300-710 SNCF Practice Test 19 — 15 Questions

Question 1

When configuring an FTD cluster, what is the purpose of the Control Plane IP address?

Accepted Answer

To allow the FMC to manage the cluster as a single logical device.. The Control Plane IP allows the FMC to communicate with the entire cluster as a single entity, rather than needing to manage individual nodes separately.

Answer

To synchronize the configuration files across the cluster.

Answer

To handle user authentication traffic.

Answer

To serve as the default gateway for internal hosts.

Question 2

An administrator is configuring manual NAT and needs to specify an interface pair (Source Interface and Destination Interface). Why is defining interface objects important in manual NAT rules?

Accepted Answer

It scopes the translation rule to specific ingress and egress interfaces, preventing unintended translations across other subnets.. In manual NAT on FTD, specifying the source and destination interface objects scopes the translation rule to a specific ingress/egress path. This prevents the rule from matching traffic that enters or exits through other interfaces, which could otherwise cause unintended translations of traffic that should not be NATed. Interface objects in manual NAT are the equivalent of 'interface pair' matching in classic ASA NAT, giving the administrator granular control over where the translation applies.

Answer

It replaces the need for security zones in Access Control policies.

Answer

It forces the FTD to convert the packet from Layer 2 to Layer 3.

Answer

It enables automatic routing table updates for the translated IP address.

Question 3

When deploying a configuration change from FMC to FTD, what is the 'Deployment' process actually doing?

Accepted Answer

Pushing policy and configuration updates. The deployment process pushes the configuration changes and policies to the FTD device.

Answer

Running a connectivity test

Answer

Rebooting the FTD

Answer

Updating the Snort binary

Question 4

An administrator is managing high availability failover events for Cisco Secure Firewall Threat Defense devices using Cisco FMC. Which TWO actions or events will trigger a failover from the active unit to the standby unit? (Choose two)

Accepted Answer

Failure of a monitored data interface exceeding the configured interface failure criteria.. Option A is correct because when an interface is configured as monitored in a failover configuration, a failure of that data interface that exceeds the configured interface failure criteria (such as the number of failed interfaces or the failure threshold) causes the active unit to fail over to the standby unit. Option E is correct because the failover control link carries heartbeat communications between the active and standby units; loss of these heartbeat messages causes the standby unit to detect that the active unit is no longer healthy and to take over as the active unit. Option B is not correct because an administrator logging into FMC via HTTPS is a normal management action and does not affect the failover state of the Threat Defense devices. Option C is not correct because failover is not triggered by CPU utilization crossing a low threshold like 10%; failover is based on interface monitoring, heartbeat loss, and unit health, not routine CPU load. Option D is not correct because a scheduled backup job on the secondary unit is an administrative task and does not trigger a failover event.

Answer

An administrator logging into the FMC user interface via HTTPS.

Answer

An increase in CPU utilization above 10% on the active unit.

Answer

A scheduled backup job running on the secondary unit.

Question 5

Which deployment scenario represents the correct use case for deploying a Cisco Secure Firewall Threat Defense in passive NGIPS mode?

Accepted Answer

Out-of-band monitoring of core switch traffic using a SPAN port to detect threats without impacting production latency.. Passive NGIPS mode is used when monitoring traffic out-of-band via a tap or SPAN port without putting the device in the direct path of data flow.

Answer

Acting as the default Layer 3 gateway and DHCP server for guest Wi-Fi users.

Answer

Terminating remote access AnyConnect VPN tunnels for mobile employees.

Answer

Inline inspection of all core data center traffic where blocking malicious packets is mandatory.

Question 6

When considering virtual FTD deployments, which THREE factors significantly impact the performance of the instance?

Accepted Answer

The amount of provisioned RAM. Option B is correct because the amount of provisioned RAM directly determines how much memory the virtual FTD can use for connection tables, Snort/Snort 3 inspection buffers, and other runtime data structures; insufficient RAM causes packet drops and degraded throughput. Option D is correct because the virtual network adapter type (for example, VMXNET3 versus E1000, or SR-IOV versus paravirtualized) determines whether traffic is offloaded to hardware, how many queues are available, and how much CPU overhead is incurred per packet, all of which strongly affect instance performance. Option E is correct because the number of allocated CPU cores governs how many Snort inspection instances and other processes can run in parallel, directly scaling inspection throughput and the ability to handle concurrent flows. Option A is not correct because the number of configured Access Control Rules is a configuration/policy factor that affects rule lookup efficiency only marginally and is not one of the primary resource factors that determine virtual FTD instance performance. Option C is not correct because the number of active management sessions consumes only a small amount of control-plane resources and does not significantly impact the data-plane performance of the virtual FTD instance.

