300-710 SNCF Practice Exam 3 — 20 Questions

Question 1

You are deploying a Cisco Secure Firewall Threat Defense in transparent mode. How are frames forwarded between the internal and external interfaces of the firewall?

Accepted Answer

By bridging frames at Layer 2 based on destination MAC addresses within a configured Bridge Group.. In transparent mode, the FTD forwards frames at Layer 2 by bridging based on destination MAC addresses within a configured Bridge Group. The firewall does not perform IP route lookups or decrement TTL; it acts like a Layer 2 switch with security inspection. This allows the firewall to be inserted into an existing network without changing IP addressing.

Answer

By encapsulating all packets inside GRE tunnels between the ingress and egress ports.

Answer

By translating all private IP addresses to public IP addresses using NAT overload.

Answer

By performing IP route lookups and decrementing the TTL on every packet.

Question 2

A network engineer needs to configure Auto NAT on a Firepower Threat Defense device managed by FMC to translate internal subnet 10.10.10.0/24 to a single public IP address 203.0.113.50. Which translation type should be selected?

Accepted Answer

Dynamic PAT (Port Address Translation). Dynamic PAT (Port Address Translation) is the correct choice because it translates multiple internal IP addresses to a single public IP address using unique source ports. This allows the entire 10.10.10.0/24 subnet to share one public IP, which is the typical use case for PAT. Static NAT would require a one-to-one mapping, and Dynamic NAT would require a pool of public IPs.

Answer

Static NAT

Answer

Static Identity NAT

Answer

Dynamic NAT

Question 3

An administrator is troubleshooting an FTD device that is failing to register with FMC. The FTD has been configured with the correct FMC IP address, registration key, and NAT ID. Which additional setting must be verified on the FTD to allow successful registration?

Accepted Answer

The FTD must have a default route to reach the FMC.. The FTD requires a route to reach FMC. If FMC is on a different network, a default gateway or static route must be configured on the management interface. Without it, registration packets cannot reach FMC. DNS, time zone, and NAT ID are either already addressed or not blocking registration in this scenario.

Answer

The FTD must be able to resolve the FMC's hostname via DNS.

Answer

The FTD must be configured with the same NAT ID as the FMC.

Answer

The FTD must have the same time zone as the FMC.

Question 4

An administrator needs to create a variable set to define specific port or network variables used within Intrusion Rules. Where are variable sets managed in the FMC?

Accepted Answer

Objects > Object Management > Variable Sets. In FMC, variable sets used by Intrusion Rules are managed under Objects > Object Management > Variable Sets. This is where administrators define variables such as $HOME_NET, $EXTERNAL_NET, and port variables that Snort rules reference. The variable sets are then applied to the Intrusion Policy.

Answer

Devices > Device Management > Variables

Answer

System > Localized Variables

Answer

Policies > Access Control > Variables

Question 5

A security requirement mandates that QoS be applied to limit bandwidth for guest users. Where is QoS configured on an FMC-managed FTD?

Accepted Answer

In a separate QoS Policy. QoS policies are defined as a separate policy type in the FMC and then applied to the Access Control Policy.

Answer

Within the Access Control Policy rules

Answer

Under the Platform Settings

Answer

In the Prefilter Policy

Question 6

An administrator is implementing an SSL Decryption Policy on a Cisco Firepower Threat Defense device managed by FMC. The policy must decrypt outbound HTTPS traffic to inspect for malware, but certain financial domains must be excluded from decryption to comply with privacy regulations. Which rule action should be configured for these specific financial domains in the SSL Decryption Policy?

Accepted Answer

Do Not Decrypt. To prevent inspection and decryption of sensitive traffic while allowing it to pass through the firewall, the Do Not Decrypt action is used in the SSL Decryption Policy.

Answer

Decrypt - Known Key

Answer

Block

Answer

Decrypt - Resign

Question 7

You are analyzing connection events and notice a block action. Which field in the connection event details best explains why the connection was dropped by the policy?

Accepted Answer

Reason. The 'Reason' field in a connection event explicitly states why the connection was dropped, such as 'Blocked by Access Control Rule' or 'Drop due to Snort rule'. It is the most direct indicator of the policy enforcement cause. Other fields like Policy Enforcement or Connection Policy may show related metadata but do not provide the specific drop reason.

Answer

Policy Enforcement

Answer

Connection Policy

Answer

Traffic Log

Answer

Drop Description

Question 8

An administrator is planning an upgrade of an FMC managing multiple FTD devices across various software versions. Which THREE factors must be validated according to Cisco compatibility guidelines before proceeding? (Choose three)

Accepted Answer

Supported upgrade paths (e.g., whether a direct jump from v6.4 to v7.4 is supported or requires an intermediate upgrade).. Option A is correct because Cisco upgrade planning requires verifying supported upgrade paths; for example, a direct jump from v6.4 to v7.4 may not be supported and may require an intermediate release such as v7.0 or v7.2 before reaching v7.4. Option B is correct because the upgrade process must have sufficient free space on FMC and FTD partitions, including /var and /root, so that downloaded packages and temporary files can be unpacked and staged without filling the filesystem. Option E is correct because the Cisco Firepower Compatibility Guide must be consulted to confirm that the target FMC software version interoperates with and supports the FTD versions currently managed by that FMC. Option C is not required because NTP stratum 1 is not a Cisco Firepower upgrade prerequisite; time synchronization matters, but the local NTP server does not have to be stratum 1. Option D is not required because the serial numbers of external power supplies are irrelevant to software compatibility and upgrade validation.

