300-710 SNCF Practice Test 19 — 15 Questions

Question 1

An organization configures third-party SIEM integration where Secure Firewall Threat Defense sends syslog messages over UDP. During high-traffic events, the SIEM administrator notices significant log dropping and packet loss across the network. What is the best practice solution to ensure reliable syslog delivery without packet loss due to UDP buffer overflows?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Reliable Syslog utilizing TCP transport to ensure flow control and guaranteed packet delivery.. UDP is a best-effort transport protocol prone to packet loss during network congestion. Switching to Reliable Syslog (TCP with TLS encryption) ensures flow control, retransmissions, and guaranteed delivery of syslog messages to the SIEM.

Answer

Increase the UDP socket buffer size on the FTD expert shell using sysctl kernel tuning.

Answer

Disable connection logging and rely solely on eStreamer.

Answer

Configure NAT overload on the syslog export interface.

Question 2

When configuring Cisco Secure Firewall Threat Defense to forward syslog messages to a remote SIEM receiver, which transport layer protocols are natively supported for syslog export?

Accepted Answer

UDP and TCP. Cisco Secure Firewall Threat Defense supports both UDP and TCP (including reliable syslog over TCP) for transmitting syslog messages to external SIEMs.

Answer

HTTP and HTTPS only

Answer

UDP only

Answer

TCP and SCTP

Question 3

An administrator is reviewing the health of the Cisco Secure Firewall Management Center integration with Cisco SecureX. Which TWO methods can be used to verify that the integration is functioning properly? (Choose two)

Accepted Answer

Examine cloud services and API log files in the FMC expert shell under /var/log/cisco/.. Integration status can be verified through the FMC System > Integration > SecureX health status and by checking cloud services API logs on the FMC expert shell.

Answer

Run 'show securex status' on the FTD CLI.

Answer

Inspect the 'pxgrid.log' file on the FMC.

Answer

Run 'show estreamer status' on the FTD CLI.

Question 4

Which THREE items are required to create a port channel on an FTD device?

Accepted Answer

LACP configuration. A port channel requires multiple physical interfaces, a logical port-channel interface ID, and the LACP protocol settings.

Answer

A static route to the port channel

Answer

A physical bypass module

Question 5

Which protocol does Cisco Secure Firewall Threat Defense use to exchange SGT (Security Group Tag) metadata across intermediate routers that do not support inline tagging?

Accepted Answer

SXP (Scalable Group Tag Exchange Protocol). SXP (Scalable Group Tag Exchange Protocol) is a protocol used to propagate SGT-to-IP mappings across network devices and firewalls that do not support inline MACsec or IPsec SGT propagation.

Answer

RADIUS

Answer

TACACS+

Answer

SNMPv3

Question 6

An engineer is configuring Cisco eStreamer to stream events from FMC to a third-party SIEM. The firewall security policy blocks incoming connections on port 8302 from the SIEM server to the FMC. Which device and interface are involved in listening for the eStreamer client connection?

Accepted Answer

The FMC management interface listening on TCP port 8302.. The eStreamer server process runs on the Cisco Secure Firewall Management Center (FMC), listening on TCP port 8302 on its management interface.

Answer

The FTD data interface listening on TCP port 8302.

Answer

The FTD management interface listening on UDP port 514.

Answer

The ISE pxGrid node listening on TCP port 8910.

Question 7

Which protocol is natively used by Cisco Secure Firewall Management Center to stream connection and intrusion events to external SIEM systems in real time?

Accepted Answer

eStreamer. eStreamer is Cisco's proprietary protocol and API used for streaming security events from FMC to SIEMs.

Answer

HTTP SOAP

Answer

TFTP

Answer

NetFlow v9

Question 8

An administrator configures an eStreamer client script on a remote server to receive events from FMC. The script connects successfully and starts receiving events, but after a few hours, the connection drops and throws a timeout error. What is the most likely cause of this behavior?

Accepted Answer

An intermediate firewall or stateful device closed the TCP port 8302 session due to inactivity timeout.. Firewalls or intermediate network devices along the path between the external eStreamer client and the FMC often have idle session timeouts (e.g., 30 minutes or 1 hour). If eStreamer traffic is quiet, the session times out. eStreamer keepalive configurations or firewall idle timeouts must be adjusted.

Answer

The eStreamer service on the FMC has a hard-coded 2-hour session limit for security reasons.

Answer

The FMC automatically rotates the eStreamer client certificate every 4 hours.

Answer

The Snort inspection engine on the FTD restarts hourly to clear cache.

Question 9

An enterprise integrates Cisco Secure Firewall Management Center with Cisco ISE using pxGrid for identity-based access control. The security team notices that user identity mapping works for domain users authenticating via 802.1X, but guest users connecting through a WebAuth portal do not have their user-to-IP mappings populated on the FTD. What is the root cause of this issue?

