300-710 SNCF Practice Exam 1 — 20 Questions

Question 1

You are configuring SSL decryption. To ensure that traffic to a specific financial domain is NOT decrypted due to privacy regulations, what must you configure in the SSL Decryption Policy?

Accepted Answer

Configure an SSL rule with the 'Do Not Decrypt' action. The 'Do Not Decrypt' action is used in SSL policies to bypass inspection for specific URLs or categories.

Answer

Use a 'Monitor' action in the SSL policy

Answer

Create an Access Control Rule with a 'Decrypt' action

Answer

Add the domain to the Prefilter Policy

Question 2

An administrator is configuring a Manual NAT rule in the FMC for an internal server that needs to be accessed from the outside zone. The internal IP is 192.168.1.50, and it must be translated to a public IP 203.0.113.10. Which TWO configuration parameters must be specified when defining this Manual NAT rule? (Choose two)

Accepted Answer

Original Source. Manual NAT rules require defining the Source Interface (original source zone/interface), Destination Interface (translated destination zone/interface), Original Source IP, and Translated Source IP.

Answer

Interface PAT (PAT Pool)

Answer

ARP Inspection Profile

Answer

DNS Resolution Option

Question 3

Which type of object is best suited for defining a web server's public-to-private NAT mapping?

Accepted Answer

Network object (Host). A Host object representing the specific server IP is required for precise Static NAT mapping.

Answer

VLAN object

Answer

Port object

Answer

Network object (Group)

Question 4

How do you ensure that a specific host object is only used in a specific interface?

Accepted Answer

Use an Interface Object. By using the 'Interface Objects' feature in FMC, you can restrict where a network object is valid.

Answer

Use a VLAN group

Answer

Use a Security Zone

Answer

Use a Port object

Question 5

An administrator is configuring a new Access Control Policy on the Firepower Management Center and needs to add a rule that blocks peer-to-peer file sharing applications regardless of port. Which rule type should the administrator select?

Accepted Answer

Access control rule. Access Control Rules of type Access are used to allow, block, or inspect traffic. To block applications regardless of port, the administrator uses the Applications tab within an Access rule.

Answer

NAT rule

Answer

Identity rule

Answer

Prefilter rule

Question 6

An administrator is setting up a new Cisco Firepower Threat Defense device and needs to configure platform-level parameters using FMC Platform Settings. Which TWO features can be configured via Platform Settings? (Choose two)

Accepted Answer

SNMP parameters. Platform Settings manage device-level settings such as Syslog/logging configuration, SNMP, Time Synchronization (NTP), and Banner settings. Access Control Policies and NAT are configured elsewhere.

Answer

SSL Decryption Certificate assignment

Answer

Network Address Translation (NAT)

Answer

Access Control Policy rules

Question 7

Which THREE settings can be configured within a Prefilter Policy on the FMC? (Choose three)

Accepted Answer

FastPath action to bypass Snort inspection. Prefilter policies support FastPath, Tunnel rules, and Default Actions (Analyze or FastPath).

Answer

Intrusion Policy signature tuning

Answer

Security Intelligence block lists

Question 8

Which THREE components of an Access Control rule can be used to identify traffic as 'Application' based?

Accepted Answer

Application Category. Applications are identified by the App-ID engine, which uses signatures, categories, and tags.

Answer

Device Type

Answer

OS Version

Question 9

An enterprise requires FTD to decrypt outbound SSL/TLS traffic so internal users visiting external websites can be inspected by Snort for malware. Which policy and action combination must be configured?

Accepted Answer

SSL/TLS Decryption Policy with Decrypt - Resign action. Outbound SSL decryption requires an SSL/TLS Decryption Policy with a 'Decrypt - Resign' action using an internal subordinate CA certificate.

Answer

Prefilter Policy configured with SSL Bypass

Answer

SSL/TLS Decryption Policy with Decrypt - Inbound action

Answer

Access Control Policy with Malware Inspection enabled and no SSL policy

Question 10

An administrator needs to create a variable set to define specific port or network variables used within Intrusion Rules. Where are variable sets managed in the FMC?

Accepted Answer

Objects > Object Management > Variable Sets. Variable sets are managed under Objects > Object Management > Variable Sets.

Answer

Devices > Device Management > Variables

Answer

System > Localized Variables

Answer

Policies > Access Control > Variables

Question 11

An administrator wants to create a Prefilter policy to fast-path (bypass Snort inspection for) a trusted backup stream between two data centers. Which action type should be selected in the Prefilter rule?

Accepted Answer

FastPath. The FastPath action in a Prefilter policy allows matching traffic to bypass Snort inspection for performance optimization.

