300-710 SNCF Practice Exam 1 — 20 Questions

Question 1

Which protocol is natively used by Cisco Secure Firewall Management Center to stream connection and intrusion events to external SIEM systems in real time?

Accepted Answer

eStreamer. eStreamer is Cisco's proprietary protocol and API used for streaming security events from FMC to SIEMs.

Answer

HTTP SOAP

Answer

TFTP

Answer

NetFlow v9

Question 2

An engineer is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) in Google Cloud Platform (GCP). The architecture requires multiple network interfaces. How does GCP map these interfaces during deployment?

Accepted Answer

GCP allows multiple discrete NICs per instance, with nic0 assigned to management and subsequent NICs mapped to data subnets.. GCP allows multiple Network Interface Cards (NICs) on a single compute instance, where nic0 is typically assigned for management and subsequent nic1, nic2, etc., are assigned for data traffic.

Answer

GCP requires all data traffic to pass through an external HTTP(S) load balancer before reaching nic0.

Answer

GCP supports only a single interface per VM; all VLAN subinterfaces must be trunked through nic0.

Answer

GCP virtual machines cannot be managed by Cisco FMC; they require deployment via Google Deployment Manager only.

Question 3

When configuring ECMP (Equal-Cost Multi-Path) on FTD, what happens if one of the next-hop paths fails?

Accepted Answer

Traffic is automatically load-balanced across the remaining active paths.. FTD monitors the routes; if a path fails, the FTD removes that specific route from the routing table, and traffic is automatically redistributed across the remaining paths.

Answer

Traffic is dropped until manual intervention.

Answer

The entire cluster enters a maintenance mode.

Answer

All traffic is rerouted to the primary management interface.

Question 4

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO fields or parameters can be included in the syslog output to facilitate incident investigation and event parsing by the SIEM? (Choose two)

Accepted Answer

Precise timestamp formatting (UTC or local time) configured in Platform Settings. Option B is correct because the syslog timestamp format (UTC or local time) is configurable under Platform Settings > Syslog in FTD, and consistent, precise timestamps are essential for correlating events across the SIEM and establishing accurate incident timelines. Option D is correct because including the firewall device name or identifier in the syslog header lets the SIEM attribute each event to its originating sensor, which is critical in multi-device deployments for parsing, filtering, and investigation. The remaining options are not valid syslog fields: a full memory core dump (A) is a diagnostic binary artifact, not syslog content; FMC administrator SSH private keys (C) are credentials that must never be transmitted in logs; and raw PCAP data (E) is captured separately via packet capture tools and cannot be embedded as text in syslog messages.

Answer

Full memory core dump binary attachments

Answer

FMC administrator SSH private keys

Answer

Raw packet captures (PCAP) of dropped connections embedded in syslog text

Question 5

An administrator is integrating Cisco Secure Firewall Threat Defense with Cisco Identity Services Engine (ISE) using Platform Exchange Services (pxGrid). Which service must be enabled and running on the ISE nodes for pxGrid communication to succeed?

Accepted Answer

Cisco pxGrid Service. pxGrid must be enabled on the designated ISE nodes so that Cisco Secure Firewall Threat Defense can subscribe to user identity and session updates.

Answer

IPAM Synchronization Service

Answer

RADIUS Accounting Service

Answer

TACACS+ Authentication Service

Question 6

An administrator configures pxGrid integration between Cisco ISE and Cisco Secure Firewall Threat Defense. During the certificate enrollment process, the firewall fails to trust the ISE pxGrid node. What is the most likely root cause of this failure in a standalone FMC deployment?

Accepted Answer

The ISE pxGrid root CA certificate is not imported into the FMC trusted certificates store.. For pxGrid communication to establish successfully, the ISE pxGrid node certificate and FMC/Firewall pxGrid certificate must be signed by a mutually trusted Certificate Authority (CA), and the CA root certificate must be imported into the FMC trusted certificates store.

Answer

The SXP secret password does not match between ISE and the firewall.

Answer

The pxGrid subscriber profile on ISE was not approved within 24 hours.

Answer

RADIUS shared secrets are mismatched on the Policy Service Nodes.

Question 7

An administrator is troubleshooting a Prefilter Policy configured on an FMC. Which THREE actions are available when creating a rule in a Prefilter Policy? (Choose three)

Accepted Answer

Slow Path (send traffic through normal inspection pipeline). In an FMC Prefilter Policy, each rule can take one of three actions: Block, which drops matching traffic immediately without further inspection (option D); Fast Path, which bypasses the inspection pipeline and fast-forwards traffic (option E); and Slow Path, which sends traffic through the normal inspection pipeline for further analysis (option C). These three actions are the only ones available at the prefilter stage, which exists to reduce the load on the Snort inspection engine by handling traffic before it reaches the access control policy. Option A (Decrypt - Resign) is an SSL policy action, not a prefilter rule action, and option B (Inspect with Snort 3 Intrusion Prevention) is an access control rule action, so neither belongs in a Prefilter Policy rule.

