300-710 SNCF Practice Test 22 — 15 Questions

Question 1

When configuring the integration between Cisco Secure Firewall and Cisco ISE via pxGrid, what is the primary role of Cisco ISE in this architecture?

Accepted Answer

To provide user identity, IP address mapping, and group context to the firewall.. Cisco ISE acts as the source of truth for user identity, endpoint posture, and contextual metadata, sharing it with the firewall via pxGrid.

Answer

To act as the primary syslog collector for firewall intrusion alerts.

Answer

To act as an inline packet inspection engine for Layer 7 threats.

Answer

To store and analyze raw eStreamer event streams from the firewall.

Question 2

An administrator needs to troubleshoot an issue where legitimate traffic is being silently dropped by the FTD device. The standard packet trace does not reveal the exact reason. Which command executed on the FTD CLI is best suited to diagnose accelerated security path (ASP) drops in real time?

Accepted Answer

capture drop type asp-drop all. The command 'capture drop type asp-drop all' is specifically designed to capture packets dropped by the Accelerated Security Path (ASP) on Cisco FTD devices. It provides real-time visibility into drops that occur in the ASP, which are not always visible through standard packet traces. This makes it the best tool for diagnosing silent drops caused by ASP-level issues.

Answer

capture capin interface outside match ip any any

Answer

system support firewall-engine-debug

Answer

debug crypto ipsec

Question 3

An administrator wants to configure an Access Control rule that triggers an Intrusion Policy only when specific vulnerability signatures match. Where is the Intrusion Policy assigned?

Accepted Answer

Under the Inspection tab of an individual Access Control rule. In Cisco Secure Firewall Management Center (FMC), an Intrusion Policy is assigned under the Inspection tab of an individual Access Control rule. This allows the rule to trigger intrusion inspection only when the traffic matches the rule's conditions (e.g., specific source/destination, application, or URL). This granular assignment ensures that intrusion detection/prevention is applied selectively based on the rule's match criteria.

Answer

Under the Advanced tab of the Access Control Policy globally

Answer

Within the Platform Settings object

Answer

In the Security Intelligence policy settings

Question 4

An administrator is deploying a Cisco Secure Firewall Virtual (Fv) appliance in an Amazon Web Services (AWS) environment. Which licensing model is typically supported for traffic throughput and feature activation during this cloud deployment?

Accepted Answer

Smart Licensing (BYOL) and Pay-As-You-Go (PAYG) through the AWS Marketplace.. Cisco Secure Firewall Virtual (Fv) in AWS supports two licensing models: Bring Your Own License (BYOL) using Smart Licensing, and Pay-As-You-Go (PAYG) purchased directly through the AWS Marketplace. BYOL lets you apply existing Smart Licenses (via CSSM or a registration token), while PAYG bundles the license into the hourly AWS instance charge and activates features automatically. Both models govern throughput tier and feature activation (e.g., IPS, URL filtering, malware).

Answer

Activation via automatic license generation from the Amazon VPC DHCP options list.

Answer

Perpetual hardware-locked PAK files applied via the command line interface.

Answer

Activation exclusively through an on-premises Cisco Smart Software Manager (CSSM) satellite server without internet access.

Question 5

When configuring Cisco ISE pxGrid integration within the Firepower Management Center, which TCP port must be open across the intermediate firewall for secure pxGrid communication?

Accepted Answer

TCP 8910. Cisco ISE pxGrid typically operates over TCP port 8910 for client-server communications.

Answer

TCP 389

Answer

TCP 80

Answer

UDP 514

Question 6

An engineer configures Cisco Secure Firewall Threat Defense to ingest SGTs from Cisco ISE via pxGrid and wants to enforce access control based on these tags. Which TWO requirements must be met for the firewall to successfully enforce SGT-based policies? (Choose two)

Accepted Answer

An active and healthy pxGrid connection between ISE and FMC to synchronize IP-to-SGT mappings.. Option D is correct because SGT-based enforcement on Cisco Secure Firewall Threat Defense depends on the FMC receiving IP-to-SGT mappings from Cisco ISE over pxGrid; without a healthy, active pxGrid session between ISE and FMC, the firewall has no tag-to-IP binding to match in access control rules. Option E is correct because the SGT metadata must actually reach the enforcement point in the data plane: either via SXP peering (to propagate SGT bindings to devices that cannot natively carry tags) or via inline TrustSec tagging, so packets retain their SGT across the network and the FTD can enforce policy on them. Option A is incorrect because eStreamer is used for exporting intrusion and connection events to external collectors, not for SGT ingestion or enforcement. Option B is incorrect because syslog with the local4 facility is only for logging/event delivery and has no role in SGT synchronization or policy enforcement. Option C is incorrect because direct LDAP integration to Active Directory on the FTD CLI is not required for SGT-based access control; identity and SGT mapping come through ISE/pxGrid, not a direct FTD LDAP configuration.

