300-710 SNCF Practice Test 20 — 15 Questions

Question 1

An FTD device is deployed behind a service provider router that performs NAT, meaning the external IP address assigned to the FTD's outside interface changes dynamically via DHCP. How should a Manual NAT rule be configured to handle outbound traffic referencing this dynamic outside IP?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Dynamic PAT using the Outside Interface as the translated address.. When the outside interface IP is dynamic, Manual NAT can use the interface itself as the translated address (Interface PAT).

Answer

Configure Auto NAT with a translated network object set to dynamic.

Answer

Use a static IP address object matching the expected DHCP lease.

Answer

Use Identity NAT with dynamic DHCP options.

Question 2

Which FTD command-line tool is primarily used to check interface status and physical link state?

Accepted Answer

show interface. The 'show interface' command provides detailed status on physical link state, speed, and duplex.

Answer

show run

Answer

show service-policy

Answer

show version

Question 3

How do you identify which Access Control Rule triggered a specific connection log?

Accepted Answer

Check the 'Rule Name' field in the connection event. The connection event log contains a field identifying the specific Rule Name that matched.

Answer

Check the 'Policy Name' field

Answer

Check the 'Device Name'

Answer

Check the 'Ingress Zone'

Question 4

An administrator is configuring static route tracking on a Cisco Secure Firewall Threat Defense deployment to handle link failure. If the tracked object goes down, the static route should be removed from the routing table. Where is this configuration managed when using Cisco FMC?

Accepted Answer

Under Devices > Device Management > Routing > Static Route, by editing the route and selecting a Monitor Track object.. In Cisco FMC, static route tracking is configured by editing the static route itself under Devices > Device Management > Routing > Static Route, then selecting a Monitor Track object (SLA monitor) in the route's Track field. When the tracked object goes down, the route is removed from the routing table, enabling failover to a backup route. This is the only supported workflow for route tracking in FTD managed by FMC.

Answer

Under Policies > Access Control > Routing Policies, by enabling SLA tracking hooks.

Answer

Under System > Configuration > High Availability > Route Tracking.

Answer

Under Objects > Object Management > SIEM > Route Track.

Question 5

When configuring Cisco Secure Firewall Threat Defense to forward syslog messages to a remote SIEM receiver, which transport layer protocols are natively supported for syslog export?

Accepted Answer

UDP and TCP. Cisco Secure Firewall Threat Defense supports both UDP and TCP (including reliable syslog over TCP) for transmitting syslog messages to external SIEMs.

Answer

HTTP and HTTPS only

Answer

UDP only

Answer

TCP and SCTP

Question 6

An administrator needs to determine if the FMC has enough disk space to hold a new software upgrade image. Which menu should they check?

Accepted Answer

System > Health > Monitor. FMC displays disk space and other appliance health metrics under System > Health > Monitor, where the administrator can view disk utilization for the FMC and managed devices. This is the correct menu to confirm whether enough disk space exists for a new software upgrade image.

Answer

Devices > Device Management > System

Answer

Policies > Settings

Answer

System > Configuration > Disk

Answer

System > Updates > Disk Space

Question 7

When configuring an Access Control Policy on the FMC, what is the purpose of the Default Action set at the bottom of the rules table?

Accepted Answer

It defines the action taken for traffic that matches no explicit rules in the policy.. The Default Action at the bottom of the FMC Access Control Policy rules table specifies what happens to traffic that does not match any explicit rule above it. Common settings are Block (default deny) or Allow (permit), and it can also invoke an intrusion policy or send to a captive portal.

Answer

It sets the global timeout values for all TCP connections.

Answer

It acts as a prefilter rule for dropped packets.

Answer

It forces all unmatched traffic to be sent to the Cisco Cloud for telemetry.

Question 8

An administrator is configuring Security Intelligence feeds on the FMC. Which TWO types of objects or feeds can be used to populate Security Intelligence blacklists? (Choose two)

Accepted Answer

Custom Network/IP Lists (Objects). Security Intelligence supports custom network/IP lists and Cisco provided dynamic feeds (like reputation feeds for URLs and IPs).

Answer

Local user identity realm database

Answer

Prefilter fast-path exclusion rules

Answer

QoS class map profile objects

Question 9

An engineer is configuring a Cisco Secure Firewall Threat Defense cluster in a data center. To ensure high availability and prevent split-brain scenarios, what is the specific function of the cluster control link (CCL)?

Accepted Answer

It synchronizes configuration, connection state tables, and heartbeat health checks between cluster members.. The cluster control link (CCL) is a dedicated network used by FTD cluster members to synchronize configuration, replicate connection state tables, and exchange heartbeat health checks. It ensures that all nodes have consistent state and can detect failures, preventing split-brain by allowing the master unit to be elected and maintained. It is not a data forwarding path for normal traffic.

Answer

It serves as the dedicated data forwarding path for all east-west traffic between different subnets.

Answer

It offloads all Snort inspection processing from data nodes to the control node.

Answer

It connects the cluster directly to the Cisco FMC management cloud over an encrypted TLS tunnel.

