300-710 SNCF Practice Exam 4 — 20 Questions

Question 1

When a packet capture is running on the FTD, where can you download the resulting .pcap file for analysis in Wireshark?

Accepted Answer

Devices > Device Management > Captures. Packet capture files (.pcap) generated on the FTD can be downloaded from Devices > Device Management > Captures in the FMC GUI. This page lists active and completed captures and provides a download option for the resulting pcap file, which can then be opened in Wireshark for detailed analysis. It is the designated location for managing and retrieving capture files.

Answer

Devices > Device Management > Diagnostics

Answer

System > Tools > File Transfer

Answer

Objects > File Lists

Answer

Analysis > Packet Analysis

Question 2

An engineer is troubleshooting a Cisco ISE and Secure Firewall pxGrid integration. The administrator notices that user group memberships are not populating correctly on the FTD, even though IP-to-user mappings are visible. What is the most likely reason user group information is missing?

Accepted Answer

ISE is not configured to include user group attributes in pxGrid publication feeds, or the FMC requires direct LDAP/AD integration to resolve user group hierarchies.. While pxGrid shares IP-to-user mappings, user group attribute resolution often relies on Active Directory integration or LDAP directory configurations mapped within ISE or synchronized via Active Directory Agent / ISE Active Directory attribute retrieval. If ISE is not configured to publish user group attributes over pxGrid or if the FMC lacks AD LDAP integration to resolve the groups, group-based rules will fail.

Answer

The FMC eStreamer service is blocking group attribute propagation.

Answer

User groups can only be resolved via RADIUS accounting attributes, making pxGrid fundamentally incompatible with user group filtering.

Answer

The FTD Snort engine must be configured with a local flat file containing all user group names.

Question 3

When editing an Access Control Rule, which action allows you to drop traffic while simultaneously sending a TCP RST to the client?

Accepted Answer

Block with Reset. The 'Block with Reset' action drops the connection and sends a reset packet to notify the sender.

Answer

Interactive Block

Answer

Block

Answer

Trust

Question 4

You are deploying an FTD in a cloud environment and need to ensure high availability. Which technology is typically used to manage the virtual IP failover?

Accepted Answer

Cloud API calls to update route tables.. In cloud environments, FTD high availability failover is managed by cloud API calls that update route tables to redirect traffic from the failed instance to the standby instance. Because cloud providers like AWS and Azure do not support traditional Layer 2 protocols such as VRRP or gratuitous ARP for floating IPs, the FTD uses cloud-native mechanisms (e.g., AWS API calls to reassign an Elastic IP or update route tables) to achieve failover. This is the standard HA approach for FTDv in public clouds.

Answer

VRRP.

Answer

EtherChannel hashing.

Answer

Gratuitous ARP.

Question 5

What is the result of assigning a 'Trust' action to a rule in an Access Control Policy?

Accepted Answer

Traffic is permitted without inspection. Trust allows traffic through the firewall without any further inspection by the Snort engine.

Answer

Traffic is inspected by IPS

Answer

Traffic is blocked

Answer

Traffic is decrypted

Question 6

Which component in an FTD cluster handles the 'Health Check' process to determine if a node is still active?

Accepted Answer

Cluster control link.. The cluster control link is used to exchange heartbeats and health information between cluster members to verify node status.

Answer

Primary management IP.

Answer

The standby unit's data interface.

Answer

FMC communication channel.

Question 7

You are configuring an NGIPS mode deployment on an FTD device. You need to ensure that the FTD can drop malicious traffic in real-time. Which mode must you select?

Accepted Answer

Inline Mode. Inline Mode places the FTD directly in the traffic path so packets must traverse the sensor, allowing it to drop malicious frames in real time before they reach the protected host. This is the only NGIPS deployment mode that supports blocking/drop actions; the other modes are detection-only.