Accepted Answer

The pxGrid connection on ISE is not subscribed to the guest session topic, or guest session publishing is disabled in ISE deployment settings.. Guest users authenticated via WebAuth on ISE may not have active pxGrid session directory notifications if the guest profile or ISE profiler service is not configured to publish guest sessions, or if the pxGrid node is not subscribed to guest session topics (such as 'Session Directory' guest events).

Answer

FMC requires an active eStreamer connection to ingest guest identities because pxGrid only supports Active Directory domain accounts.

Answer

Guest users must manually log into a captive portal hosted on the FTD data plane before ISE can share their identity.

Answer

The FTD identity policy must be configured with a RADIUS server group instead of pxGrid to support guest VLANs.

Question 10

An administrator is troubleshooting an eStreamer connection between the FMC and a custom Python SIEM script. The connection is established, but no intrusion events appear in the SIEM. Which TWO potential reasons could explain why intrusion events are missing from the stream? (Choose two)

Accepted Answer

The Access Control policy applied to the FTD devices does not have an Intrusion Policy assigned to inspect and generate events.. Missing intrusion events in eStreamer can result from the client script not subscribing to intrusion event types during initialization or from Access Control rules not having intrusion policies enabled.

Answer

The SIEM script is using UDP instead of TCP for eStreamer communication.

Answer

The FMC eStreamer listening port was changed from 8302 to 443.

Answer

The FTD management interface IP address is blocked by an Access Control rule.

Question 11

An administrator is troubleshooting an eStreamer integration where the client script disconnects immediately after authentication. Upon inspecting the logs, the administrator notes an SSL certificate verification error. Which TWO areas should be checked to resolve this certificate error? (Choose two)

Accepted Answer

Verify that the FMC CA root certificate has been correctly imported into the client application's trust store.. eStreamer TLS verification errors occur when the client lacks the FMC CA certificate or when the client certificate bundle generated from the FMC is invalid or expired.

Answer

Verify the pxGrid client approval status on the Cisco ISE dashboard.

Answer

Check the FTD Platform Settings syslog server IP configuration.

Answer

Restart the Snort engine on the FTD device.

Question 12

An administrator is setting up Cisco SecureX threat intelligence integration with Cisco Secure Firewall Management Center. The test connection fails with a 'Token Expired or Invalid' error. What is the correct procedure to re-establish trust and authentication between the FMC and SecureX?

Accepted Answer

Generate a new client ID and API key from the Cisco SecureX (Security Cloud Control) console and update the integration credentials in FMC System > Integration > SecureX.. To resolve API token or cloud registration expirations for SecureX, the administrator must re-register the FMC with SecureX by generating a new API key / integration credential from the SecureX/Security Cloud Control portal and pasting it into the FMC System > Integration > SecureX settings.

Answer

Log into the FTD CLI and execute the 'clear securex-token' command.

Answer

Reinstall the Snort rule updates package on the FMC.

Answer

Reboot the FMC appliance to regenerate the internal device certificate.

Question 13

An administrator integrates Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. After successful registration, the administrator wants to create an Access Control policy rule that blocks traffic from users in the 'Contractors' Security Group Tag. Where in the FMC rule creation wizard should the administrator configure this condition?

Accepted Answer

In the Access Control Rule, navigate to the Users tab and select the desired Security Group Tag.. In FMC Access Control policies, user and tag-based criteria are added under the 'Users' tab of the rule configuration, where Security Group Tags learned via pxGrid can be selected.

Answer

In Objects > Object Management > Access Control > SGT Objects.

Answer

In the Platform Settings policy under Identity Sources.

Answer

In the Access Control Rule, navigate to the Networks tab and select Security Groups.

Question 14

An administrator is integrating Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. The connection fails during the certificate validation phase because the FMC rejects the ISE pxGrid certificate. Upon inspection, the FMC certificate store lacks the intermediate CA certificate of the PKI hierarchy used by ISE. How should the administrator resolve this?

Accepted Answer

Upload the complete certificate authority chain (Root and Intermediate CA certificates) into the FMC Trusted CAs object repository.. Mutual TLS for pxGrid requires the FMC to trust the entire certificate chain presented by ISE. The administrator must upload both the Root CA and Intermediate CA certificates of the ISE PKI to the FMC's trusted certificate store under Object Management > PKI > Trusted CAs.

Answer

Configure an SNMPv3 community string to bridge the certificate trust gap.

Answer

Generate a self-signed certificate on the FTD CLI and assign it as the pxGrid trust anchor.

Answer

Disable certificate validation in the FMC pxGrid advanced configuration menu.

Question 15

An administrator is troubleshooting an eStreamer client script failure where the connection is refused on port 8302. Which TWO potential causes should the administrator investigate? (Choose two)

Accepted Answer

An intermediate firewall or the FMC internal iptables firewall is blocking TCP port 8302 traffic.. Connection refused errors on port 8302 indicate that the eStreamer service is not running on the FMC or that network filtering/firewalls are blocking access to port 8302.

Answer

The FTD Snort engine is out of memory.

Answer

The DHCP lease on the FTD data interface has expired.

Answer

The pxGrid certificate on ISE has expired.