Answer

The number of configured Access Control Rules

Answer

The number of active management sessions

Question 7

You are troubleshooting a connectivity issue. The traffic is being dropped by a Prefilter rule. What is the characteristic of traffic handled by a Prefilter policy?

Accepted Answer

It bypasses the Snort engine. Prefilter policies provide a fast path to inspect traffic without the overhead of deep packet inspection.

Answer

It performs full IPS inspection

Answer

It operates at the L7 layer

Answer

It only applies to encrypted traffic

Question 8

An administrator is configuring Cisco ISE pxGrid integration with Cisco Secure Firewall Management Center. Which TWO identity sources or methods supported by ISE can provide context that is subsequently consumed by FTD via pxGrid? (Choose two)

Accepted Answer

Guest WebAuth portal authentications. Options B and C are correct because Cisco ISE pxGrid publishes identity and session context that it has learned from its own authentication and authorization services. Guest WebAuth portal authentications (B) are processed by ISE's guest services, so the resulting user identity, endpoint, and session attributes are available to be shared over pxGrid and consumed by FTD for identity-based policy. Active Directory / LDAP authentications via 802.1X or RADIUS (C) are core ISE identity sources; when users or machines authenticate through ISE against AD/LDAP, ISE maps that identity to the session and publishes it via pxGrid to FMC/FTD. The other options do not belong: raw NetFlow v5 streams from routers (A) are traffic telemetry, not an ISE-supported identity source, and FMC does not ingest them as pxGrid identity context. Local FTD administrator CLI logins (D) are device-management events on the firewall itself, not ISE-authenticated user sessions. Manually imported DHCP static lease text files (E) are not an ISE pxGrid identity source and are not a supported method for providing ISE context to FTD.

Answer

Raw NetFlow v5 packet streams exported directly from core routers to the FMC

Answer

Local FTD administrator CLI login sessions

Answer

DHCP server static lease table text files imported manually into FMC

Question 9

Which THREE settings can be configured within a Prefilter Policy on the FMC? (Choose three)

Accepted Answer

FastPath action to bypass Snort inspection. Option B is correct because a Prefilter Policy's central purpose is to let early-pass traffic skip deep inspection, and the FastPath action explicitly bypasses Snort so matching flows are forwarded without intrusion or file analysis. Option C is correct because every Prefilter Policy defines a Default Action applied to traffic that matches no prefilter rule, and that default is chosen as either Analyze (send to Snort for full inspection) or FastPath (bypass Snort). Option E is correct because Prefilter Policies include tunnel handling settings that let you analyze or fastpath tunneled traffic such as GRE and IPsec, including inspecting the outer or inner flow. Option A is not part of a Prefilter Policy: Intrusion Policy signature tuning is configured in the Intrusion Policy itself, which the Prefilter Policy only references via the Analyze action. Option D is also not a Prefilter setting: Security Intelligence block lists are configured in the Access Control Policy's Security Intelligence tab, not in the Prefilter Policy.

Answer

Intrusion Policy signature tuning

Answer

Security Intelligence block lists

Question 10

An administrator is configuring security zones on a Cisco Secure Firewall Threat Defense. Which TWO rules regarding security zones and interface assignments are correct? (Choose two)

Accepted Answer

Multiple interfaces (such as physical ports, subinterfaces, or EtherChannels) can be grouped into a single security zone.. Option D is correct because a security zone in Cisco Secure Firewall Threat Defense is a logical grouping that can contain multiple interfaces, including physical ports, subinterfaces, and EtherChannels, allowing consistent policy application across them. Option E is correct because an interface (physical or logical) can belong to only one security zone at a time, preventing conflicting zone-based policy assignments. Option A is incorrect because a security zone does not require a Bridge Virtual Interface (BVI); BVIs are used in transparent mode and are not mandatory for zone membership. Option B is incorrect because security zones are used in Access Control Policies to classify traffic, not to replace them. Option C is incorrect because security zones are supported in both routed and transparent modes, not only transparent mode.

Answer

Every security zone must contain at least one BVI interface.

Answer

Security zones replace the need for Access Control Policies entirely.

Answer

Security zones are only supported in transparent mode and cannot be used in routed mode deployments.

