300-710 SNCF Practice Test 23 — 15 Questions

Question 1

An administrator is troubleshooting an eStreamer client connection between a Python script and the Cisco FMC. The script fails to authenticate. Which TWO items must be verified regarding the eStreamer client credentials? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the PKCS#12 certificate file and password/keys used by the client script match the credentials generated on the FMC.. Option A is correct because the eStreamer client authenticates to the FMC using the PKCS#12 (.p12) certificate bundle and its associated password/private key that were generated when the eStreamer certificate was created on the FMC; if the script references a different file or an incorrect password, the TLS handshake and authentication will fail. Option B is correct because during eStreamer certificate generation on the FMC the administrator specifies the authorized client IP address (or hostname), and the FMC will reject connections from any host whose source IP does not match that binding, so the client host's IP must match the configured value. Option C is not relevant because eStreamer authentication does not use FTD Active Directory domain credentials. Option D is not relevant because pxGrid client approval is a Cisco ISE/pxGrid concept, not part of the FMC eStreamer authentication flow. Option E is not relevant because SNMPv3 community strings apply to SNMP polling/traps on the management interface and have nothing to do with eStreamer client authentication.

Answer

Verify the FTD Active Directory domain password.

Answer

Check the pxGrid client approval status on the Cisco ISE server.

Answer

Check the SNMPv3 community string on the FTD management interface.

Question 2

An administrator is analyzing a troubleshooting scenario involving Snort inspection crashes on an FTD device. Which THREE locations or tools should the administrator check to diagnose why the Snort process restarted or crashed? (Choose three)

Accepted Answer

Examine /var/log/messages and system log files for Out-Of-Memory (OOM) killer events targeting Snort.. Option C is correct because when the Snort process on an FTD is killed due to memory exhaustion, the Linux kernel OOM killer logs the event in /var/log/messages and other system logs, showing which process (snort) was terminated and why. Option D is correct because Snort-specific runtime errors, such as inspection engine failures or rule-related crashes, are written to the Snort logs under /var/log/snort/ and are also surfaced as health alerts in FMC, making them a primary diagnostic source. Option E is correct because when Snort crashes it can generate core dump files in the crash directories; these can be listed in expert mode or managed with the 'system support clean-core' command, and analyzing them (or their presence) helps confirm and diagnose the crash. Option A is incorrect because Smart Software Manager license expiration would cause registration or entitlement issues, not a Snort process restart or crash. Option B is incorrect because DHCP lease logs in /var/log/dhcpd.log relate to address assignment and have no bearing on Snort inspection crashes.

Answer

Check the Cisco Smart Software Manager portal for license expiration alerts.

Answer

Inspect the DHCP lease logs in /var/log/dhcpd.log.

Question 3

An organization integrates Cisco Secure Firewall Threat Defense with Cisco ISE via pxGrid. The security team notices that identity rules are matching incorrect users for traffic originating from shared Citrix terminal servers or Virtual Desktop Infrastructure (VDI) multi-user hosts. What mechanism must be enabled and configured to properly handle multi-user IP identity attribution on Secure Firewall?

Accepted Answer

Port-Based Identity mapping (or Terminal Services Agent integration) to correlate user sessions by source port in addition to IP address.. On multi-user hosts like Citrix or VDI, many users share a single IP address, so IP-to-user mapping alone cannot distinguish sessions. Port-Based Identity mapping (or Terminal Services Agent integration) correlates the source port of each connection with the user session on the host, allowing FTD to attribute traffic to the correct user even when the IP is shared.

Answer

Configuring SXP peers between the VDI hypervisor and the FMC.

Answer

Configuring static NAT overloading on the FTD egress interface.

Answer

Enabling SNMP polling on the VDI host so FMC can query active user sessions every 10 seconds.

Question 4

An administrator is planning a third-party SIEM integration with Cisco Secure Firewall Management Center. Which TWO methods or protocols are officially supported for exporting event data from the FMC to the SIEM? (Choose two)

Accepted Answer

eStreamer API / protocol over TCP port 8302. Option A is correct because the eStreamer (Event Streamer) API is Cisco's officially supported client-server protocol for sending FMC event data to third-party SIEMs; the eStreamer server on the FMC listens on TCP port 8302 and streams events to a client installed on the SIEM host. Option C is correct because FMC supports syslog export of events, configured through FTD Platform Settings (Syslog settings), and can send syslog over UDP or TCP, including TCP with TLS encryption, to an external SIEM. Option B is not correct because exporting raw PCAP files via FTP is not an event-export integration method for SIEMs and is not an officially supported SIEM data feed. Option D is not correct because direct SQL replication from the FMC's internal PostgreSQL database over SSH is unsupported and would violate Cisco's database access model. Option E is not correct because NetFlow export is a traffic-flow telemetry feature, not an FMC event-export method to a SIEM, and the FMC management interface does not provide NetFlow v5 export for this purpose.