Answer

Promiscuous Mode

Answer

Bypass Mode

Answer

Passive Mode

Question 8

An administrator is performing health monitoring on an FMC appliance. Which TWO health monitors are available out-of-the-box in the FMC Health Monitor dashboard to track system resource utilization? (Choose two)

Accepted Answer

CPU Utilization. The FMC Health Monitor dashboard ships with a set of default, out-of-the-box monitors that focus on appliance-level system resources, and CPU Utilization (A) is one of them, tracking processor load on the FMC so administrators can detect performance degradation. Disk Utilization (B) is also a built-in monitor, reporting how full the FMC's disk partitions are, which is critical because a full disk can halt logging, event storage, and database operations. Both A and B are standard system-resource monitors present by default without any additional configuration. The other options do not belong: SSL Handshake Latency (C) is not a default FMC health monitor, SNMP Trap Queue Depth (D) is not an out-of-the-box FMC system-resource monitor, and BGP Peer Flap Counter (E) relates to routing protocol state rather than FMC appliance resource utilization.

Answer

SSL Handshake Latency

Answer

SNMP Trap Queue Depth

Answer

BGP Peer Flap Counter

Question 9

An administrator needs to create a custom Application filter object in the FMC to easily select cloud storage applications in Access Control rules. Where are application filters created?

Accepted Answer

Objects > Object Management > Application Filters. Application Filters are reusable objects created under Objects > Object Management > Application Filters in the FMC. They let administrators group applications by characteristics such as category, risk, business relevance, or tags, so a single filter can be referenced in Access Control rules instead of listing dozens of individual applications. This is the canonical location for creating custom application filter objects.

Answer

Devices > Device Management > Apps

Answer

System > Configuration > Application Database

Answer

Policies > Access Control > Applications

Question 10

An administrator configures pxGrid integration between Cisco ISE and Secure Firewall Management Center. During the pxGrid certificate generation on ISE, the administrator must export the client certificate and keystore. What format must the client keystore be in when importing it into the FMC to establish the pxGrid trust relationship?

Accepted Answer

PKCS#12 (.pfx/.p12) bundle containing the client certificate, private key, and CA certificate.. The pxGrid client keystore must be a PKCS#12 (.pfx/.p12) bundle because FMC needs the client certificate, its matching private key, and the CA certificate together in one password-protected container to authenticate to the ISE pxGrid controller. ISE's pxGrid certificate generation workflow explicitly produces a .p12 file for download, and FMC's pxGrid client import expects exactly that bundle. Without the private key and CA chain in the same file, the TLS mutual-authentication handshake with ISE cannot complete.

Answer

Plaintext DER binary format without private keys.

Answer

Microsoft Exchange Web Services (EWS) XML format.

Answer

Java KeyStore (.jks) format exclusively.

Question 11

What occurs when an 'Interactive Block' action is used in an Access Control rule?

Accepted Answer

The user receives a notification page. The user is shown a page explaining why the traffic was blocked and given an option to proceed.

Answer

The traffic is dropped

Answer

The traffic is automatically allowed

Answer

The rule is ignored

Question 12

An FTD device is deployed in routed mode with multiple security zones. An administrator needs to configure an Access Control rule that evaluates traffic flowing between two different security zones. How are security zones utilized in the rule?

Accepted Answer

Security zones are selected under the Zones tab of an Access Control rule as Source and Destination.. In FMC, an Access Control rule includes a Zones tab where you select the source and destination security zones (interface groups) that the rule should match. Traffic flowing between two different security zones is matched by specifying those zones as Source and Destination in the rule, allowing zone-based policy enforcement.

Answer

Security zones replace IP address objects entirely in all rule configurations.

Answer

Security zones are used exclusively in NAT translation rules.

Answer

Security zones are assigned globally in device platform settings, not in access rules.

Question 13

An administrator wants to ensure that specific internal subnets are never subjected to NAT translation when communicating with a partner VPN tunnel. Which NAT feature achieves this?