Answer

Decrypt - Resign (intercept and re-sign SSL certificate)

Answer

Inspect with Snort 3 Intrusion Prevention

Question 8

What is the primary function of a 'Security Zone' in FMC?

Accepted Answer

To logically group interfaces. Security Zones allow applying the same policy to multiple interfaces at once.

Answer

To set bandwidth limits

Answer

To enable routing

Answer

To define IP ranges

Question 9

An engineer is configuring a QoS policy on an FMC-managed FTD and needs to police traffic to a maximum bandwidth limit on an interface. Which shaping/policing parameter must be configured?

Accepted Answer

Traffic Policing with specified Committed Information Rate (CIR). Traffic policing on FTD is configured via a QoS policy that enforces a maximum bandwidth limit using a Committed Information Rate (CIR). The CIR defines the average rate allowed, and traffic exceeding it is dropped or marked down, directly capping bandwidth. This is the standard mechanism for rate limiting on an interface in Cisco Secure Firewall, and it must be applied through the FMC QoS policy.

Answer

Prefilter FastPath Rate Cap

Answer

Access Control Rate Limiting action

Answer

Random Early Detection (RED) drop threshold

Question 10

Which TWO settings are available when configuring the 'Logging' tab in an Access Control Rule?

Accepted Answer

Log at End. In Cisco Firepower Management Center, an Access Control Rule's Logging tab lets you choose when to generate connection events for traffic matching the rule, and the two available timing settings are 'Log at Beginning' (option E) and 'Log at End' (option D). 'Log at Beginning' generates a connection event when the connection is first seen, which is useful for capturing attempted connections even if they are later blocked or never complete. 'Log at End' generates the event when the connection closes, providing full session details such as bytes sent/received and duration. 'Log to Cloud' (A) is not a logging-timing option in the Access Control Rule Logging tab, and 'Log every packet' (B) and 'Log at Middle' (C) are not valid settings for this tab.

Answer

Log to Cloud

Answer

Log every packet

Answer

Log at Middle

Question 11

Which TWO of the following are benefits of using a Port Channel on an FTD?

Accepted Answer

Improved link redundancy.. Option A is correct because a Port Channel (EtherChannel/LACP or static) bundles multiple physical interfaces into one logical interface, so if a member link fails, traffic continues over the remaining links, providing link redundancy without a topology change. Option E is correct because the bundled member links share traffic through the hashing algorithm, so the logical interface's throughput is the aggregate of its members, increasing total available bandwidth beyond a single link. Options B, C, and D are not benefits of a Port Channel: it does not inherently reduce latency, it does not eliminate spanning tree (STP still runs on the logical bundle and the FTD still participates in loop prevention), and it has nothing to do with automatic NAT mapping, which is a separate FTD NAT policy function.

Answer

Reduced latency.

Answer

Elimination of spanning tree.

Answer

Automatic NAT mapping.

Question 12

In routed mode, what is the purpose of the 'Name' assigned to an interface?

Accepted Answer

To define the interface for use in security policies and NAT.. The name assigned to an interface (e.g., 'outside') is used in policy rules and NAT definitions to identify the zone or security level.

Answer

To define the failover priority.

Answer

To change the speed of the physical interface.

Answer

To set the MAC address.

Question 13

An administrator wants to ensure that all security event logs from Cisco Secure Firewall Threat Defense are exported reliably and in real time to external security analytics tools. Which TWO deployment and configuration practices should be implemented? (Choose two)

Accepted Answer

Configure Reliable Syslog (TCP with TLS) in FTD Platform Settings to ensure encrypted and guaranteed log delivery.. Option B is correct because configuring Reliable Syslog in FTD Platform Settings uses TCP with TLS (port 6514 by default) to provide encrypted, connection-oriented, acknowledged delivery of syslog events, which prevents log loss and satisfies the requirement for reliable, real-time export to external analytics tools. Option D is correct because eStreamer on the FMC streams intrusion, connection, malware, and other security events in near real time to a SIEM collector over a persistent TLS connection, which is the Cisco-recommended method for feeding external security analytics platforms. Option A is wrong because local disk storage with weekly manual SCP exports is neither real-time nor reliable, and risks losing events if the disk fills or the device fails. Option C is wrong because disabling the Snort engine would stop intrusion event generation entirely and does not address log transport. Option E is wrong because SNMPv1 traps only carry event counters and are unencrypted, unacknowledged, and not designed for streaming detailed security event logs.

