirectional IPSec VPN tunnel established automatically between FMC and SecureX cloud cluster.

Question 8

You are configuring static route tracking on an FTD device. What is the primary purpose of this configuration?

Accepted Answer

To ensure traffic is only routed through a verified path.. Static route tracking allows the firewall to monitor the availability of a path using ICMP or other probes and remove the route from the routing table if the probe fails.

Answer

To load-balance traffic across ISPs.

Answer

To increase the throughput of the interface.

Answer

To dynamically adjust the MTU of the link.

Question 9

Which component in Cisco Secure Firewall architecture is responsible for generating Security Intelligence feeds and synchronizing them with Cisco SecureX threat intelligence?

Accepted Answer

Cisco Secure Firewall Management Center (FMC). The Cisco Secure Firewall Management Center (FMC) downloads Security Intelligence feeds and cloud threat intelligence from Cisco SecureX and distributes them to the managed FTD devices.

Answer

The local DHCP server on the FTD

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco DNA Center

Question 10

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO fields or parameters can be included in the syslog output to facilitate incident investigation and event parsing by the SIEM? (Choose two)

Accepted Answer

Precise timestamp formatting (UTC or local time) configured in Platform Settings. Syslog messages can include device identifiers and explicit timestamps to aid SIEM log parsing and correlation.

Answer

Full memory core dump binary attachments

Answer

FMC administrator SSH private keys

Answer

Raw packet captures (PCAP) of dropped connections embedded in syslog text

Question 11

An administrator configures Cisco Secure Firewall Threat Defense to send connection logs to a syslog server. The SIEM administrator reports that connection teardown logs are missing, while connection creation logs are successfully received. What setting in the FTD Platform Settings syslog configuration needs to be adjusted?

Accepted Answer

Ensure that 'Log Beginning of Connection' and 'Log End of Connection' (Teardown) are both explicitly enabled in the FTD Platform Settings logging configuration.. By default, FTD logging options allow configuring whether to log connection begin, connection end (teardown), or both. If teardown logs are missing, the logging option for 'Connection Teardown' (or closed connections) is disabled in the Platform Settings logging configuration.

Answer

Increase the syslog severity level from informational to debug.

Answer

Change the syslog facility from local4 to daemon.

Answer

Enable 'Reliable Syslog' over TCP.

Question 12

An administrator is troubleshooting an eStreamer integration where custom Python client scripts fail to receive events from the FMC. The administrator verifies that network connectivity, certificates, and user permissions are correct. Upon running the client script in verbose mode, the error indicates an 'Incompatible Protocol Version' between the client SDK and the FMC. How is this resolved?

Accepted Answer

Update the eStreamer client SDK on the third-party SIEM to a version compatible with the current FMC software release.. Cisco FMC updates frequently include eStreamer protocol version upgrades. If an older third-party SIEM client SDK is used with a newly upgraded FMC, the client SDK must be updated to match or support the eStreamer protocol version running on the FMC.

Answer

Downgrade the FMC software to match the legacy eStreamer client library.

Answer

Switch from eStreamer to legacy SNMP traps.

Answer

Modify the eStreamer version registry key in the FMC expert shell configuration file.

Question 13

A network security engineer configures Cisco Secure Firewall Threat Defense to ingest Security Group Tags (SGTs) from Cisco ISE via pxGrid. The integration is active, and SGTs are successfully mapped to IP addresses. However, access control rules referencing Security Group Tags fail to match traffic originating from authenticated endpoints. What is the most likely cause of this behavior on FTD?

Accepted Answer

The TrustSec SXP peering is not configured between the FTD and the authenticator switch, causing the firewall data plane to drop or ignore inline SGT headers.. For SGTs to be enforced in Access Control policies on FTD, the SGT metadata must be preserved in the data plane (such as through inline SGT propagation using Cisco TrustSec SXP or inline tagging). If SXP is not configured to propagate the tags across routed hops, or if the interface is not configured to trust SGT headers, FTD will not inspect the tag in the packet header.

Answer

Cisco Secure Firewall Threat Defense does not support enforcement of SGTs learned via pxGrid; it only supports SXP.

Answer

The Identity Source Sequence on ISE must include Active Directory LDAP bindings specifically for FTD rule evaluation.

Answer

The FMC requires a manual restart of the Snort detection engine every time a new SGT is learned via pxGrid.

Question 14

An organization uses Cisco Secure Firewall Threat Defense and integrates with Cisco ISE for identity policies. The security team notices that identity rules are intermittently failing because the FTD cache of IP-to-user mappings is being flushed unexpectedly. Upon investigation, what condition on FTD or ISE typically causes the purging of active user identity maps?

Accepted Answer

Receipt of an accounting stop message from the authenticator or an explicit session termination event from ISE pxGrid.. User identity mappings on FTD can be purged or invalidated due to RADIUS accounting stop messages, explicit pxGrid session termination notices from ISE (such as logoff or re-authentication timeouts), or when the maximum session idle timer expires on the firewall identity policy configuration.

Answer

A mismatch in the NTP time synchronization greater than 5 minutes between the FTD and the FMC.

Answer

Exceeding the FMC database storage limit for event logging.

Answer

Automatic daily rotation of the FMC administrator password.

Question 15

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslogs to a third-party SIEM. To ensure confidentiality of sensitive log data traversing untrusted network segments, how should the syslog export be configured?

Accepted Answer

Configure Reliable Syslog utilizing TCP with TLS encryption under Platform Settings > Syslog.. To secure syslog transmission, administrators configure Reliable Syslog, which uses TLS encryption over TCP (typically on TCP port 6514) between the FTD and the SIEM syslog collector.

Answer

Configure HTTPS POST requests in the eStreamer client configuration.

Answer

Enable Secure Shell (SSH) port forwarding for UDP port 514.

Answer

Tunnel all UDP syslog packets inside an IPsec VPN tunnel terminated on the FMC management interface.