300-710 SNCF Practice Test 23 — 15 Questions

Question 1

An enterprise environment requires streaming connection events, intrusion events, and file events from Cisco Secure Firewall Threat Defense to a third-party SIEM. Which native protocol and feature on the firewall is designed to stream these events in real time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

eStreamer. The eStreamer (Event Streamer) API allows external applications and SIEM systems to stream real-time connection, intrusion, and file events from the FMC.

Answer

NetFlow v9

Answer

Syslog over UDP

Answer

SNMPv3 Traps

Question 2

When configuring the integration between Cisco Secure Firewall and Cisco ISE via pxGrid, what is the primary role of Cisco ISE in this architecture?

Accepted Answer

To provide user identity, IP address mapping, and group context to the firewall.. Cisco ISE acts as the source of truth for user identity, endpoint posture, and contextual metadata, sharing it with the firewall via pxGrid.

Answer

To act as the primary syslog collector for firewall intrusion alerts.

Answer

To act as an inline packet inspection engine for Layer 7 threats.

Answer

To store and analyze raw eStreamer event streams from the firewall.

Question 3

Which TWO protocols or mechanisms are used to integrate Cisco Identity Services Engine (ISE) with Cisco Secure Firewall Threat Defense? (Choose two)

Accepted Answer

SXP. Cisco ISE integrates with Secure Firewall using pxGrid (for identity/context sharing) and SXP (for SGT tag and IP mapping propagation).

Answer

NetFlow v5

Answer

LDAP direct bind

Answer

SNMPv1

Question 4

An administrator is troubleshooting a Cisco Secure Firewall Threat Defense deployment integrated with Cisco ISE using pxGrid for TrustSec. The firewall is failing to enforce Security Group Tag (SGT) filtering on incoming traffic. What is the most likely cause of this issue?

Accepted Answer

Inline tagging is disabled in the access control policy Advanced settings.. For SGT enforcement to work properly on Secure Firewall Threat Defense, inline tagging must be enabled on the access control policy or the SGT/ISE integration must be explicitly mapped and enabled in the platform settings and access control rules, ensuring SGT metadata is preserved across security zones.

Answer

Syslog event generation for identity events is disabled in the platform settings.

Answer

The pxGrid certificate on ISE has expired, but the node trust is still active.

Answer

The eStreamer service on the FMC is stopped.

Question 5

An enterprise security architect is designing an architecture where Cisco Secure Firewall Threat Defense integrates with a third-party SIEM. Which THREE methods or protocols are officially supported for exporting security events and logs from the FMC/Firewall to the third-party SIEM? (Choose three)

Accepted Answer

Cisco SecureX / REST APIs for programmatic event retrieval. Supported methods for exporting events to third-party SIEMs include syslog, the eStreamer API, and Cisco SecureX/REST APIs.

Answer

Direct SQL database replication from the FMC internal PostgreSQL database to the SIEM

Answer

SNMPv1 trap forwarding of full packet payloads

Question 6

When configuring Cisco Secure Firewall Threat Defense integration with Cisco Threat Response (SecureX Threat Response) for automated threat hunting and mitigation, which THREE components or steps are required? (Choose three.)

Accepted Answer

Register the Firepower Management Center with the SecureX cloud portal using a generated registration token.. Integrating Secure Firewall with SecureX Threat Response requires registering the FMC with SecureX, configuring API access, and ensuring outbound HTTPS connectivity to the SecureX cloud infrastructure.

Answer

Configure an eStreamer client certificate specifically for SecureX cloud relay.

Answer

Deploy an external Syslog collector virtual appliance inside the SecureX cloud tenant.

Question 7

When configuring syslog export from Cisco Secure Firewall Threat Defense using Firepower Management Center, which alert format should you choose to ensure standard SIEM ingestion parsers can easily read the event headers?

Accepted Answer

IETF (RFC 5424) format. Syslog messages exported from Secure Firewall Threat Defense can be formatted using BSD (RFC 3164) or IETF (RFC 5424) formats. RFC 5424 is the standard IETF structured format widely supported by modern SIEMs.

