300-710 SNCF Practice Test 21 — 15 Questions

Question 1

An administrator is configuring Cisco Secure Firewall Threat Defense to export syslog messages to a remote SIEM. Which TWO parameters can be customized under the FTD Platform Settings syslog configuration? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Syslog facility levels (e.g., local0 through local7) and severity filters. Platform Settings for syslog allow configuring transport protocols (UDP/TCP/Reliable Syslog), log facilities, message formatting, and severity filters.

Answer

The encryption algorithm used for IPsec VPN tunnels terminating on the FTD

Answer

The OSPF routing protocol router ID

Answer

The Snort inspection engine memory allocation size

Question 2

An administrator wants to configure Access Control rules on Cisco Secure Firewall Threat Defense using identity context received from Cisco ISE via pxGrid. Which TWO criteria can be utilized in the Access Control policy rule configuration once pxGrid is fully integrated? (Choose two)

Accepted Answer

User names and User Groups. Once pxGrid is integrated, Access Control rules can filter traffic based on user identities, user groups, and Security Group Tags (SGTs).

Answer

DHCP lease pool exhaustion percentages

Answer

OSPF neighbor adjacency states

Answer

MACsec encryption key lifetimes

Question 3

An administrator is configuring Cisco Secure Firewall Threat Defense to export syslog messages to a remote SIEM. Which TWO parameters can be customized under the FTD Platform Settings syslog configuration? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In FTD Platform Settings > Syslog > Event Logging, configure severity thresholds for specific event categories.. In FTD Platform Settings > Syslog, administrators can select specific event classes (such as Intrusion, Security Intelligence, or Access Control) and assign severity filters so that only desired severity levels are exported.

Answer

Via the FTD CLI command 'logging severity-filter critical'.

Answer

In the Access Control Policy advanced tab by disabling connection logging.

Answer

In Objects > Object Management > Syslog Severity.

Question 4

An administrator integrates Cisco Secure Firewall with Cisco SecureX. Which TWO components or settings are required on the FMC to establish and maintain this cloud integration? (Choose two)

Accepted Answer

Valid API integration keys / credentials generated from the Cisco SecureX cloud management console and pasted into the FMC.. SecureX integration on FMC requires outbound internet connectivity over HTTPS (port 443) and valid API integration credentials generated from the SecureX/Security Cloud Control portal.

Answer

An active eStreamer daemon listening on TCP port 8302 for SecureX incoming connection polls.

Answer

A direct SSH tunnel between the FTD data plane and the SecureX cloud.

Answer

An active pxGrid session client on every managed FTD device.

Question 5

An administrator configures pxGrid integration between Cisco ISE and Cisco Secure Firewall Threat Defense. During the certificate enrollment process, the firewall fails to trust the ISE pxGrid node. What is the most likely root cause of this failure in a standalone FMC deployment?

Accepted Answer

The ISE pxGrid root CA certificate is not imported into the FMC trusted certificates store.. For pxGrid communication to establish successfully, the ISE pxGrid node certificate and FMC/Firewall pxGrid certificate must be signed by a mutually trusted Certificate Authority (CA), and the CA root certificate must be imported into the FMC trusted certificates store.

Answer

The SXP secret password does not match between ISE and the firewall.

Answer

The pxGrid subscriber profile on ISE was not approved within 24 hours.

Answer

RADIUS shared secrets are mismatched on the Policy Service Nodes.

Question 6

An administrator needs to send Cisco Secure Firewall Threat Defense audit logs and security logs to an external syslog server. Which configuration object in the FMC Platform Settings must be modified to define the destination IP address, transport protocol, and port?

Accepted Answer

Devices > Platform Settings > Syslog > Syslog Servers. Syslog server destinations are configured under Platform Settings via the Syslog server object configuration within the FMC.

Answer

System > Integration > Syslog

Answer

Access Control Policy > Logging

Answer

Objects > Object Management > Syslog Destination

Question 7

An administrator is configuring Cisco Secure Firewall Threat Defense to export syslog messages to a remote SIEM. Which TWO parameters can be customized under the FTD Platform Settings syslog configuration? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automatic synchronization of dynamic Indicators of Compromise (IoCs) to block malicious traffic.. SecureX integration allows sharing indicators of compromise (IoCs) for automated blocking/alerting and pivoting to Threat Response for investigation.

Answer

Real-time firmware updates pushed from the SecureX cloud console to the managed firewalls.

Answer

Replacement of local FMC policy administration with cloud-only RBAC management.

Answer

Direct deployment of Snort 3 custom intrusion rules compiled locally on the SecureX cloud platform.

Question 8

An administrator is configuring Cisco Secure Firewall Threat Defense to export syslog messages to a remote SIEM. Which TWO parameters can be customized under the FTD Platform Settings syslog configuration? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device name or firewall identifier in the syslog header. Syslog messages can include device identifiers and timestamps to aid SIEM correlation.

