300-710 SNCF Practice Test 22 — 15 Questions

Question 1

An administrator is configuring third-party SIEM integration using syslog on Cisco Secure Firewall Threat Defense. Which TWO configuration practices are recommended to ensure optimal log management and troubleshooting? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure severity filtering to prevent excessive, low-priority debug logs from overwhelming the SIEM ingestion capacity.. Recommended syslog practices include filtering event severities to avoid log flooding and using Reliable Syslog (TCP/TLS) for secure, guaranteed transmission.

Answer

Disable connection teardown logging to reduce log volume.

Answer

Configure all FTD devices to use UDP port 514 without severity filters.

Answer

Export raw PCAP files via syslog instead of text logs.

Question 2

An engineer is troubleshooting Cisco Secure Firewall integration with Cisco SecureX. The integration is active, but a custom threat indicator block action initiated in SecureX fails to reach the managed FTD devices. Which TWO troubleshooting steps should the engineer perform? (Choose two)

Accepted Answer

Check FMC cloud services log files to verify that API requests from SecureX completed successfully without authorization errors.. Troubleshooting SecureX action delivery involves checking API communication between SecureX and FMC, and verifying that FMC successfully deploys policy updates to the FTD sensors.

Answer

Run 'show pxgrid status' on the FTD CLI.

Answer

Inspect the 'estreamer.log' on the FTD CLI.

Answer

Restart the physical FTD appliance to force cloud synchronization.

Question 3

An administrator is integrating Cisco Secure Firewall Threat Defense with Cisco Threat Response (now Cisco SecureX threat intelligence). Which mechanism does the firewall use to automatically receive dynamic indicators of compromise (IoCs) and perform retrospective security analysis?

Accepted Answer

Cisco SecureX cloud-native telemetry and integration settings configured in the FMC.. Secure Firewall integrates with Cisco SecureX threat intelligence / Threat Response via Cisco SecureX cloud services, which synchronize dynamic IoCs and trigger retrospective alerts.

Answer

Syslog forwarding over TLS to the Cisco Talos collector IP.

Answer

Periodic manual import of STIX/TAXII threat feeds via an automated script on port 443.

Answer

Direct eStreamer API polling from the Cisco Cloud proxy.

Question 4

An administrator wishes to configure third-party SIEM integration with Cisco Secure Firewall Threat Defense by forwarding security events in a standard format. While eStreamer is available, the SIEM only accepts standard syslog. Which configuration options must be selected in FMC to ensure the SIEM receives parseable CEF (Common Event Format) or LEEF logs?

Accepted Answer

Configure syslog output format to include unified syslog or standard text formats compatible with SIEM parsers in Platform Settings.. FMC Platform Settings or Alert configurations allow formatting syslog output into industry-standard formats such as Cisco standard, or leveraging advanced logging integrations. Wait, FMC syslog settings support Cisco legacy format or standard syslog, but third-party SIEM parsing often relies on specific header mappings or third-party connectors. Let's look at standard FMC syslog capabilities: FMC allows configuring syslog alert formats under Platform Settings.

Answer

Enable the eStreamer-to-Syslog translator daemon inside Access Control policies.

Answer

Configure NetFlow v9 templates with custom CEF field type definitions.

Answer

Install a CEF/LEEF plugin on the managed Threat Defense device via FlexConfig.

Question 5

An administrator is configuring Cisco Secure Firewall Threat Defense to send connection and intrusion events to a third-party SIEM. Which protocol and port are natively supported by the eStreamer client integration for streaming events from the firewall?

Accepted Answer

TCP port 8302 using the eStreamer API. The Cisco eStreamer (Event Streamer) daemon on Secure Firewall Threat Defense communicates with external clients over TCP port 8302, using a securely negotiated SSL/TLS connection.

Answer

TCP port 514 using standard Syslog

Answer

TCP port 9997 using Splunk Forwarder protocol

Answer

UDP port 443 using HTTPS

Question 6

An administrator is configuring Cisco ISE pxGrid integration with Cisco Secure Firewall Management Center. Which TWO identity sources or methods supported by ISE can provide context that is subsequently consumed by FTD via pxGrid? (Choose two)

Accepted Answer

Guest WebAuth portal authentications. ISE gathers identity context from 802.1X/RADIUS authentications, passive identity collectors, and web authentication portals, publishing them via pxGrid.

Answer

Raw NetFlow v5 packet streams exported directly from core routers to the FMC

Answer

Local FTD administrator CLI login sessions

Answer

DHCP server static lease table text files imported manually into FMC

Question 7

When configuring Cisco ISE pxGrid integration within the Firepower Management Center, which TCP port must be open across the intermediate firewall for secure pxGrid communication?

Accepted Answer

TCP 8910. Cisco ISE pxGrid typically operates over TCP port 8910 for client-server communications.