Answer

Exporting raw packet captures (PCAP) via FTP every 5 minutes

Answer

Direct SQL database replication from the FMC internal PostgreSQL database over SSH

Answer

NetFlow v5 export from the FMC management interface

Question 5

Which THREE items are synchronized across an FTD high availability pair?

Accepted Answer

NAT tables.. HA synchronization includes NAT tables, connection/session states, and the system configuration policies.

Answer

Management interface IP.

Answer

Physical interface counters.

Question 6

An engineer is troubleshooting a scenario where Security Group Tags (SGTs) are not being enforced by FTD access control rules despite an active pxGrid connection between ISE and FMC. Which TWO potential causes should the engineer investigate? (Choose two)

Accepted Answer

SXP peering or inline TrustSec header propagation is missing along the data path between the endpoint and the FTD interface.. Option C is correct because SGT enforcement on FTD requires that the tag actually reaches the device: either via inline TrustSec (Cisco Metadata) header propagation from the upstream switch, or via SXP peering that carries IP-to-SGT mappings to the FTD. If neither the inline tag nor an SXP-learned mapping is present on the data path, the FTD has no SGT to match even though pxGrid is up. Option E is correct because FTD access control rules must explicitly reference the SGT in the rule's source/destination (Users/SGT) condition; if no SGT object is selected in the rule, the rule cannot match tagged traffic regardless of pxGrid status. Option A is incorrect because Active Directory registration of the FTD management IP is irrelevant to SGT propagation and enforcement. Option B is incorrect because eStreamer is a separate FMC event-streaming service for external consumers and is not the mechanism that delivers SGT mappings to FTD. Option D is incorrect because syslog facility local0 on a switch has no bearing on TrustSec tag propagation or FTD rule matching.

Answer

The FTD management interface IP address is not registered in Active Directory.

Answer

The FMC eStreamer service is disabled, blocking SGT updates.

Answer

Syslog facility local0 is not configured on the switch.

Question 7

An administrator is planning the deployment of Cisco Secure Firewall Virtual in a public cloud environment (AWS or Azure). Which TWO deployment practices are recommended for ensuring high availability and performance? (Choose two)

Accepted Answer

Deploy multiple virtual network interfaces (NICs) to separate management, internal, and external traffic paths.. Option A is correct because Cisco Secure Firewall Virtual in AWS/Azure should be deployed with multiple virtual NICs so that management, inside (internal), and outside (external) traffic are separated onto distinct interfaces, which is required for proper traffic inspection and to avoid asymmetric routing or management-plane contention. Option E is correct because cloud instances have finite bandwidth and the firewall's licensed throughput must match the instance's capabilities; selecting an instance size and the corresponding throughput license tier (e.g., FTDv5/10/16/24/32/64 tiers) ensures the firewall can actually handle the expected traffic load without dropping or throttling. Option B is wrong because Smart Licensing (or Smart Licensing Using Policy) is the required licensing mechanism and disabling it would break entitlement and support; cloud egress fees are not a valid reason to disable it. Option C is wrong because public cloud instances do not expose physical serial console cables to the hypervisor; initial configuration is done via the cloud console, SSH, or bootstrap/user-data. Option D is wrong because single-NIC deployments with VLAN subinterfaces are not the recommended HA/performance design in public clouds, where multiple ENIs/NICs are used to separate traffic paths and support scaling.

Answer

Disable Smart Licensing to avoid cloud internet egress fees.

Answer

Use physical serial console cables attached to the hypervisor for initial configuration.

Answer

Rely solely on single-NIC deployments with VLAN subinterfaces trunking all cloud traffic.

Question 8

An administrator needs to schedule automated weekly backups of the FMC configuration and store them securely on a remote SCP server. Where is remote backup storage configured in the FMC GUI?

Accepted Answer

System > Tools > Backup / Restore > Remote Storage. Remote backup storage for FMC is configured under System > Tools > Backup / Restore > Remote Storage. This is where you specify the SCP server details for storing backups remotely.

Answer

Devices > Device Management > Backup

Answer

System > Integration > SCP Servers

Answer

Objects > Object Management > Servers > Backup

Question 9

An engineer is configuring Cisco eStreamer to stream events from FMC to a third-party SIEM. The firewall security policy blocks incoming connections on port 8302 from the SIEM server to the FMC. Which device and interface are involved in listening for the eStreamer client connection?