Answer

The local NTP server stratum level must be exactly stratum 1.

Answer

The serial number of the external power supplies attached to the rack mount chassis.

Question 9

An administrator is configuring Cisco SecureX threat intelligence integration with Cisco Secure Firewall Threat Defense via the FMC. Which TWO actions can be performed directly through the SecureX integration? (Choose two)

Accepted Answer

Automatic synchronization of dynamic Indicators of Compromise (IoCs) to block malicious traffic.. SecureX integration allows sharing indicators of compromise (IoCs) for automated blocking/alerting and pivoting to Threat Response for investigation.

Answer

Real-time firmware updates pushed from the SecureX cloud console to the managed firewalls.

Answer

Replacement of local FMC policy administration with cloud-only RBAC management.

Answer

Direct deployment of Snort 3 custom intrusion rules compiled locally on the SecureX cloud platform.

Question 10

Which THREE criteria can be used to match traffic within an Access Control rule on the FMC? (Choose three)

Accepted Answer

URL Categories. In Cisco FMC, an Access Control rule can match traffic using criteria such as URL Categories (C), which let you filter based on reputation or category of requested web destinations; Applications (D), which identify traffic by application or application group via Snort/App-ID; and Security Zones (E), which match the ingress/egress interfaces assigned to zones. These three are all valid match conditions on the rule's main criteria tabs. Intrusion Policy Signatures (A) are not a match criterion — an Intrusion Policy is an inspection action applied to traffic that already matched the rule. Device Platform Settings (B) are also not a match condition; platform settings are applied via a Platform Settings policy to managed devices, not used to select traffic in an access rule.

Answer

Intrusion Policy Signatures

Answer

Device Platform Settings

Question 11

An engineer needs to troubleshoot high CPU usage on an FTD device caused by Snort. Which THREE actions or features can be adjusted or implemented to mitigate Snort CPU load? (Choose three)

Accepted Answer

Configure SSL Decryption policies to bypass trusted internal traffic or known safe applications.. Option B is correct because SSL Decryption is one of the most CPU-intensive operations Snort performs; bypassing trusted internal traffic or known safe applications in the SSL policy prevents Snort from decrypting and inspecting that traffic, directly reducing CPU load. Option D is correct because the Intrusion Policy determines which Snort rules are evaluated, and disabling rules not applicable to the network environment reduces the number of signatures Snort must process per packet, lowering CPU utilization. Option E is correct because Access Control rules are evaluated top-down, and placing frequently matched allow rules higher with fewer inspection requirements (e.g., no intrusion or file inspection) lets traffic be allowed early with minimal Snort processing, reducing overall CPU demand. Option A is incorrect because converting physical interfaces to switchports without IP addresses is a Layer 2 deployment consideration and does not by itself reduce Snort CPU load. Option C is incorrect because disabling the FTD kernel and running Snort in standalone user-space loopback mode is not a supported or valid FTD configuration and would not mitigate CPU usage.

Answer

Convert all physical interfaces into switchports without IP addresses.

Answer

Disable the FTD kernel entirely and run Snort in standalone user-space loopback mode.

Question 12

An engineer has modified several access control rules and object groups on the FMC. Before deploying these changes to the FTD, the engineer wants to review all pending changes to ensure no unauthorized modifications are included. Where in the FMC GUI should the engineer go to view pending deployment changes?

Accepted Answer

Deploy > Deployment (or clicking the Deploy icon in the top header). To view pending deployment changes, the engineer should go to Deploy > Deployment (or click the Deploy icon in the top header). This shows a list of all pending changes across policies and objects, allowing review before deployment.

Answer

Objects > Object Management > Diff Viewer

Answer

Analysis > Audit > Pending

Answer

System > Updates > Pending Changes

Question 13

Which TWO benefits are gained by integrating Cisco Secure Firewall with Cisco Identity Services Engine (ISE) using TrustSec SGTs? (Choose two)

Accepted Answer

Propagation of security tags across network boundaries via SXP for consistent enforcement. Option A is correct because integrating Cisco Secure Firewall with ISE via TrustSec uses SXP (SGT Exchange Protocol) to propagate Security Group Tags (SGTs) across network boundaries, allowing consistent policy enforcement even where inline tagging is not supported. Option B is correct because ISE supplies identity and group information (user roles, AD group membership) that maps to SGTs, so firewall rules can be written against security group tags instead of volatile IP addresses. Option C is incorrect because the firewall does not send quarantine commands directly to Active Directory; remediation is typically handled by ISE/pxGrid and endpoint tools, not AD. Option D is incorrect because TrustSec is a segmentation/policy framework and does not replace routing protocols such as OSPF or BGP. Option E is incorrect because access control rules are still required on the firewall; SGTs enrich and simplify them rather than eliminating them.