Answer

TCP 389

Answer

TCP 80

Answer

UDP 514

Question 8

Which TWO benefits are gained by integrating Cisco Secure Firewall with Cisco Identity Services Engine (ISE) using TrustSec SGTs? (Choose two)

Accepted Answer

Propagation of security tags across network boundaries via SXP for consistent enforcement. TrustSec SGT integration allows creating scalable firewall access control policies based on security groups rather than changing IP addresses, and enforcing segmentation across the network.

Answer

Automatic remediation of endpoint malware infections via direct quarantine commands sent from the firewall to Active Directory

Answer

Replacement of traditional routing protocols with TrustSec matrix routing

Answer

Elimination of the need for access control rules on the firewall

Question 9

An administrator is troubleshooting eStreamer event export from a Firepower Management Center to a third-party SIEM tool. Which TWO factors can cause eStreamer communication to fail? (Choose two.)

Accepted Answer

TCP port 8302 is blocked by an intermediate firewall between the FMC and the eStreamer client.. eStreamer communication relies on valid PKCS#12 client certificates generated on the FMC and proper firewall/network rules allowing TCP port 8302 between the FMC and the eStreamer client.

Answer

NetFlow export rate-limiting has been exceeded on the data interfaces.

Answer

The SNMPv3 authentication password does not match between the devices.

Answer

The Syslog server is configured to use UDP port 514 instead of TCP port 514.

Question 10

An enterprise integrates Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. Which TWO conditions or events can cause an active user-to-IP mapping to be purged from the FTD identity table? (Choose two)

Accepted Answer

Receipt of a RADIUS accounting stop message or session timeout expiration.. Active identity mappings are purged when ISE sends session termination notices (logoff) or when accounting stop messages are received from the network access device.

Answer

A scheduled weekly restart of the eStreamer service on the FMC.

Answer

Automatic daily rotation of the FMC administrator password.

Answer

An update to the Snort intrusion signature package.

Question 11

An administrator sets up Cisco ISE and Secure Firewall integration. The firewall successfully learns user identities from ISE pxGrid, but when users roam to a new IP address, the firewall continues to apply the old IP-to-user mapping for several minutes. What is the best way to resolve this synchronization lag?

Accepted Answer

Ensure real-time pxGrid session notifications are enabled and check the Active Directory agent timeouts if applicable.. Tuning the pxGrid session refresh and timeout settings or verifying the pxGrid subscription status ensures prompt updates of session changes.

Answer

Reboot the FMC daily via a cron job.

Answer

Increase the NetFlow export interval to 1 minute.

Answer

Change the syslog facility to emergency.

Question 12

An engineer is troubleshooting a scenario where Cisco Secure Firewall is receiving SGT information from Cisco ISE via SXP, but access control rules referencing Security Group Tags are not matching traffic. What is the most effective command to run on the Threat Defense CLI to verify that the firewall has learned the IP-to-SGT mappings?

Accepted Answer

show sgt mapping. On Cisco Secure Firewall Threat Defense (CLI), the command 'show sgt mapping' or 'show ip sgt mapping' is used to verify learned SXP bindings. Specifically, 'show sgt map' or 'show epe sgt' depending on the exact build, but 'show ip sgt mapping' or 'show sgt' commands are standard. Wait, the exact command is 'show sgt mapping'.

Answer

show pxgrid clients

Answer

show trustsec sxp connections

Answer

show access-list

Question 13

Which THREE types of events can be streamed natively from Cisco Secure Firewall using the eStreamer API to a third-party SIEM or custom application? (Choose three)

Accepted Answer

Connection events. eStreamer supports streaming connection events, intrusion events, and file events (along with malware events).

Answer

FMC hardware temperature sensor telemetry logs

Answer

CLI administrator command audit logs

Question 14

A security analyst configures syslog integration on Cisco Secure Firewall Threat Defense to forward critical security events to a Splunk SIEM. Which configuration step must be performed within the Firepower Management Center (FMC) to ensure these logs include the user identity and SGT mapping?

Accepted Answer

Configure syslog alerts within the Access Control Policy rules and ensure user identity inclusion is enabled.. To include identity and user metadata in syslog messages generated by Threat Defense, the administrator must ensure that Extended Syslog formats or appropriate logging destinations containing user activity are enabled within the Platform Settings or Access Control Policy syslog settings.

Answer

Enable SNMP polling on the FMC for user IP mappings.

Answer

Deploy an eStreamer client directly on the Splunk indexer.

Answer

Configure NetFlow export templates to include SGT fields.

Question 15

A security engineer is integrating Cisco Secure Firewall with a third-party SIEM using eStreamer. The SIEM vendor's connector documentation requires the eStreamer event types to be parsed correctly. Which file format or protocol encoding does eStreamer use to transmit event records over TCP port 8305?

Accepted Answer

Compressed binary-encoded records over a custom TCP session. eStreamer transmits serialized binary event records over a secured TCP connection.

Answer

JSON over HTTPS REST API

Answer

XML-formatted SOAP messages

Answer

Syslog-formatted plain text over TLS