300-710 SNCF Practice Test 21 — 15 Questions

Question 1

When troubleshooting a connectivity issue where traffic is being dropped, which TWO of the following logs or tools should be reviewed first to determine the cause?

Accepted Answer

Connection Events. Connection Events (A) should be reviewed first because they record per-flow details such as source/destination, ingress/egress interfaces, matched access-control rule, and the specific drop reason (e.g., deny by ACL, no matching rule, or security-intelligence block), directly revealing why traffic was dropped. Packet Tracer (C) is also correct because it simulates a specific packet against the configured policies and shows the exact point in the policy chain where it is allowed or dropped, making it ideal for pinpointing the cause of a connectivity failure. The System Access Log (B) only records administrative login/authentication activity, not traffic-forwarding decisions, so it cannot explain dropped packets. The File Policy Report (D) covers file-type detection and malware/blocking actions on files, which is unrelated to general connectivity drops. Hardware Inventory (E) merely lists device components and serial numbers and provides no insight into traffic handling.

Answer

System Access Log

Answer

File Policy Report

Answer

Hardware Inventory

Question 2

Which component is responsible for processing traffic in an FTD cluster when 'Distributed' mode is used?

Accepted Answer

All cluster members.. In distributed mode, traffic is load-balanced across all members of the cluster, and each node processes its own traffic flows.

Answer

The management node.

Answer

A separate load-balancing virtual machine.

Answer

Only the primary node.

Question 3

An administrator is troubleshooting an active/standby Cisco Secure Firewall High Availability pair. Stateful failover is enabled, but active long-lived TCP connections are dropping when a failover occurs. Upon checking the stateful inspection settings, what is the most likely cause of this behavior?

Accepted Answer

Dynamic NAT translation entries are not being synchronized across the failover link because stateful NAT translation sync is disabled.. When stateful failover is enabled but dynamic NAT translation entries are not synchronized, existing long-lived TCP flows lose their translation state on the standby unit. When failover occurs, the standby cannot match return traffic to the original translation, so the connections are dropped. Enabling stateful NAT sync ensures translation entries are replicated across the failover link.

Answer

The units are running different minor patch versions of Cisco FTD, causing the state payload to be silently dropped by the receiver.

Answer

The stateful failover link (FMC control link) is using a management-only interface instead of a dedicated high-speed data interface.

Answer

The active unit is configured with stateful failover, but the standby unit is configured for stateless failover via CLI.

Question 4

Where do you define the 'Search' criteria for finding objects in FMC?

Accepted Answer

Objects > Object Management. The Object Management page provides a search bar for filtering existing objects.

Answer

Devices > Device Management

Answer

Policies > Access Control

Answer

Analysis > Reports

Question 5

An engineer is troubleshooting a high availability failover issue in a Cisco Secure Firewall Threat Defense pair. Which THREE conditions will trigger an automatic failover event in an Active/Standby deployment? (Choose three)

Accepted Answer

Failure of designated monitored interfaces exceeding the failure threshold count.. Failover triggers include unit power loss, critical interface failure thresholds being met, kernel/hardware crashes, or failure of health check heartbeats over the failover link.

Answer

An FMC software policy deployment to the standby unit.

Answer

A minor latency spike of 5 milliseconds on an internal routed data interface.

Question 6

Where in the FMC UI do you go to create a new Access Control Policy?

Accepted Answer

Policies > Access Control. In the FMC UI, Access Control Policies are created and managed under the Policies > Access Control menu. From there, administrators can create a new policy, assign it to managed devices, and configure rules.

Answer

Devices > Device Management

Answer

Objects > Object Management

Answer

Analysis > Connection

Question 7

Which protocol does Cisco Secure Firewall Threat Defense use to exchange SGT (Security Group Tag) metadata across intermediate routers that do not support inline tagging?

Accepted Answer

SXP (Scalable Group Tag Exchange Protocol). SXP (Scalable Group Tag Exchange Protocol) is a protocol used to propagate SGT-to-IP mappings across network devices and firewalls that do not support inline MACsec or IPsec SGT propagation.

Answer

RADIUS

Answer

TACACS+

Answer

SNMPv3

Question 8

What must be configured before an Access Control Rule can use a URL category?

Accepted Answer

URL Filtering License. The URL filtering license must be enabled/configured for the category database to be available.

