300-710 SNCF Practice Test 24 — 15 Questions

Question 1

You are configuring static route tracking on an FTD device. What is the primary purpose of this configuration?

Accepted Answer

To ensure traffic is only routed through a verified path.. Static route tracking allows the firewall to monitor the availability of a path using ICMP or other probes and remove the route from the routing table if the probe fails.

Answer

To load-balance traffic across ISPs.

Answer

To increase the throughput of the interface.

Answer

To dynamically adjust the MTU of the link.

Question 2

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslogs to a third-party SIEM. To ensure confidentiality of sensitive log data traversing untrusted network segments, how should the syslog export be configured?

Accepted Answer

Configure Reliable Syslog utilizing TCP with TLS encryption under Platform Settings > Syslog.. To secure syslog transmission, administrators configure Reliable Syslog, which uses TLS encryption over TCP (typically on TCP port 6514) between the FTD and the SIEM syslog collector.

Answer

Configure HTTPS POST requests in the eStreamer client configuration.

Answer

Enable Secure Shell (SSH) port forwarding for UDP port 514.

Answer

Tunnel all UDP syslog packets inside an IPsec VPN tunnel terminated on the FMC management interface.

Question 3

An administrator is configuring Cisco Secure Firewall Threat Defense to send connection and intrusion events to a third-party SIEM. Which protocol and port are natively supported by the eStreamer client integration for streaming events from the firewall?

Accepted Answer

TCP port 8302 using the eStreamer API. The Cisco eStreamer (Event Streamer) daemon on Secure Firewall Threat Defense communicates with external clients over TCP port 8302, using a securely negotiated SSL/TLS connection.

Answer

TCP port 514 using standard Syslog

Answer

TCP port 9997 using Splunk Forwarder protocol

Answer

UDP port 443 using HTTPS

Question 4

What is the purpose of 'Network Discovery' in FMC?

Accepted Answer

To identify hosts and user activity. Network Discovery identifies hosts, applications, and operating systems on the network.

Answer

To push firmware updates

Answer

To configure routing protocols

Answer

To perform active IPS scanning

Question 5

When configuring an NGIPS appliance in passive mode, how does the system handle traffic flow to ensure monitoring without impacting the production network?

Accepted Answer

It receives a copy of traffic via a SPAN or TAP port and performs out-of-band analysis.. Passive mode utilizes a TAP or SPAN port to ingest a copy of the traffic. It does not sit in the traffic path, meaning it cannot block traffic directly.

Answer

It uses an inline set with a bypass feature enabled.

Answer

It drops malicious packets by sending TCP resets to the source.

Answer

It requires an EtherChannel configuration to load balance traffic.

Question 6

An administrator is troubleshooting an eStreamer integration where custom Python client scripts fail to receive events from the FMC. The administrator verifies that network connectivity, certificates, and user permissions are correct. Upon running the client script in verbose mode, the error indicates an 'Incompatible Protocol Version' between the client SDK and the FMC. How is this resolved?

Accepted Answer

Update the eStreamer client SDK on the third-party SIEM to a version compatible with the current FMC software release.. Cisco FMC updates frequently include eStreamer protocol version upgrades. If an older third-party SIEM client SDK is used with a newly upgraded FMC, the client SDK must be updated to match or support the eStreamer protocol version running on the FMC.

Answer

Downgrade the FMC software to match the legacy eStreamer client library.

Answer

Switch from eStreamer to legacy SNMP traps.

Answer

Modify the eStreamer version registry key in the FMC expert shell configuration file.

Question 7

An engineer is troubleshooting a Cisco Secure Firewall Threat Defense clustering deployment where configuration synchronization between the control node and a data node has failed. Which THREE diagnostic steps or log sources should the engineer check? (Choose three)

Accepted Answer

Execute the 'show cluster info' and 'show cluster state' commands on the firewall CLI to verify node membership and sync status.. Troubleshooting cluster sync issues involves examining cluster health status via CLI commands (e.g., 'show cluster info'), reviewing FMC deployment history logs, and verifying Cluster Control Link connectivity.

Answer

Check the BGP routing table on the core switch for missing Autonomous System path attributes.

Answer

Review the VMware vCenter datastore utilization for disk space errors.

Question 8

An administrator is troubleshooting a scenario where configuration deployment from FMC to an FTD device fails with a 'Deployment Validation Error'. Where can the administrator view the detailed validation messages and deployment task history?

Accepted Answer

System > Monitoring > Task Manager. The Task Manager in FMC (System > Monitoring > Task Manager) provides detailed deployment task history, including validation errors and the specific reasons why a configuration deployment to an FTD failed. It shows each deployment attempt, its status, and any error messages generated during validation.

