300-710 SNCF Practice Exam 4 — 20 Questions

Question 1

How do you identify which Access Control Rule triggered a specific connection log?

Accepted Answer

Check the 'Rule Name' field in the connection event. The connection event log contains a field identifying the specific Rule Name that matched.

Answer

Check the 'Policy Name' field

Answer

Check the 'Device Name'

Answer

Check the 'Ingress Zone'

Question 2

You are creating a custom URL category. How do you add specific domains to this category in FMC?

Accepted Answer

Via Objects > Object Management > URL. Custom URL objects are created in the Object Manager and then assigned to the category.

Answer

In the SSL Policy

Answer

Directly in the Access Control rule

Answer

In the Prefilter Policy

Question 3

What is the primary function of a 'Security Zone' in FMC?

Accepted Answer

To logically group interfaces. Security Zones allow applying the same policy to multiple interfaces at once.

Answer

To set bandwidth limits

Answer

To enable routing

Answer

To define IP ranges

Question 4

When configuring a QoS policy, what happens if you exceed the 'Rate Limit' set for a traffic class?

Accepted Answer

The excess traffic is policed. Traffic exceeding the rate limit is policed (dropped or shaped).

Answer

The traffic is redirected to another interface

Answer

The traffic is logged as critical

Answer

The connection is reset

Question 5

Which tab in the FMC Object Manager allows you to manage pre-defined objects?

Accepted Answer

System Objects. FMC provides a list of pre-defined objects under the 'Network' or 'Port' categories; you can filter for 'System' objects.

Answer

User Objects

Answer

Global Objects

Answer

Custom Objects

Question 6

You are configuring a static route on a Cisco Secure Firewall Threat Defense using FDM. Which parameters are strictly required to create a valid IPv4 static route?

Accepted Answer

Destination IP network, subnet mask, and next-hop IP address or egress interface.. A valid static route requires a destination network (prefix/mask), and either a next-hop IP address or an egress outgoing interface.

Answer

MAC address of the next-hop router and security zone name.

Answer

IP SLA tracking object ID and weighted cost metric.

Answer

Source IP address, destination IP address, and BGP Autonomous System number.

Question 7

Which TWO items must be defined to create a fully functional Network Object group in FMC?

Accepted Answer

Member Objects. A group needs a name and at least one member (object) assigned to it.

Answer

Object Description

Answer

SNMP Traps

Answer

Routing Table

Question 8

When configuring a NAT rule, which THREE options are valid 'Type' selections within the NAT Rule editor?

Accepted Answer

Static. Static, Dynamic, and Identity are valid NAT types in FTD/FMC.

Answer

Virtual

Answer

Transparent

Question 9

What is the result of assigning a 'Trust' action to a rule in an Access Control Policy?

Accepted Answer

Traffic is permitted without inspection. Trust allows traffic through the firewall without any further inspection by the Snort engine.

Answer

Traffic is inspected by IPS

Answer

Traffic is blocked

Answer

Traffic is decrypted

Question 10

What is the purpose of 'Network Discovery' in FMC?

Accepted Answer

To identify hosts and user activity. Network Discovery identifies hosts, applications, and operating systems on the network.

Answer

To push firmware updates

Answer

To configure routing protocols

Answer

To perform active IPS scanning

Question 11

An administrator is configuring an inline interface pair on a Cisco Secure Firewall Threat Defense device using Cisco FMC. The business requires that if the firewall experiences a power failure or kernel panic, traffic must continue to flow uninterrupted through the network segment. Which action should the administrator take?

Accepted Answer

Configure the inline set with the 'Fail Open' setting and ensure hardware bypass is supported and enabled on the network module.. Hardware bypass capability (fail-open) on supported Network Interface Modules (NIMs/SMs) allows physical optical or copper paths to bridge automatically when power is lost or the Snort engine crashes.

Answer

Set up a redundant EtherChannel with LACP fast-rate timers.

Answer

Deploy the interfaces in a Bridge Virtual Interface (BVI) group with spanning tree disabled.

Answer

Configure the inline set with the 'Fail Close' setting and enable STP root guard.

Question 12

An engineer is troubleshooting a Cisco Secure Firewall Threat Defense clustering deployment where configuration synchronization between the control node and a data node has failed. Which THREE diagnostic steps or log sources should the engineer check? (Choose three)

Accepted Answer

Execute the 'show cluster info' and 'show cluster state' commands on the firewall CLI to verify node membership and sync status.. Troubleshooting cluster sync issues involves examining cluster health status via CLI commands (e.g., 'show cluster info'), reviewing FMC deployment history logs, and verifying Cluster Control Link connectivity.

Answer

Check the BGP routing table on the core switch for missing Autonomous System path attributes.

Answer

Review the VMware vCenter datastore utilization for disk space errors.

Question 13

A security requirement mandates that QoS be applied to limit bandwidth for guest users. Where is QoS configured on an FMC-managed FTD?

Accepted Answer

In a separate QoS Policy. QoS policies are defined as a separate policy type in the FMC and then applied to the Access Control Policy.

Answer

Within the Access Control Policy rules

Answer

Under the Platform Settings

Answer

In the Prefilter Policy

Question 14

Which THREE actions can be performed by an SSL Decryption Policy?

Accepted Answer

Do Not Decrypt. SSL policy actions include Decrypt, Do Not Decrypt, and Monitor.

Answer

Redirect

Answer

Block

Question 15

When you have multiple overlapping NAT rules, which rule is applied?

Accepted Answer

The first matching rule. The FTD matches NAT rules using a top-down approach, similar to Access Control rules.

Answer

The rule that matches the interface

Answer

The rule with the lowest priority

Answer

The most specific rule

Question 16

Which TWO protocols are commonly managed via Port objects in FMC?

Accepted Answer

UDP. TCP and UDP are the primary protocols managed via port objects.

Answer

ARP

Answer

IGMP

Answer

ICMP

Question 17

In the context of FTD, what does 'FMC' stand for?

Accepted Answer

Firepower Management Center. FMC is the central management platform for FTD devices.

Answer

Firewall Management Console

Answer

Firewall Monitoring Center

Answer

Firepower Managed Cloud

Question 18

Where do you define the 'Search' criteria for finding objects in FMC?

Accepted Answer

Objects > Object Management. The Object Management page provides a search bar for filtering existing objects.

Answer

Devices > Device Management

Answer

Policies > Access Control

Answer

Analysis > Reports

Question 19

What must be configured before an Access Control Rule can use a URL category?

Accepted Answer

URL Filtering License. The URL filtering license must be enabled/configured for the category database to be available.

Answer

Identity Policy

Answer

Prefilter Policy

Answer

QoS Policy

Question 20

Which object type should be used to represent a group of network subnets?

Accepted Answer

Network Group. A Network Group object allows you to aggregate multiple network subnets into a single object for policy efficiency.

Answer

Host

Answer

Range

Answer

Port Group