300-710 SNCF Practice Exam 2 — 20 Questions

Question 1

Which THREE criteria can be used to match traffic within an Access Control rule on the FMC? (Choose three)

Accepted Answer

URL Categories. Access Control rules support matching based on Networks, Ports, Applications, URL categories, Users, and Zones.

Answer

Intrusion Policy Signatures

Answer

Device Platform Settings

Question 2

An administrator wants to create a Port object group containing TCP ports 80, 443, and 8080 on the FMC. Where is this object configured?

Accepted Answer

Objects > Object Management > Ports. Port object groups and individual ports are created under Objects > Object Management > Ports.

Answer

Policies > Access Control > Ports

Answer

Devices > Device Management > Object Explorer

Answer

System > Configuration > Port Groups

Question 3

An administrator needs to create a Geolocation object in the FMC to block traffic originating from a specific country. Where is this object used?

Accepted Answer

In Access Control rules under the Networks tab as Country objects. Geolocation objects are used directly within Access Control rules under the Source/Destination Country criteria.

Answer

In manual NAT rules under Original Source

Answer

In Identity policies to restrict user login locations

Answer

In Prefilter policies under Geo-FastPath

Question 4

An engineer wants to group several FTD interfaces into a single logical zone to simplify Access Control rule creation. Where are security zones created in the FMC?

Accepted Answer

Objects > Object Management > Security Zones. Security zones are created under Objects > Object Management > Security Zones.

Answer

System > Integration > Security Zones

Answer

Policies > Access Control > Zones

Answer

Devices > Device Management > Interfaces > Zones

Question 5

An administrator needs to configure Active Authentication using a captive portal on an FTD device. Which firewall feature must be properly configured and running to present the authentication prompt to users?

Accepted Answer

HTTP/HTTPS Response Page and Authentication Certificate configuration. Captive portal active authentication requires an HTTP/HTTPS response server configuration on the FTD to intercept unauthenticated HTTP sessions and prompt for credentials.

Answer

Prefilter Bypass rule with SSL Resign

Answer

SNMPv3 trap notification server

Answer

Platform Settings AAA server group for SSH/Telnet

Question 6

An administrator is configuring manual NAT on an FTD device managed by FMC. Which TWO parameters must be defined when creating a manual NAT rule? (Choose two)

Accepted Answer

Original Source. Manual NAT rules require defining the NAT type (Static or Dynamic) and the Original Source (along with other matching parameters like interfaces or destination).

Answer

Prefilter FastPath action

Answer

Security Intelligence Whitelist

Answer

Snort Inspection Engine Mode

Question 7

Which THREE actions can be assigned to an individual rule within an Access Control Policy on the FMC? (Choose three)

Accepted Answer

Allow. Access Control rules support actions such as Allow, Block, Interactive Block, Trust, and Monitor.

Answer

Decrypt

Answer

FastPath

Question 8

When editing an Access Control Rule, which action allows you to drop traffic while simultaneously sending a TCP RST to the client?

Accepted Answer

Block with Reset. The 'Block with Reset' action drops the connection and sends a reset packet to notify the sender.

Answer

Interactive Block

Answer

Block

Answer

Trust

Question 9

You have a large number of NAT rules. How does the FTD process them?

Accepted Answer

Top-down. NAT rules are processed in a top-down order until the first match is found.

Answer

Bottom-up

Answer

Specific to General

Answer

Alphabetical

Question 10

What is the result of applying an 'IPS Policy' to an Access Control Rule?

Accepted Answer

It enables deep packet inspection. The IPS policy enables deep packet inspection for the traffic matched by the rule.

Answer

It bypasses decryption

Answer

It blocks traffic based on IP

Answer

It disables the rule

Question 11

An administrator is planning an Active/Standby High Availability deployment for two Cisco Secure Firewall Threat Defense devices managed by FMC. Which THREE prerequisites must be satisfied before configuring the HA pair? (Choose three)

Accepted Answer

A dedicated link must be available to serve as the stateful failover control and health monitoring link.. HA deployment requires identical hardware models, matching major/minor FTD software versions, and dedicated physical or logical links for stateful failover control.

Answer

The secondary unit must have a higher management IP address than the primary unit.