Accepted Answer

Identity NAT. Identity NAT (also called NAT exemption or 'no NAT') is the feature that explicitly excludes specified source/destination subnet pairs from translation. In Cisco FTD/FMC, an Identity NAT rule is placed in the manual NAT policy with the original source and destination as both the translated source and destination, effectively creating a 'do not translate' entry. This is the standard method for ensuring VPN traffic to a partner tunnel traverses without address rewriting, which is required for IPsec/ISAKMP selectors to match correctly.

Answer

Auto NAT Static

Answer

Dynamic PAT

Answer

Port Address Translation

Question 14

Which menu path in the Cisco Secure Firewall Management Center (FMC) is used to configure the connection to Cisco Threat Response or Cisco SecureX?

Accepted Answer

System > Integration > SecureX. Integration with Cisco SecureX (Threat Response) is configured under System > Integration on the FMC interface.

Answer

Devices > Device Management > Threat Intelligence

Answer

Objects > Object Management > Cloud Services

Answer

Policies > Access Control > Security Intelligence

Question 15

An administrator wants to export a packet capture (.pcap file) taken on an FTD interface directly from the FMC GUI for offline analysis in Wireshark. Where should the administrator navigate?

Accepted Answer

Analysis > Captures or Devices > Device Management > Packet Capture. To export a packet capture (.pcap) taken on an FTD interface from the FMC GUI, the administrator navigates to Analysis > Captures or Devices > Device Management > Packet Capture. These locations provide access to captures stored on the FTD, allowing download of the .pcap file for offline analysis in Wireshark.

Answer

System > Tools > Packet Export

Answer

Policies > Access Control > Advanced > Packet Capture

Answer

Objects > Object Management > Captures

Question 16

An administrator wants to configure automated email notifications from the FMC whenever a critical health monitor alert occurs on any managed device. Where should this be configured in the FMC GUI?

Accepted Answer

System > Health > Monitor > Alert Responses. FMC health alert email notifications are configured under System > Health > Monitor > Alert Responses. There you define alert response objects that specify the email recipients and the health events (critical/warning) that trigger them, then apply them to health policies. This is the only location in the FMC GUI that natively sends email on health monitor alerts.

Answer

Objects > Object Management > Alerting

Answer

Policies > Access Control > Logging

Answer

Devices > Device Management > Alerts

Question 17

An administrator needs to configure Quality of Service (QoS) on a Cisco Firepower Threat Defense device via FMC to limit peer-to-peer traffic bandwidth. Where must the QoS policy be applied for it to take effect on traffic traversing the firewall?

Accepted Answer

Assigned to Security Zones in the Access Control Policy QoS tab. In FMC, a QoS policy is applied to the Access Control Policy by assigning it to security zones on the QoS tab. The QoS policy defines rate limiting and prioritization, and it takes effect only when associated with zones that carry the traffic traversing the FTD. This is the correct location for applying QoS to limit peer-to-peer bandwidth.

Answer

Assigned to Access Control Policy rules directly

Answer

Assigned inside Prefilter Policies

Answer

Assigned globally in Platform Settings

Question 18

In the FMC, what is the purpose of the 'Network Discovery Policy'?

Accepted Answer

To define discovery scope. It is used to control which networks are monitored for host/user discovery to avoid performance impact.

Answer

To enable routing

Answer

To block unauthorized users

Answer

To monitor bandwidth

Question 19

When using a Redundant Interface, what is the primary behavior during a link failure?

Accepted Answer

The standby link becomes active.. In a redundant interface pair, one link is active and the other is standby. If the active link fails, the FTD automatically switches to the standby link.

Answer

Both links remain active and load balance.

Answer

The FTD triggers a device-level failover.

Answer

Traffic is dropped until manual reset.

Question 20

Which TWO protocols are commonly managed via Port objects in FMC?

Accepted Answer

UDP. TCP and UDP are the primary protocols managed via port objects.

Answer

ARP

Answer

IGMP

Answer

ICMP