Answer

SNMP v2c Trap format

Answer

Legacy ASA native text format

Answer

NetFlow v9 structured records

Question 8

Which TWO fields are commonly used in the 'NAT Rule' editor to define the source address?

Accepted Answer

Translated Source. NAT rules use 'Original Source' and 'Translated Source' fields to define the address translation logic.

Answer

Destination Port

Answer

Access List

Answer

Interface Group

Question 9

When configuring an Access Control Policy on the FMC, what is the purpose of the Default Action set at the bottom of the rules table?

Accepted Answer

It defines the action taken for traffic that matches no explicit rules in the policy.. The Default Action determines how traffic that fails to match any explicit access control rule is handled (typically Block or Pass with logging).

Answer

It sets the global timeout values for all TCP connections.

Answer

It acts as a prefilter rule for dropped packets.

Answer

It forces all unmatched traffic to be sent to the Cisco Cloud for telemetry.

Question 10

An FTD device is deployed in routed mode with multiple security zones. An administrator needs to configure an Access Control rule that evaluates traffic flowing between two different security zones. How are security zones utilized in the rule?

Accepted Answer

Security zones are selected under the Zones tab of an Access Control rule as Source and Destination.. Security zones are groupings of interfaces referenced as source and destination zones within Access Control rules.

Answer

Security zones replace IP address objects entirely in all rule configurations.

Answer

Security zones are used exclusively in NAT translation rules.

Answer

Security zones are assigned globally in device platform settings, not in access rules.

Question 11

Where in the FMC UI do you go to create a new Access Control Policy?

Accepted Answer

Policies > Access Control. Access Control Policies are found under the Policies menu.

Answer

Devices > Device Management

Answer

Objects > Object Management

Answer

Analysis > Connection

Question 12

An administrator configures DNS injection and rewriting in a manual NAT rule on an FTD device. What is the primary purpose of enabling DNS translation in a NAT rule?

Accepted Answer

To rewrite DNS A-records returning internal server IPs so external clients receive the correct public NAT IP. DNS translation ensures that when an internal client queries a local DNS server for an external name that resolves to a private IP (due to NAT), the FTD rewrites the DNS A-record response to the public IP.

Answer

To cache DNS responses locally on the FTD control plane

Answer

To encrypt DNS queries over TLS (DoT)

Answer

To block malicious DNS tunneling attempts via Snort inspection

Question 13

An administrator is troubleshooting an SSL Decryption policy where encrypted connections are failing. The FMC logs indicate that clients are rejecting the FTD's re-signed certificate because it is not trusted. What configuration step is missing?

Accepted Answer

Deploy the FTD's Re-signing CA certificate to the trusted root certification authorities store of all internal client endpoints.. When using Decrypt - Resign, the FTD acts as a proxy and signs certificates with a Sub-CA. End-user machines must trust this Sub-CA certificate.

Answer

Configure a Prefilter policy to bypass SSL handshakes for those clients.

Answer

Import the server's private key into the FTD certificate store.

Answer

Enable SSL Known Key decryption for external websites.

Question 14

A network engineer is deploying a Firepower Threat Defense (FTD) device and must configure NAT to translate an internal server IP of 10.10.10.50 to a public IP of 203.0.113.50 while preserving the original source port for inbound traffic. Which NAT type accomplishes this?

Accepted Answer

Manual Static NAT. Manual Static NAT allows the translation of a specific internal IP to a specific external public IP while supporting port translation and preservation options.

Answer

Auto NAT (Dynamic PAT)

Answer

Manual Identity NAT

Answer

Auto NAT (Static Patched)

Question 15

You are configuring an SSL Decryption policy. Which action is required to ensure that traffic to a specific financial website is excluded from inspection due to compliance reasons?

Accepted Answer

Do Not Decrypt. The 'Do Not Decrypt' action is used in the SSL policy to bypass decryption for specific traffic based on URL or category.

Answer

Decrypt - Resign

Answer

Bypass

Answer

Block