Answer

Automatic remediation of endpoint malware infections via direct quarantine commands sent from the firewall to Active Directory

Answer

Replacement of traditional routing protocols with TrustSec matrix routing

Answer

Elimination of the need for access control rules on the firewall

Question 14

You are troubleshooting high availability. The units are connected, but the failover link shows as 'Down'. What is the most likely cause?

Accepted Answer

Mismatched failover link configuration or physical layer issues.. The failover link must be a direct cable connection or a dedicated VLAN. Mismatched cable types or misconfigured link settings are common causes for the link to remain down.

Answer

The primary unit is in routed mode.

Answer

The standby unit has an expired license.

Answer

Mismatched IP addresses on the data interface.

Question 15

You are deploying a Cisco FTD High Availability pair. During the synchronization process, what occurs when the standby unit fails to receive three consecutive heartbeat hellos from the primary?

Accepted Answer

The standby unit transitions to the Active state.. In FTD HA, three consecutive missed hellos trigger a state change, and the standby unit initiates a failover because it assumes the primary has failed.

Answer

The standby unit initiates a full configuration overwrite from the secondary flash.

Answer

The standby unit enters a suspended state to wait for administrative intervention.

Answer

The primary unit is rebooted automatically by the standby unit.

Question 16

A security engineer is creating an Access Control Policy (ACP) in FMC. The policy must block all traffic matching specific URL categories while allowing standard web browsing. However, the administrator wants users to receive a warning page before continuing to pages categorized as "Potentially Damaging Content" rather than a hard block. Which action should the engineer assign to the URL category in the ACP Rules tab?

Accepted Answer

Interactive Block. In an FMC Access Control Policy, the 'Interactive Block' action for a URL category presents users with a warning page that they can acknowledge to continue to the site. This matches the requirement to warn users before proceeding to 'Potentially Damaging Content' pages rather than hard-blocking them. The other actions either block outright, allow silently, or only log.

Answer

Block

Answer

Allow

Answer

Monitor

Question 17

An administrator integrates Cisco Secure Firewall with Cisco SecureX. Which TWO components or settings are required on the FMC to establish and maintain this cloud integration? (Choose two)

Accepted Answer

Valid API integration keys / credentials generated from the Cisco SecureX cloud management console and pasted into the FMC.. Option A is correct because integrating the FMC with Cisco SecureX requires generating API credentials (client ID and secret / API key) in the SecureX cloud portal and entering them on the FMC under the SecureX/Cloud Services registration, which authenticates the FMC to the cloud service. Option E is correct because the FMC management interface must reach the SecureX cloud endpoints over outbound HTTPS on TCP 443 for registration, token exchange, and ongoing telemetry/health updates. Option B is incorrect: eStreamer (TCP 8302) is a legacy event-streaming service used by other integrations, not the mechanism SecureX uses to poll the FMC. Option C is incorrect because SecureX integration uses REST APIs over HTTPS, not a direct SSH tunnel to the FTD data plane. Option D is incorrect because pxGrid is an ISE-based identity sharing framework and is not required on each managed FTD for SecureX cloud integration.

Answer

An active eStreamer daemon listening on TCP port 8302 for SecureX incoming connection polls.

Answer

A direct SSH tunnel between the FTD data plane and the SecureX cloud.

Answer

An active pxGrid session client on every managed FTD device.

Question 18

An administrator wants to create a Prefilter policy to fast-path (bypass Snort inspection for) a trusted backup stream between two data centers. Which action type should be selected in the Prefilter rule?

Accepted Answer

FastPath. In a Prefilter policy, the FastPath action bypasses Snort inspection for trusted traffic, allowing it to be forwarded without deep packet inspection. This is ideal for a trusted backup stream between data centers because it reduces latency and processing overhead. The FastPath action is specifically designed to fast-track traffic that does not require security inspection.

Answer

Monitor

Answer

Block

Answer

Inspect

Answer

Trust

Question 19

An administrator wants to group multiple existing port objects (e.g., TCP 80, TCP 443, TCP 8080) into a single object for use in Access Control Policy rules. Which object container should be created?

Accepted Answer

Port Group Object. A Port Group Object is a container that groups multiple port objects (e.g., TCP 80, 443, 8080) into a single reusable object. This allows administrators to reference the group in Access Control rules instead of listing each port individually, simplifying policy management. Port Group Objects are specifically designed for this purpose in FMC.

Answer

Port Object

Answer

Protocol Object

Answer

Application Filter Object

Question 20

A security engineer is integrating Cisco Secure Firewall with a third-party SIEM using eStreamer. The SIEM vendor's connector documentation requires the eStreamer event types to be parsed correctly. Which file format or protocol encoding does eStreamer use to transmit event records over TCP port 8305?

Accepted Answer

Compressed binary-encoded records over a custom TCP session. eStreamer transmits serialized binary event records over a secured TCP connection.

Answer

JSON over HTTPS REST API

Answer

XML-formatted SOAP messages

Answer

Syslog-formatted plain text over TLS