Answer

An active eStreamer subscription for intrusion event streaming.

Answer

Syslog server configuration with local4 facility enabled.

Answer

Active Directory domain controller LDAP integration directly configured on the FTD CLI.

Question 7

An administrator is deploying static route tracking combined with IP SLA on a Cisco Secure Firewall Threat Defense device managed by Cisco FMC. Which TWO components must be configured to implement this feature successfully? (Choose two)

Accepted Answer

A Track object that monitors the state of the IP SLA operation.. Option B is correct because static route tracking on Cisco Secure Firewall Threat Defense requires a Track object that references the IP SLA operation and whose up/down state is bound to the static route, so the route is withdrawn or reinstalled based on probe results. Option D is correct because the underlying IP SLA monitor object must be defined first, specifying the target IP address and probe type (for example ICMP Echo) that the Track object monitors. Together, the IP SLA monitor generates the reachability data and the Track object translates that data into a route-tracking state used by the static route. Option A is incorrect because IP SLA telemetry does not require a dedicated secondary management interface; probes are sourced from the data interface associated with the route. Option C is incorrect because static route tracking with IP SLA is a local mechanism and does not depend on BGP peering or advertising SLA status to upstream routers. Option E is incorrect because no Access Control Rule permitting ICMP to a loopback interface is needed; IP SLA ICMP Echo probes are generated by the device itself and are not subject to FMC Access Control policy in that manner.

Answer

A secondary management interface configured for out-of-band SLA telemetry.

Answer

A BGP routing peer group that automatically advertises SLA status to upstream routers.

Answer

An Access Control Rule explicitly permitting ICMP traffic destined for the firewall's loopback interface.

Question 8

An administrator needs to monitor the real-time health and status of managed devices from the FMC dashboard. Which TWO dashboard widgets or features are available in FMC to assist with device monitoring? (Choose two)

Accepted Answer

Health Status widget. The Health Status widget (A) is a standard FMC dashboard widget that displays real-time health metrics for managed devices, including CPU, memory, disk usage, and interface status, making it directly relevant to monitoring device health. The Device Status widget (E) is also an FMC dashboard widget that shows the current up/down status and connectivity of managed devices, which is exactly what the administrator needs for real-time status monitoring. The Real-time Packet Replay widget (B) does not exist in FMC; packet capture and replay are handled through troubleshooting tools, not dashboard widgets. The Firewall Cluster Load Balancing Graph widget (C) is not an FMC dashboard feature; FMC provides cluster status via device health monitors, not a dedicated load-balancing graph widget. The Active BGP Neighbor Matrix widget (D) is not an FMC dashboard widget; BGP neighbor status is viewed through device-specific routing tables or CLI, not a dashboard matrix.

Answer

Real-time Packet Replay widget

Answer

Firewall Cluster Load Balancing Graph widget

Answer

Active BGP Neighbor Matrix widget

Question 9

An engineer is configuring NGIPS inline sets on a Cisco Secure Firewall Threat Defense deployment. Which THREE configuration options or behaviors are associated with inline sets? (Choose three)

Accepted Answer

Snort Bypass can be configured to pass traffic uninspected if the inspection engine is overloaded.. Option A is correct because inline sets support Snort Bypass, which allows traffic to be passed uninspected when the inspection engine is overloaded or fails, preserving availability. Option C is correct because inline normalization is a configurable feature that rewrites packets to remove ambiguities, proactively mitigating evasion techniques such as overlapping fragments or TTL manipulation. Option D is correct because an inline set pairs two interfaces, and traffic entering one interface is inspected by the NGIPS engine and forwarded out the paired interface, dropping malicious traffic as needed. Option B is incorrect because inline sets are Layer 2 transparent inspection constructs and do not run dynamic routing protocols like OSPF. Option E is incorrect because inline set interfaces are typically configured without Layer 3 IP addresses, operating in transparent mode rather than requiring unique IPs.

Answer

Inline sets automatically function as dynamic OSPF routers for neighboring switches.

Answer

Inline sets require every participating interface to have a unique Layer 3 IP address.