Answer

FMC administrator password hash for auditing

Answer

Full Active Directory database file attachments

Answer

Raw PCAP binary dumps appended to every syslog packet

Question 9

An administrator is troubleshooting a Cisco ISE and Secure Firewall pxGrid integration where identity policies are failing to match traffic. Which TWO tools or diagnostic methods should the administrator use to verify that IP-to-user mappings are present on the FTD? (Choose two)

Accepted Answer

Run 'show user-identity user' on the FTD CLI to verify active user mappings.. Identity mappings on FTD can be verified using FTD CLI commands such as 'show user-identity user' and inspecting the identity database statistics ('show idedb').

Answer

Inspect the 'estreamer.log' file on the FTD CLI.

Answer

Run 'show ise-server status' on the FMC CLI.

Answer

Run 'debug pxgrid packet' on the FTD privileged EXEC mode.

Question 10

An administrator is configuring third-party SIEM integration using eStreamer on the FMC. A custom client application is written to connect to the FMC eStreamer server, but the connection is immediately reset. What is the most likely cause of this issue?

Accepted Answer

The eStreamer client certificate and pkcs12 password have not been generated and configured on the FMC.. Before an eStreamer client can connect to FMC, an eStreamer certificate and password must be generated on the FMC and imported into the client application.

Answer

The SIEM is using TCP port 443 instead of eStreamer default port 8305.

Answer

Syslog facility levels are set to local0 instead of daemon.

Answer

pxGrid service is disabled on the FMC.

Question 11

An engineer is troubleshooting a mutual TLS connection failure between Cisco ISE pxGrid and the FMC. The openssl command on the FMC reveals a 'certificate verify failed' error. What is the underlying reason for this error?

Accepted Answer

The peer certificate has been signed by a Certificate Authority whose root certificate is missing from the local trust store.. A 'certificate verify failed' error indicates that the client or server certificate was signed by a CA that is not present in the truststore of the peer verifying it.

Answer

The NTP clock skew between FMC and ISE exceeds 60 seconds, causing token expiration.

Answer

The pxGrid shared secret key contains unsupported special characters.

Answer

TCP port 8910 is blocked by an intermediate stateful firewall.

Question 12

You are integrating Cisco Secure Firewall Management Center (FMC) with Cisco Identity Services Engine (ISE) via pxGrid. After successfully establishing the pxGrid connection, user identity data is not populating on the FMC. Where in the FMC GUI should you verify that the SGTs and user-to-IP mappings are being received?

Accepted Answer

Analysis > Users > Active Sessions. User-to-IP mappings and Security Group Tags (SGTs) received via pxGrid can be verified under Analysis > Users > User Activity or by checking the Connection Status within the ISE configuration pane under System > Integration > ISE.

Answer

Devices > Device Management > Advanced > pxGrid

Answer

Objects > Object Management > Access Control List

Answer

System > Integration > Cisco ISE > Runtime Status

Question 13

An administrator configures Cisco Secure Firewall Threat Defense to integrate with Cisco ISE via pxGrid. Which TWO operational benefits are provided by this integration for firewall policy enforcement? (Choose two)

Accepted Answer

Consumption of Security Group Tags (SGTs) for tag-based microsegmentation and access filtering.. pxGrid integration allows identity-based access control rules and dynamic threat mitigation (such as quarantine or tagging) based on ISE context.

Answer

Automatic generation of FTD intrusion detection signatures.

Answer

Real-time streaming of raw PCAP files to third-party SIEM platforms.

Answer

Direct management of FMC appliance administrator passwords.

Question 14

Which THREE configuration settings must be verified on the FMC when troubleshooting syslog export issues to a third-party SIEM receiver? (Choose three)

Accepted Answer

Syslog server IP address and port configuration in Platform Settings. Syslog troubleshooting involves verifying the destination server IP/port, the protocol (UDP/TCP), and ensuring that the appropriate Access Control rules or Platform Settings are configured to actually generate and send the logs.

Answer

pxGrid client approval status in Cisco ISE

Answer

eStreamer client certificate validity

Question 15

Which TWO actions must be performed on Cisco ISE when setting up pxGrid integration with Cisco Secure Firewall Management Center (FMC)? (Choose two.)

Accepted Answer

Approve the certificate for the FMC client within the Cisco ISE pxGrid services administration interface.. When integrating ISE with FMC via pxGrid, you must enable the pxGrid service on the designated ISE nodes and approve the certificate/node registration from the FMC or ISE side depending on auto-approval settings.

Answer

Enable TrustSec SGT propagation via NetFlow v9 on all ISE interfaces.

Answer

Configure SNMPv3 traps on ISE to forward user IP mappings to the FMC.

Answer

Configure a RADIUS shared secret on the FMC platform settings page.