Answer

Identity Policy

Answer

Prefilter Policy

Answer

QoS Policy

Question 9

An administrator is configuring inline interface pairs on a Cisco Secure Firewall Threat Defense device. Which THREE characteristics apply to inline deployment mode? (Choose three)

Accepted Answer

Asymmetric routing must be carefully managed or avoided because inline inspection expects to see both directions of a TCP flow.. Inline deployment places the Cisco Secure Firewall Threat Defense device directly in the traffic path, so option D is correct: because packets physically traverse the firewall, it can inspect and drop malicious traffic before it reaches destination hosts. Option B is correct because inline inspection is stateful and expects to see both directions of a TCP flow; asymmetric routing can cause the firewall to miss one direction, breaking inspection or dropping legitimate sessions. Option C is correct because inline sets support hardware bypass (Fail Open) on supported interfaces, which preserves network connectivity if the device loses power or fails. Option A is not correct because SPAN or TAP configurations are used for passive, promiscuous monitoring, not inline mode, where traffic is actively forwarded through the firewall. Option E is not correct because inline mode does not prevent routed mode; an inline set can be deployed as part of a routed (or transparent) configuration, and inline refers to the traffic-path placement rather than disabling routing.

Answer

Inline interfaces require SPAN or TAP configurations on upstream core switches to receive mirrored traffic copies.

Answer

Inline mode prevents the firewall from operating in routed mode.

Question 10

Which TWO of the following are valid methods for deploying an FTD appliance?

Accepted Answer

As a virtual machine on ESXi. Option D is correct because Cisco Firepower Threat Defense (FTD) can be deployed as a virtual appliance on VMware ESXi, where it runs as a VM using the FTDv image with virtual NICs mapped to the host's vSwitches. Option E is correct because FTD is also available as a dedicated physical hardware appliance, such as the Cisco Firepower 1000, 2100, 4100, or 9300 series, where the FTD software runs directly on the appliance's hardware. Options A, B, and C are not valid deployment methods: FTD is not supported as a module inside a Nexus switch (that role belongs to the ASA/FTD module in a Catalyst 6500 or Firepower 4100/9300 chassis, not Nexus), it is not distributed as a Docker container, and it is not installed as an OS-level package on Windows Server.

Answer

As a hardware module inside a Cisco Nexus switch

Answer

As a Docker container on a Linux host

Answer

As an OS-level package on a Windows server

Question 11

What is the result of using a 'Security Group' object in an Access Control rule?

Accepted Answer

Matches based on SGT. Security Group objects allow policy matching based on Cisco TrustSec tags.

Answer

Matches based on IP address

Answer

Matches based on VLAN

Answer

Matches based on Interface

Question 12

In an FTD clustering deployment, how does the control plane communicate state information between the master and slave units?

Accepted Answer

Via the Control Link.. In FTD clustering, the Control Link (CL) is responsible for heartbeat and state synchronization between the master unit and the subordinate units.

Answer

Via the Management Interface.

Answer

Via the backplane bus protocol.

Answer

Via the Data Link.

Question 13

Which FTD deployment mode is best suited for an environment where the device should monitor traffic without performing any blocking or dropping actions?

Accepted Answer

Passive mode. Passive mode is specifically designed for monitoring traffic via a SPAN or TAP port without impacting traffic flow.

Answer

Transparent mode

Answer

Inline mode

Answer

Routed mode

Question 14

An administrator needs to deploy an FTD in inline mode for IPS functionality but must ensure that the traffic remains uninterrupted if the software process fails. Which feature should be enabled?

Accepted Answer

Configure the interfaces as a hardware bypass pair.. The fail-open feature (hardware bypass) on supported FTD interfaces ensures that traffic continues to flow even if the FTD software fails or reboots.

Answer

Set the FTD to passive mode.

Answer

Enable high availability failover.

Answer

Implement ECMP routing.

Question 15

An engineer deploys an Access Control Policy change from the FMC to a managed FTD device. The task hangs in the Deployment History with a status of 'Applying' for an extended period. Upon checking the FTD CLI, the engineer notices a locked deployment file or stuck process. What action should be taken to clear or restart the deployment process safely?

Accepted Answer

Cancel the task in the FMC Task Manager (System > Task Monitor), verify deployment locks, and re-attempt the deployment after clearing pending changes.. When a deployment task hangs in 'Applying' state with a locked deployment file or stuck process on the FTD, the safe remediation is to cancel the task from the FMC Task Monitor (System > Task Monitor), verify no deployment locks remain, and then re-attempt the deployment after clearing pending changes. This avoids disrupting traffic or corrupting the configuration database. The FMC-to-FTD deployment is transactional; cancelling cleanly releases the lock so a fresh deployment can proceed.

Answer

Power cycle the physical FTD chassis immediately using the hardware power switch.

Answer

Delete the Access Control Policy and recreate it with a new name.

Answer

Run 'reload factory-default' from the FTD CLI to reset the management plane.