300-710 SNCF Practice Exam 3 — 20 Questions

Question 1

What occurs when an 'Interactive Block' action is used in an Access Control rule?

Accepted Answer

The user receives a notification page. The user is shown a page explaining why the traffic was blocked and given an option to proceed.

Answer

The traffic is dropped

Answer

The traffic is automatically allowed

Answer

The rule is ignored

Question 2

An enterprise network design incorporates Equal-Cost Multi-Path (ECMP) routing across two Cisco Secure Firewall Threat Defense units functioning independently in routed mode. What is the primary benefit of enabling ECMP on the firewalls?

Accepted Answer

It enables the firewall to balance outbound traffic across multiple next-hop gateways using multiple equal-cost routes.. ECMP allows the firewall to install multiple equal-cost paths to the same destination in its routing table, distributing traffic across multiple next-hop routers for load balancing and redundancy.

Answer

It allows passive NGIPS interfaces to share inspection load without SPAN replication.

Answer

It pools the CPU and memory resources of both firewalls into a single logical cluster.

Answer

It synchronizes connection state tables across both independent firewalls for zero-loss failover.

Question 3

An organization is planning to deploy a Cisco Secure Firewall Threat Defense Cluster using three Secure Firewall 9300 security modules to handle a massive aggregate throughput requirement. Which consideration is critical when designing this cluster?

Accepted Answer

All security modules in the cluster must be identical in model, memory, and interface module composition.. In a firewall cluster, one unit is automatically elected as the control node, while the others act as data nodes. All units share a common configuration and distributed connection table, but session handling is managed across the cluster nodes via a central cluster control link.

Answer

Cluster nodes can be spread across different geographical data centers over high-latency WAN links.

Answer

The control node processes all data traffic while data nodes only handle control plane heartbeats.

Answer

Clustering requires transparent mode; routed mode is unsupported on clustered Secure Firewall platforms.

Question 4

An Identity Policy is configured on the FMC to authenticate users connecting through the FTD. The administrator wants to use Active Directory as the identity source. Which mechanism must be configured to map user IP addresses to usernames without requiring explicit web authentication?

Accepted Answer

Passive Authentication via AD Agent or ISE. Passive authentication utilizes the Cisco User Agent or Firepower Identity Services Engine (ISE) / AD agent to map IP addresses to usernames transparently.

Answer

Captive Portal

Answer

Local User Database

Answer

RADIUS Server Authentication

Question 5

An administrator needs to define network objects in the FMC Object Management menu. Which THREE object types are natively supported for network definition? (Choose three)

Accepted Answer

Host Object. FMC supports Host, Range, Network (subnet), FQDN, and Network Group objects for network definitions.

Answer

Port Object

Answer

Application Filter Object

Question 6

An administrator needs to ensure that internal users can access the internet using a public IP while hiding their private address. Which NAT rule type should be configured on the FMC?

Accepted Answer

Dynamic NAT. Dynamic NAT or PAT is used to map internal private addresses to public addresses for outbound internet traffic.

Answer

Policy NAT

Answer

Identity NAT

Answer

Static NAT

Question 7

You are troubleshooting a connectivity issue. The traffic is being dropped by a Prefilter rule. What is the characteristic of traffic handled by a Prefilter policy?

Accepted Answer

It bypasses the Snort engine. Prefilter policies provide a fast path to inspect traffic without the overhead of deep packet inspection.

Answer

It performs full IPS inspection

Answer

It operates at the L7 layer

Answer

It only applies to encrypted traffic

Question 8

Which TWO types of objects can be created in the FMC Object Manager?

Accepted Answer

Network. Network and Port objects are standard types in FMC.

Answer

License

Answer

System Health

Answer

Dashboard

Question 9

What is the result of using a 'Security Group' object in an Access Control rule?

Accepted Answer

Matches based on SGT. Security Group objects allow policy matching based on Cisco TrustSec tags.

Answer

Matches based on IP address

Answer

Matches based on VLAN

Answer

Matches based on Interface

Question 10

An administrator configures QoS on an FTD interface to prioritize VoIP traffic. Which traffic matching mechanism within the QoS policy allows the FTD to identify VoIP traffic (such as SIP or RTP) based on Layer 7 application inspection?