Question 10

An administrator is planning the deployment of a Cisco Secure Firewall Threat Defense device and needs to choose between routed mode and transparent mode. Which factor strongly favors choosing transparent mode?

Accepted Answer

The firewall needs to be inserted into an existing IP subnet without altering current gateway or routing designs.. Transparent mode (also called Layer 2 mode) on Cisco Secure Firewall Threat Defense allows the device to be inserted into an existing network segment without requiring IP addressing changes on the firewall interfaces or modifications to the surrounding routing topology. Because the FTD bridges traffic between its interfaces, hosts on the same subnet keep their existing default gateway, and no routing protocol adjacencies need to be re-established. This makes transparent mode ideal for drop-in deployments where changing the IP schema or gateway design is not feasible.

Answer

The network requires advanced NAT, PAT, and dynamic routing protocols like OSPF and BGP.

Answer

The deployment requires termination of site-to-site IPsec VPN tunnels.

Answer

The firewall must act as the default gateway for multiple VLAN segments.

Question 11

What action should you take if you want to test a new Access Control Rule without impacting production traffic?

Accepted Answer

Use the 'Monitor' action. The Monitor action in an Access Control Rule allows traffic to pass while logging it, without enforcing any block or trust action. This is ideal for testing a new rule because it does not impact production traffic—traffic is still allowed but you can see what would have matched. It provides visibility without disruption.

Answer

Delete the rule

Answer

Use the 'Block' action

Answer

Use the 'Trust' action

Question 12

You are configuring an SSL Decryption policy. Which action is required to ensure that traffic to a specific financial website is excluded from inspection due to compliance reasons?

Accepted Answer

Do Not Decrypt. The 'Do Not Decrypt' action in an SSL Decryption policy explicitly excludes matching traffic from decryption, which is the correct choice for compliance reasons such as financial data that must not be inspected. This action ensures the traffic passes through without being decrypted or resigned, satisfying legal and privacy requirements.

Answer

Decrypt - Resign

Answer

Bypass

Answer

Block

Question 13

An administrator needs to restore an FMC configuration backup onto a replacement hardware appliance. Which of the following conditions must be met for the backup restoration to succeed successfully?

Accepted Answer

The target FMC must run the exact same software version and patch level as the source appliance.. FMC backup restoration requires that the target appliance run the exact same software version and patch level as the source appliance that produced the backup. The backup archive contains version-specific database schemas and configuration structures, so a mismatch in version or patch level will cause the restore to fail or produce an inconsistent configuration. Cisco documentation explicitly states this as a prerequisite for successful restoration.

Answer

Smart Licensing must be disabled on the target appliance prior to importing the backup.

Answer

The target FMC must be running a newer major software version than the backup file.

Answer

The target appliance hardware model must be different to allow schema remapping.

Question 14

An administrator notices that the FMC Health Monitor shows a 'Critical' alert for the Snort process utilization on an FTD device. What is the most appropriate first-line troubleshooting step from the FMC GUI or FTD CLI to investigate the cause of high Snort CPU usage?

Accepted Answer

Check the Snort performance statistics and rule update status via Devices > Device Management > Advanced > Snort Statistics.. The most appropriate first-line troubleshooting step is to check Snort performance statistics and rule update status via Devices > Device Management > Advanced > Snort Statistics in the FMC GUI. This provides visibility into Snort's CPU usage, packet processing rates, and rule-related metrics that can reveal whether the issue stems from rule complexity, traffic volume, or a recent rule update. It is a non-disruptive diagnostic step that gathers data before any remediation.

Answer

Restart the database process via 'pmtool restartbyname mysqld'.

Answer

Change the Access Control policy action from 'Inspect' to 'Block' globally without logging.

Answer

Delete all custom intrusion rules immediately to clear the buffer.

Question 15

An administrator is troubleshooting a high availability (HA) failover link failure between two FTD physical appliances. Which THREE checks should be performed to diagnose physical and logical connectivity between the failover interfaces? (Choose three)

Accepted Answer

Verify physical link lights (LEDs) and cable integrity on the dedicated failover interfaces.. Option A is correct because verifying physical link lights (LEDs) and cable integrity on the dedicated failover interfaces is the first step to confirm Layer 1 connectivity, since a failed or unplugged cable or dead interface will prevent any failover communication. Option B is correct because the 'show failover' command on the FTD diagnostic CLI reports mate status, failover link state, and interface monitoring states, directly revealing whether the failover link is up or down and whether the peer is reachable. Option C is correct because if Layer 3 failover is used, the dedicated failover interfaces must have valid IP addresses in the same subnet and be ping-reachable; checking IP configuration and ping reachability validates logical connectivity across that subnet. Option D is not relevant because changing the management IP address does not diagnose or repair the dedicated failover link and could disrupt management access. Option E is not relevant because rebooting the FMC does not restart failover polling between FTD appliances; failover is handled by the FTD data plane, not the management center.

Answer

Change the FTD management IP address on both units.

Answer

Reboot the FMC to restart failover polling.