Accepted Answer

The FMC management interface listening on TCP port 8302.. The eStreamer server process runs on the Cisco Secure Firewall Management Center (FMC), listening on TCP port 8302 on its management interface.

Answer

The FTD data interface listening on TCP port 8302.

Answer

The FTD management interface listening on UDP port 514.

Answer

The ISE pxGrid node listening on TCP port 8910.

Question 10

Which TWO of the following are valid high availability modes for FTD?

Accepted Answer

Active/Standby.. Option C (Active/Standby) is correct because FTD supports a stateful failover HA pair in which one unit actively passes traffic while the standby unit synchronizes connection and state information and takes over if the active unit fails. Option D (Clustering) is correct because FTD supports clustering, where multiple FTD devices are grouped into a single logical cluster to provide both high availability and increased throughput/scalability. The other options are not valid FTD HA modes: Active/Active (non-clustered) is not a supported FTD failover mode, Failover-on-demand is not an FTD HA configuration, and Load-Balanced Passive is not a recognized FTD high availability mode.

Answer

Active/Active (non-clustered).

Answer

Failover-on-demand.

Answer

Load-Balanced Passive.

Question 11

Which THREE items are required to create a port channel on an FTD device?

Accepted Answer

LACP configuration. To create a port channel on an FTD device, you must configure LACP (option B), which is the link aggregation protocol used to negotiate and bundle the member links, and you need two or more physical interfaces (option C) to serve as the members of the EtherChannel. You also must create a logical Port-Channel interface (option E), which is the aggregated interface that receives the IP configuration and is referenced by policies and routing, with the physical interfaces assigned to it. A static route to the port channel (option A) is not required to build the port channel itself; routing is configured separately after the interface exists. A physical bypass module (option D) is a hardware fail-to-wire feature unrelated to forming a port channel and is not a prerequisite.

Answer

A static route to the port channel

Answer

A physical bypass module

Question 12

Which object type should be used to represent a group of network subnets?

Accepted Answer

Network Group. A Network Group object allows you to aggregate multiple network subnets into a single object for policy efficiency.

Answer

Host

Answer

Range

Answer

Port Group

Question 13

Which TWO of the following are valid reasons to use Transparent Mode?

Accepted Answer

Simplified L2 insertion.. Option D is correct because Transparent Mode lets a firewall be inserted into an existing Layer 2 segment without requiring any IP addressing or routing changes, so deployment is a simple drop-in at the L2 level. Option E is correct because in Transparent Mode the device forwards traffic without acting as a router or NAT boundary, preserving the original source and destination IP addresses so the network remains address-transparent. Options A, B, and C are not valid reasons: Transparent Mode still inspects L3/L4 headers rather than ignoring them, it explicitly does not act as a Layer 3 gateway, and it does not provide dynamic routing, which requires an L3 interface and routing protocols.

Answer

To increase throughput by ignoring L3 headers.

Answer

To act as a Layer 3 gateway.

Answer

To enable dynamic routing.

Question 14

Which THREE considerations must be addressed when deploying FTDv in a public cloud?

Accepted Answer

Integration with cloud route tables for failover.. When deploying FTDv in a public cloud, integration with cloud route tables for failover (A) is required because FTDv cannot use traditional Layer 2 failover mechanisms; instead, failover is achieved by manipulating cloud provider route tables to redirect traffic to the standby instance. VPC security group constraints (B) must be addressed because security groups act as stateful virtual firewalls at the instance level and can block the management, data, and failover traffic that FTDv requires, so rules must be carefully configured. Cloud-specific instance sizing (C) is also essential because FTDv performance depends on the selected cloud instance type's CPU, memory, and network bandwidth, and supported instance sizes differ from on-premises hardware models. Hardware bypass capabilities (D) do not apply because public cloud instances have no physical network interface cards or hardware bypass pairs. Clustering using local control links (E) is not applicable because FTDv clustering in public clouds uses cloud-native constructs and does not rely on dedicated local control-link interfaces as on physical appliances.

Answer

Hardware bypass capabilities.

Answer

Clustering using local control links.

Question 15

Which protocol is utilized by Cisco Secure Firewall Management Center and FTD devices to communicate with Cisco SecureX for cloud-delivered threat intelligence?

Accepted Answer

HTTPS (REST API over port 443). Cisco SecureX and cloud services communicate with Cisco Secure Firewall Management Center using REST APIs over HTTPS (port 443).

Answer

SNMPv2c

Answer

TFTP

Answer

Syslog over UDP 514