Accepted Answer

Access Control Rules with Application Filters. QoS policies can match traffic based on Access Control lists or Application Filters to apply rate shaping or priority queuing.

Answer

Prefilter Policy Bandwidth Limits

Answer

Intrusion Policy Rule Actions

Answer

Platform Settings QoS Class Maps

Question 11

An administrator is implementing an SSL Decryption Policy on a Cisco Firepower Threat Defense device managed by FMC. The policy must decrypt outbound HTTPS traffic to inspect for malware, but certain financial domains must be excluded from decryption to comply with privacy regulations. Which rule action should be configured for these specific financial domains in the SSL Decryption Policy?

Accepted Answer

Do Not Decrypt. To prevent inspection and decryption of sensitive traffic while allowing it to pass through the firewall, the Do Not Decrypt action is used in the SSL Decryption Policy.

Answer

Decrypt - Known Key

Answer

Block

Answer

Decrypt - Resign

Question 12

Which feature in FMC allows you to group multiple physical interfaces into a single logical zone for policy assignment?

Accepted Answer

Security Zone. Security Zones allow logical grouping of interfaces for easier policy management.

Answer

VLAN Group

Answer

Port Channel

Answer

Bridge Group

Question 13

An administrator is configuring Security Intelligence feeds on the FMC. Which TWO types of objects or feeds can be used to populate Security Intelligence blacklists? (Choose two)

Accepted Answer

Custom Network/IP Lists (Objects). Security Intelligence supports custom network/IP lists and Cisco provided dynamic feeds (like reputation feeds for URLs and IPs).

Answer

Local user identity realm database

Answer

Prefilter fast-path exclusion rules

Answer

QoS class map profile objects

Question 14

You need to map internal users to specific security policies based on their AD group membership. What must be configured in FMC to support this?

Accepted Answer

Identity Policy. Identity policies require an Identity Realm and agent integration to map user IPs to group memberships.

Answer

Access Control Policy

Answer

Network Discovery Policy

Answer

SSL Decryption Policy

Question 15

Which tab in the Access Control Policy rule editor allows you to specify the source and destination zones?

Accepted Answer

Zones. The 'Zones' tab is where you define ingress and egress zones for the rule.

Answer

Ports

Answer

Networks

Answer

Applications

Question 16

An engineer is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) in Google Cloud Platform (GCP). The architecture requires multiple network interfaces. How does GCP map these interfaces during deployment?

Accepted Answer

GCP allows multiple discrete NICs per instance, with nic0 assigned to management and subsequent NICs mapped to data subnets.. GCP allows multiple Network Interface Cards (NICs) on a single compute instance, where nic0 is typically assigned for management and subsequent nic1, nic2, etc., are assigned for data traffic.

Answer

GCP requires all data traffic to pass through an external HTTP(S) load balancer before reaching nic0.

Answer

GCP supports only a single interface per VM; all VLAN subinterfaces must be trunked through nic0.

Answer

GCP virtual machines cannot be managed by Cisco FMC; they require deployment via Google Deployment Manager only.

Question 17

An administrator is configuring interface-level QoS on an FTD device. Which THREE parameters or features can be configured within an FTD QoS policy? (Choose three)

Accepted Answer

DSCP Marking. Qos policies on FTD support rate limiting, traffic shaping, priority queuing, and marking DSCP values.

Answer

Active Directory user group mapping

Answer

Automatic IP address translation (NAT mapping)

Question 18

Which option in the Access Control Policy rule allows you to define a specific application, such as 'Facebook', to be blocked?

Accepted Answer

Applications. The 'Applications' tab in an Access Control Rule allows selection of specific applications for blocking or monitoring.

Answer

URL

Answer

Zones

Answer

Ports

Question 19

When deploying a configuration change from FMC to FTD, what is the 'Deployment' process actually doing?

Accepted Answer

Pushing policy and configuration updates. The deployment process pushes the configuration changes and policies to the FTD device.

Answer

Running a connectivity test

Answer

Rebooting the FTD

Answer

Updating the Snort binary

Question 20

How do you enable 'High Availability' (HA) for an FTD pair managed by FMC?

Accepted Answer

Under Devices > Device Management. HA is configured in the Device Management section by selecting two devices to pair.

Answer

Under Policies > HA

Answer

Via the System > Configuration menu

Answer

In the Access Control Policy