Answer

Rely solely on local FTD disk storage and export logs via manual SCP once a week.

Answer

Disable the Snort engine to prevent log buffer congestion.

Answer

Configure SNMPv1 traps to poll event counters every 60 seconds.

Question 14

You are setting up an FTD interface. What is the difference between a 'Routed' and 'Transparent' interface mode?

Accepted Answer

Transparent mode operates at L2. A Transparent (L2) interface mode on FTD bridges traffic between interfaces without modifying IP headers, operating at Layer 2 like a bump-in-the-wire switch. Routed mode, by contrast, acts as a Layer 3 hop with IP addresses and routing decisions.

Answer

Routed mode does not support VLANs

Answer

Transparent mode requires a default gateway

Answer

Routed mode requires NAT

Question 15

An administrator is configuring third-party SIEM integration using eStreamer. The external client application encounters a TLS handshake failure when attempting to connect to the FMC eStreamer port. What is the standard troubleshooting step to resolve certificate validation issues between an external eStreamer client and the FMC?

Accepted Answer

Generate a new pkcs12 client certificate bundle from the FMC eStreamer configuration menu and import it into the client application store.. When setting up an external eStreamer client, the administrator must generate a PKCS#12 (.pfx or .pem) client certificate bundle and copy the corresponding CA certificate to the client host so that mutual TLS authentication succeeds.

Answer

Disable SSL/TLS verification in the FMC Platform Settings under the eStreamer daemon parameters.

Answer

Restart the Snort inspection engine on all managed FTD devices.

Answer

Change the eStreamer listening port from 8302 to 443 in the FMC System Preferences.

Question 16

An FMC high availability (HA) pair has split-brain symptoms due to a management network failure. After restoring network connectivity, the standby unit remains in a 'Failed' state and does not automatically re-synchronize. What is the correct procedure to recover the HA sync?

Accepted Answer

Go to System > Integration > HA, break the HA pairing, and re-establish it using the active unit as the primary.. When an FMC HA pair experiences split-brain and the standby unit remains in a 'Failed' state after network restoration, the correct recovery is to break the HA pairing and re-establish it using the active unit as the primary. This forces a clean re-synchronization and resolves the failed state.

Answer

Run 'system support fmc-ha-sync' from the standby FMC CLI.

Answer

Reboot both FMC units simultaneously.

Answer

From the primary FMC CLI, run 'configure ha restore-sync'.

Question 17

An administrator needs to troubleshoot a routing issue on an FTD device managed by FMC. Where in the FMC GUI should the administrator navigate to view and modify static and dynamic routing configurations for the device?

Accepted Answer

Devices > Device Management > Edit Device > Routing tab. To view and modify static and dynamic routing configurations for an FTD device in FMC, the administrator navigates to Devices > Device Management, edits the device, and selects the Routing tab. This tab provides access to static routes, dynamic routing protocols (OSPF, BGP, EIGRP), and related routing settings for that specific device.

Answer

Objects > Object Management > Network > Routes

Answer

System > Configuration > Network Settings

Answer

Policies > Access Control > Routing

Question 18

Which menu in the FMC allows you to view the list of managed FTD devices?

Accepted Answer

Devices > Device Management. Devices > Device Management is the primary menu for managing all FTD nodes.

Answer

Policies > Devices

Answer

Analysis > Devices

Answer

System > Devices

Question 19

Which option in the Access Control Policy rule allows you to define a specific application, such as 'Facebook', to be blocked?

Accepted Answer

Applications. The 'Applications' tab in an Access Control Rule allows selection of specific applications for blocking or monitoring.

Answer

URL

Answer

Zones

Answer

Ports

Question 20

An engineer is troubleshooting a newly deployed FTD device where syslog messages are not reaching the external syslog server. Which tool on the FTD CLI can the engineer use to verify if the syslog generation and transmission process is attempting to send packets out the management or data interface?

Accepted Answer

Capture traffic on the designated egress interface matching the syslog server IP and UDP port 514.. To verify if syslog packets are being sent out the correct interface, the engineer should capture traffic on the designated egress interface matching the syslog server IP and UDP port 514. This will show whether the FTD is attempting to transmit syslog messages and on which interface.

Answer

Run 'debug syslog all' from the FTD expert mode.

Answer

Use 'system support reset-logging'.

Answer

Check the FMC dashboard under System > Logging > Syslog status.