Question 10

An administrator is configuring Cisco Secure Firewall Threat Defense to export syslog messages to a remote SIEM. Which TWO parameters can be customized under the FTD Platform Settings syslog configuration? (Choose two)

Accepted Answer

Syslog facility levels (e.g., local0 through local7) and severity filters. Under FTD Platform Settings > Syslog, the administrator can define the logging destination and customize how messages are sent, including the syslog facility (local0 through local7) and severity level filters that determine which messages are forwarded to the SIEM, making option D correct. The same configuration section also lets you select the transport used to reach the syslog server—UDP or TCP with Reliable Syslog (TLS encryption)—so option E is correct. Option A is wrong because IPsec tunnel encryption algorithms are configured in the VPN/IPsec settings, not in Platform Settings syslog. Option B is wrong because the OSPF router ID is set under routing protocol configuration, not syslog. Option C is wrong because Snort inspection memory allocation is tuned in the inspection engine/advanced settings, not in the syslog configuration.

Answer

The encryption algorithm used for IPsec VPN tunnels terminating on the FTD

Answer

The OSPF routing protocol router ID

Answer

The Snort inspection engine memory allocation size

Question 11

Which action must be taken on the FTD CLI after a manual configuration change is made, if you want to ensure the FMC does not overwrite it?

Accepted Answer

Manual changes should be avoided; perform all changes in FMC.. Manual changes on the FTD CLI should be avoided because the FMC is the central management platform and will overwrite any manual configuration changes during the next policy deployment. To ensure the FMC does not overwrite manual changes, the best practice is to perform all changes in FMC. There is no CLI command to lock manual changes from being overwritten.

Answer

Set the device to 'Read-Only' mode.

Answer

Run 'fmc update lock'.

Answer

Run 'write memory' to lock the configuration.

Answer

Run 'commit configuration' to save the state.

Question 12

An administrator is integrating Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. The connection fails during the certificate validation phase because the FMC rejects the ISE pxGrid certificate. Upon inspection, the FMC certificate store lacks the intermediate CA certificate of the PKI hierarchy used by ISE. How should the administrator resolve this?

Accepted Answer

Upload the complete certificate authority chain (Root and Intermediate CA certificates) into the FMC Trusted CAs object repository.. Mutual TLS for pxGrid requires the FMC to trust the entire certificate chain presented by ISE. The administrator must upload both the Root CA and Intermediate CA certificates of the ISE PKI to the FMC's trusted certificate store under Object Management > PKI > Trusted CAs.

Answer

Configure an SNMPv3 community string to bridge the certificate trust gap.

Answer

Generate a self-signed certificate on the FTD CLI and assign it as the pxGrid trust anchor.

Answer

Disable certificate validation in the FMC pxGrid advanced configuration menu.

Question 13

An administrator needs to perform a full system backup of the FMC. Where is the most appropriate place to store this backup for long-term disaster recovery?

Accepted Answer

Remote server using SCP or SFTP. The FMC full system backup must be stored off-box for true disaster recovery. Cisco explicitly supports exporting the backup to a remote server via SCP or SFTP, which provides a durable, external location that survives FMC hardware failure, reimaging, or replacement. Because the backup contains the entire FMC configuration, database, and OS state, keeping it on a remote server ensures it can be restored to a new appliance or VM during a full-site disaster.

Answer

Local /var/log/backup partition

Answer

The FMC /tmp directory

Answer

Attached USB storage drive

Answer

The managed FTD flash memory

Question 14

Which command is used on the Cisco Secure Firewall Threat Defense CLI to verify that the device is successfully communicating with the Cisco Secure Firewall Management Center?

Accepted Answer

show managers. To check the registration and management connection status between FTD and FMC, the administrator uses the CLI command 'show managers'.

Answer

show fmc status

Answer

show isc status

Answer

show controller connection

Question 15

An administrator is troubleshooting an eStreamer client script failure where the connection is refused on port 8302. Which TWO potential causes should the administrator investigate? (Choose two)

Accepted Answer

An intermediate firewall or the FMC internal iptables firewall is blocking TCP port 8302 traffic.. Option A is correct because eStreamer clients connect to the FMC on TCP port 8302, so a connection-refused or blocked result can come from an intermediate firewall or the FMC's own iptables rules filtering that port. Option E is correct because the eStreamer service (the eStreamer daemon on the FMC management plane) must be running and enabled; if it is stopped or disabled, nothing listens on TCP 8302 and the client receives a connection refused. Option B is not relevant because an out-of-memory Snort engine on an FTD affects inspection/event generation, not the FMC's eStreamer listener on port 8302. Option C is not relevant because a DHCP lease expiry on an FTD data interface is a Layer 3 addressing issue unrelated to the FMC eStreamer service port. Option D is not relevant because pxGrid certificates on ISE pertain to pxGrid/ISE integration, not to the FMC eStreamer TCP 8302 service.

Answer

The FTD Snort engine is out of memory.

Answer

The DHCP lease on the FTD data interface has expired.

Answer

The pxGrid certificate on ISE has expired.