Answer

Objects > Object Management > History

Answer

Analysis > Intrusions > Events

Answer

Devices > Platform Settings > Deployment Log

Question 9

An enterprise is deploying a high-availability cluster of Cisco Secure Firewall Threat Defense devices to scale performance. Which requirement must be met regarding the physical switch infrastructure connecting the cluster nodes?

Accepted Answer

Connections between the switches and cluster nodes must use Port Channels (EtherChannels) to aggregate bandwidth and ensure proper traffic distribution.. Firewall clustering requires specific switch features such as EtherChannel (Port Channels) and often requires specific load-balancing algorithms to distribute traffic across cluster members evenly.

Answer

Switches must be configured with Spanning Tree Protocol (STP) disabled globally to prevent cluster split-brain.

Answer

The switches must run Cisco StackWise Virtual and be managed by the firewall cluster master node.

Answer

Routing protocols must be disabled on all switch interfaces connected to the cluster control link (CCL).

Question 10

An administrator needs to verify the license status and active feature subscriptions (such as URL Filtering, Malware, and IPS) on an FMC. Where should the administrator check this information in the FMC GUI?

Accepted Answer

System > Licenses > Smart Licenses. In FMC, license status and active feature subscriptions are found under System > Licenses > Smart Licenses. This page displays the Smart Licensing status, including which features (URL Filtering, Malware, IPS, etc.) are enabled and their compliance.

Answer

Policies > Access Control > Subscriptions

Answer

Objects > Object Management > Licensing

Answer

Devices > Device Management > Licenses

Question 11

An administrator is setting up Cisco SecureX threat intelligence integration with Cisco Secure Firewall Management Center. The test connection fails with a 'Token Expired or Invalid' error. What is the correct procedure to re-establish trust and authentication between the FMC and SecureX?

Accepted Answer

Generate a new client ID and API key from the Cisco SecureX (Security Cloud Control) console and update the integration credentials in FMC System > Integration > SecureX.. To resolve API token or cloud registration expirations for SecureX, the administrator must re-register the FMC with SecureX by generating a new API key / integration credential from the SecureX/Security Cloud Control portal and pasting it into the FMC System > Integration > SecureX settings.

Answer

Log into the FTD CLI and execute the 'clear securex-token' command.

Answer

Reinstall the Snort rule updates package on the FMC.

Answer

Reboot the FMC appliance to regenerate the internal device certificate.

Question 12

You are deploying a Cisco Secure Firewall Threat Defense cluster in a data center environment. Which deployment requirement must be strictly followed regarding the control link and data interfaces?

Accepted Answer

The control link must be a dedicated, low-latency interface completely separated from data traffic handling.. Clustered FTD units require a dedicated control plane network (control link) with low latency and high bandwidth, separate from data interfaces, to synchronize state and management data.

Answer

All cluster members must reside in different Layer 2 broadcast domains to prevent spanning-tree loops.

Answer

Cluster units can share data interfaces for control synchronization as long as Jumbo frames are enabled on the switch.

Answer

Clustering is supported only in transparent firewall mode; routed mode disables clustering capabilities.

Question 13

When utilizing static route tracking, what value represents the frequency of the tracking probe?

Accepted Answer

Frequency interval.. The SLA Monitor configuration allows you to define the frequency (in seconds) at which the probe is sent to the target.

Answer

Threshold value.

Answer

Timeout interval.

Answer

TTL value.

Question 14

You are deploying a Cisco Firepower Threat Defense (FTD) device in transparent mode. Which requirement must be met to allow traffic flow through the firewall?

Accepted Answer

Configure a Bridge Group Virtual Interface (BVI) with an IP address for management.. In transparent mode, FTD acts as a Layer 2 device. It uses bridge groups, and traffic is bridged between interfaces. Since it is L2, the interfaces do not require IP addresses for routing, but the bridge group interface (BVI) needs an IP address for management purposes.

Answer

Define a default gateway on the upstream router pointing to the FTD MAC address.

Answer

Assign a unique IP address to each physical interface in the bridge group.

Answer

Enable dynamic routing protocols on all physical interfaces.

Question 15

When configuring an FQDN object, which THREE options are valid for the FQDN field?

Accepted Answer

Subdomain. In an FQDN object, the FQDN field accepts a single domain name (E), such as example.com, which resolves to one or more IP addresses and is the standard hostname form. It also accepts a subdomain (B), such as www.example.com or mail.example.com, since a subdomain is still a fully qualified domain name with a complete host and domain hierarchy. A wildcard domain (C), such as *.example.com, is likewise valid because it lets the object match any hostname within that domain. An IP address (A) is not valid in the FQDN field because IP addresses belong in address or IP-netmask objects, not in a name-based FQDN object. A protocol name (D) is also invalid, since protocols such as TCP, UDP, or ICMP are specified in service objects, not in an FQDN field.

Answer

IP address

Answer

Protocol name