Question 11

An administrator is troubleshooting an issue where Snort inspection engine crashes repeatedly on an FTD device. Which THREE diagnostic artifacts or steps should the administrator collect and perform to assist Cisco TAC in resolving the core dump issue? (Choose three)

Accepted Answer

Collect the generated core dump files located in the core directory (such as /var/common/ or /var/sf/cores/).. Option A is correct because when the Snort inspection engine crashes on an FTD, the resulting core dump files are written to directories such as /var/common/ or /var/sf/cores/, and these binaries are essential for TAC to perform root-cause analysis of the crash. Option C is correct because recording the exact timestamp of the crash along with any preceding intrusion events or traffic patterns helps TAC correlate the core dump with the triggering conditions and reproduce the fault. Option D is correct because generating a full 'system support tech-support' bundle from the FTD CLI captures the complete device state, configuration, logs, and diagnostics that Cisco TAC requires alongside the core files. Option B is incorrect because deleting log files in /var/log destroys forensic evidence and does not address the core dump issue. Option E is incorrect because formatting the flash partition containing the Snort binaries would remove critical software and is a destructive action that would not help diagnose the crash.

Answer

Delete all log files in /var/log to clear disk space before opening a TAC case.

Answer

Format the flash memory partition containing the Snort binaries.

Question 12

An administrator is creating an Access Control Policy rule on the FMC. Which TWO elements are required to create a basic rule? (Choose two)

Accepted Answer

Rule Name. Option A (Rule Name) is correct because the FMC Access Control Policy rule editor requires a unique name to identify the rule within the policy; without a name, the rule cannot be saved. Option C (Action) is correct because every access control rule must specify what happens to matching traffic — Allow, Block, Monitor, Trust, or Block with Reset — and this action determines how the rule is enforced. The remaining options are not mandatory for a basic rule: Source Security Zone (B) is optional and defaults to any zone, Destination Port Object (D) is optional and defaults to any port, and Intrusion Policy assignment (E) is an optional inspection setting applied only when the rule action permits further inspection.

Answer

Source Security Zone

Answer

Destination Port Object

Answer

Intrusion Policy assignment

Question 13

An administrator is troubleshooting high memory utilization on an FMC appliance. Which TWO actions or tools can be used to identify resource-heavy processes or clean up storage? (Choose two)

Accepted Answer

Navigate to Analysis > Health > Monitor to review historical memory utilization graphs and identify anomalies.. Option A is correct because the FMC's Analysis > Health > Monitor page provides Health Monitor graphs, including historical memory utilization, which let the administrator spot trends and anomalies that correlate with resource-heavy periods. Option C is correct because entering expert mode from the FMC CLI gives access to the underlying Linux shell, where standard utilities like 'top' and 'ps' show per-process CPU and memory consumption so the offending process can be identified. Option B is wrong because 'system support memory-dump' is not a valid FMC GUI action for this purpose. Option D is wrong because restarting the Snort inspection engine on the FMC does not identify resource-heavy processes or clean up storage, and Snort typically runs on managed devices rather than the FMC itself. Option E is wrong because 'clear memory cache' is not a valid FMC CLI command.

Answer

Run 'system support memory-dump' from the FMC GUI.

Answer

Restart the Snort inspection engine on the FMC.

Answer

Execute 'clear memory cache' in the FMC CLI.

Question 14

An administrator is troubleshooting intermittent connectivity loss between an FTD managed device and the FMC. Which TWO methods or tools can be used to verify registration and communication status between the managed device and the FMC? (Choose two.)

Accepted Answer

Review the connection status in the FMC GUI under Devices > Device Management.. Option C is correct because the FMC GUI at Devices > Device Management displays each managed device's registration and connectivity state (e.g., 'Up'/'Down' or 'Reachable'), which directly reflects the SFTunnel-based management channel status. Option E is correct because the FTD CLI commands 'show sftunnel status' (or the newer 'sftm status') report the state of the Secure Firewall Tunnel (SFTunnel) that carries management traffic between the FTD and FMC, including peer connectivity and heartbeat information. Option A is wrong because Access Control policy hit counts show traffic matching rules, not the management/registration tunnel status. Option B is wrong because UDP port 514 is syslog, not the SFTunnel management protocol, and capturing on the FMC management interface would not verify registration state. Option D is wrong because the health monitor's 'SNMP Agent' status concerns SNMP polling, not the FTD-to-FMC registration and communication channel.

Answer

Inspect the Access Control policy rule hit counts.

Answer

Run a packet capture on the FMC management interface filtering for UDP port 514.

Answer

Check the health monitor alerts specifically for 'SNMP Agent' status.

Question 15

An administrator is configuring an Access Control Policy on FMC and wants to log all connections that match a specific rule, including the beginning and end of each connection. Which logging action should be selected for the rule?

Accepted Answer

Log at Beginning and End of Connection. The 'Log at Beginning and End of Connection' action generates two events per connection, capturing both initiation and termination. This provides complete visibility for the rule. The other logging options are partial or disabled, so they do not satisfy the need to log the full connection lifecycle.

Answer

Log at Beginning of Connection

Answer

Log None

Answer

Log at End of Connection