300-710 SNCF Practice Test 2 — 10 Questions

Question 1

An administrator wants to create a Prefilter policy to fast-path (bypass Snort inspection for) a trusted backup stream between two data centers. Which action type should be selected in the Prefilter rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FastPath. The FastPath action in a Prefilter policy allows matching traffic to bypass Snort inspection for performance optimization.

Answer

Monitor

Answer

Block

Answer

Inspect

Answer

Trust

Question 2

An administrator wants to decrypt inbound HTTPS traffic destined for a public web server behind a Firepower Threat Defense device. Which type of SSL/TLS decryption policy must be configured on the FMC?

Accepted Answer

Decrypt - Inbound. Decrypt - Inbound is used when the FTD device holds the private key of the server to decrypt inbound traffic destined for internal protected servers.

Answer

SSL Decryption - Do Not Decrypt

Answer

Decrypt - Resign

Answer

SSL Inspection Policy - Outbound

Question 3

An engineer is configuring a QoS policy on an FMC-managed FTD and needs to police traffic to a maximum bandwidth limit on an interface. Which shaping/policing parameter must be configured?

Accepted Answer

Traffic Policing with specified Committed Information Rate (CIR). Interface-based QoS rate limiting uses police parameters to cap bandwidth for traffic matching the QoS policy.

Answer

Prefilter FastPath Rate Cap

Answer

Access Control Rate Limiting action

Answer

Random Early Detection (RED) drop threshold

Question 4

An administrator configures an Identity Policy on the FMC to authenticate users via Active Directory using captive portal. Where is the Identity Policy applied within the Firepower configuration hierarchy?

Accepted Answer

Within the Access Control Policy settings on the FMC. Identity policies are associated directly with an Access Control Policy under the Advanced tab or specific settings, which links the user mapping to traffic inspection.

Answer

Directly under Devices > Device Management > Platform Settings

Answer

Inside the SSL/TLS Decryption Policy

Answer

As a standalone rule inside a Prefilter Policy

Question 5

An administrator configures a security intelligence feed in the FMC to block known malicious IP addresses. Where are Security Intelligence feeds and lists applied in the FMC configuration?

Accepted Answer

Under the Security Intelligence tab of the Access Control Policy. Security Intelligence is configured globally per Access Control Policy under the Security Intelligence tab to drop bad traffic before evaluation against regular access rules.

Answer

Directly inside the Prefilter policy configuration

Answer

Within individual Access Control rules under the Source/Destination tabs

Answer

Under Objects > Security Intelligence > Rule Mapping

Question 6

An administrator needs to configure manual NAT on an FTD device to translate both the source IP and source port of outbound packets originating from 192.168.2.50 to a specific public IP 198.51.100.10 and port 50000. Which manual NAT rule element achieves this?

Accepted Answer

Manual NAT rule with Translated Source set to an IP object and dynamic port translation enabled. Manual NAT rules allow specifying Original Source, Translated Source (IP), and Port translation options to achieve Port Address Translation.

Answer

Static NAT with Bi-directional enabled

Answer

Auto NAT rule configured with Dynamic PAT

Answer

Identity NAT with Port Forwarding enabled

Question 7

An administrator configures an SSL Decryption Policy with a rule to 'Do Not Decrypt' financial traffic. However, the administrator also wants to ensure that the encrypted session still undergoes basic certificate validation and categorization. How does FTD handle 'Do Not Decrypt' traffic?

Accepted Answer

The FTD extracts SNI and performs URL categorization using the unencrypted Client Hello handshake.. Even when traffic is set to Do Not Decrypt, FTD can inspect the TLS handshake (Client Hello) to extract SNI, categorize the URL, and validate basic certificate attributes without decrypting the payload.

Answer

All inspection, including URL categorization and SNI extraction, is completely bypassed.

Answer

The FTD converts the traffic to plaintext using a self-signed proxy certificate.

Answer

The FTD drops the connection because decryption is mandatory for any inspection.

Question 8

An administrator is configuring Security Intelligence in FMC. Which TWO types of objects can be added to Security Intelligence blacklists or whitelists? (Choose two)

Accepted Answer

URL objects. Security Intelligence supports IP address objects/networks and URL objects/feeds.

Answer

Intrusion policy objects

Answer

Security Zone objects

Answer

Application filter objects

Question 9

An administrator wants to group multiple existing port objects (e.g., TCP 80, TCP 443, TCP 8080) into a single object for use in Access Control Policy rules. Which object container should be created?

Accepted Answer

Port Group Object. Port Group objects allow administrators to combine multiple port or port range objects into a single manageable item.

Answer

Port Object

Answer

Protocol Object

Answer

Application Filter Object

Question 10

An administrator needs to configure an identity policy to authenticate users using an external RADIUS server via Passive Authentication. Which mechanism accomplishes passive user identification?

Accepted Answer

Cisco ISE pxGrid / Firepower User Agent. Passive authentication maps users without prompting them for credentials, typically achieved using Cisco Firepower User Agent or ISE pxGrid integration.

Answer

Captive Portal

Answer

RADIUS Challenge-Response prompt

Answer

HTTP Basic Authentication challenge