Answer

Monitor

Answer

Block

Answer

Inspect

Answer

Trust

Question 12

An administrator wants to decrypt inbound HTTPS traffic destined for a public web server behind a Firepower Threat Defense device. Which type of SSL/TLS decryption policy must be configured on the FMC?

Accepted Answer

Decrypt - Inbound. Decrypt - Inbound is used when the FTD device holds the private key of the server to decrypt inbound traffic destined for internal protected servers.

Answer

SSL Decryption - Do Not Decrypt

Answer

Decrypt - Resign

Answer

SSL Inspection Policy - Outbound

Question 13

An engineer is configuring a QoS policy on an FMC-managed FTD and needs to police traffic to a maximum bandwidth limit on an interface. Which shaping/policing parameter must be configured?

Accepted Answer

Traffic Policing with specified Committed Information Rate (CIR). Interface-based QoS rate limiting uses police parameters to cap bandwidth for traffic matching the QoS policy.

Answer

Prefilter FastPath Rate Cap

Answer

Access Control Rate Limiting action

Answer

Random Early Detection (RED) drop threshold

Question 14

An administrator configures an Identity Policy on the FMC to authenticate users via Active Directory using captive portal. Where is the Identity Policy applied within the Firepower configuration hierarchy?

Accepted Answer

Within the Access Control Policy settings on the FMC. Identity policies are associated directly with an Access Control Policy under the Advanced tab or specific settings, which links the user mapping to traffic inspection.

Answer

Directly under Devices > Device Management > Platform Settings

Answer

Inside the SSL/TLS Decryption Policy

Answer

As a standalone rule inside a Prefilter Policy

Question 15

An administrator configures a security intelligence feed in the FMC to block known malicious IP addresses. Where are Security Intelligence feeds and lists applied in the FMC configuration?

Accepted Answer

Under the Security Intelligence tab of the Access Control Policy. Security Intelligence is configured globally per Access Control Policy under the Security Intelligence tab to drop bad traffic before evaluation against regular access rules.

Answer

Directly inside the Prefilter policy configuration

Answer

Within individual Access Control rules under the Source/Destination tabs

Answer

Under Objects > Security Intelligence > Rule Mapping

Question 16

An administrator needs to configure manual NAT on an FTD device to translate both the source IP and source port of outbound packets originating from 192.168.2.50 to a specific public IP 198.51.100.10 and port 50000. Which manual NAT rule element achieves this?

Accepted Answer

Manual NAT rule with Translated Source set to an IP object and dynamic port translation enabled. Manual NAT rules allow specifying Original Source, Translated Source (IP), and Port translation options to achieve Port Address Translation.

Answer

Static NAT with Bi-directional enabled

Answer

Auto NAT rule configured with Dynamic PAT

Answer

Identity NAT with Port Forwarding enabled

Question 17

An administrator configures an SSL Decryption Policy with a rule to 'Do Not Decrypt' financial traffic. However, the administrator also wants to ensure that the encrypted session still undergoes basic certificate validation and categorization. How does FTD handle 'Do Not Decrypt' traffic?

Accepted Answer

The FTD extracts SNI and performs URL categorization using the unencrypted Client Hello handshake.. Even when traffic is set to Do Not Decrypt, FTD can inspect the TLS handshake (Client Hello) to extract SNI, categorize the URL, and validate basic certificate attributes without decrypting the payload.

Answer

All inspection, including URL categorization and SNI extraction, is completely bypassed.

Answer

The FTD converts the traffic to plaintext using a self-signed proxy certificate.

Answer

The FTD drops the connection because decryption is mandatory for any inspection.

Question 18

An administrator is configuring Security Intelligence in FMC. Which TWO types of objects can be added to Security Intelligence blacklists or whitelists? (Choose two)

Accepted Answer

URL objects. Security Intelligence supports IP address objects/networks and URL objects/feeds.

Answer

Intrusion policy objects

Answer

Security Zone objects

Answer

Application filter objects

Question 19

An administrator wants to group multiple existing port objects (e.g., TCP 80, TCP 443, TCP 8080) into a single object for use in Access Control Policy rules. Which object container should be created?

Accepted Answer

Port Group Object. Port Group objects allow administrators to combine multiple port or port range objects into a single manageable item.

Answer

Port Object

Answer

Protocol Object

Answer

Application Filter Object

Question 20

An administrator needs to configure an identity policy to authenticate users using an external RADIUS server via Passive Authentication. Which mechanism accomplishes passive user identification?

Accepted Answer

Cisco ISE pxGrid / Firepower User Agent. Passive authentication maps users without prompting them for credentials, typically achieved using Cisco Firepower User Agent or ISE pxGrid integration.

Answer

Captive Portal

Answer

RADIUS Challenge-Response prompt

Answer

HTTP Basic Authentication challenge