Answer

Both firewalls must be configured in transparent mode; routed mode is unsupported in HA.

Question 12

An engineer is designing a high-availability architecture utilizing Equal-Cost Multi-Path (ECMP) routing with Cisco Secure Firewall Threat Defense units. Which THREE characteristics or limitations apply to ECMP on FTD? (Choose three)

Accepted Answer

ECMP distributes traffic across multiple equal-cost next-hop routes to optimize bandwidth utilization and path redundancy.. ECMP on FTD balances traffic across multiple paths, requires dynamic routing protocols like OSPF/BGP or static routes, and hashes flows based on packet headers.

Answer

ECMP is restricted exclusively to transparent firewall deployments and cannot be used in routed mode.

Answer

ECMP automatically synchronizes state tables between independent firewall appliances without requiring an HA control link.

Question 13

An administrator is planning the deployment of Cisco Secure Firewall Virtual in a public cloud environment (AWS or Azure). Which TWO deployment practices are recommended for ensuring high availability and performance? (Choose two)

Accepted Answer

Deploy multiple virtual network interfaces (NICs) to separate management, internal, and external traffic paths.. Cloud deployments require proper instance sizing, multiple NIC configurations for separating management and data planes, and cloud-native HA mechanisms.

Answer

Disable Smart Licensing to avoid cloud internet egress fees.

Answer

Use physical serial console cables attached to the hypervisor for initial configuration.

Answer

Rely solely on single-NIC deployments with VLAN subinterfaces trunking all cloud traffic.

Question 14

When using a Redundant Interface, what is the primary behavior during a link failure?

Accepted Answer

The standby link becomes active.. In a redundant interface pair, one link is active and the other is standby. If the active link fails, the FTD automatically switches to the standby link.

Answer

Both links remain active and load balance.

Answer

The FTD triggers a device-level failover.

Answer

Traffic is dropped until manual reset.

Question 15

When defining a NAT rule for an internal server, what happens if the 'DNS Rewrite' option is enabled?

Accepted Answer

The FTD modifies DNS responses. DNS Rewrite modifies the payload of DNS responses to ensure clients reach the correct internal server IP instead of the NAT public IP.

Answer

The FTD forces a DNS query to an external server

Answer

The FTD creates a new NAT object

Answer

The FTD blocks all DNS traffic

Question 16

What is the effect of changing the order of rules in an Access Control Policy?

Accepted Answer

Changes the evaluation sequence. Rules are evaluated top-down; changing the order can cause a rule to be shadowed or never matched.

Answer

No effect

Answer

Resets the device

Answer

Updates the device firmware

Question 17

An FTD device is deployed behind a service provider router that performs NAT, meaning the external IP address assigned to the FTD's outside interface changes dynamically via DHCP. How should a Manual NAT rule be configured to handle outbound traffic referencing this dynamic outside IP?

Accepted Answer

Configure Dynamic PAT using the Outside Interface as the translated address.. When the outside interface IP is dynamic, Manual NAT can use the interface itself as the translated address (Interface PAT).

Answer

Configure Auto NAT with a translated network object set to dynamic.

Answer

Use a static IP address object matching the expected DHCP lease.

Answer

Use Identity NAT with dynamic DHCP options.

Question 18

You are configuring a NAT rule on an FTD device managed by FMC. You need to translate the source IP of internal hosts to a specific public IP address when they access the internet. Which NAT type must be selected in the FMC NAT Rule editor?

Accepted Answer

Dynamic NAT. Dynamic NAT allows mapping a range of internal addresses to a single or range of public addresses, typically used for internet access.

Answer

Identity NAT

Answer

Static NAT

Answer

Policy NAT

Question 19

When creating a network object in FMC, which field allows you to define a group of IP addresses using CIDR notation?

Accepted Answer

Network. The Network object type allows single hosts, ranges, or subnets using CIDR notation.

Answer

Host

Answer

Range

Answer

FQDN

Question 20

If you need to block a specific file type (e.g., .exe) from being downloaded, which feature must you enable in the Access Control Rule?

Accepted Answer

File Policy. File policies are associated with Access Control rules to inspect and block files.

Answer

SSL Policy

Answer

IPS Policy

Answer

QoS Policy