300-710 SNCF Practice Test 4 — 25 Questions

Question 1

An administrator wants to configure automated email notifications from the FMC whenever a critical health monitor alert occurs on any managed device. Where should this be configured in the FMC GUI?

Accepted Answer

System > Health > Monitor > Alert Responses. FMC health alert email notifications are configured under System > Health > Monitor > Alert Responses. There you define alert response objects that specify the email recipients and the health events (critical/warning) that trigger them, then apply them to health policies. This is the only location in the FMC GUI that natively sends email on health monitor alerts.

Answer

Objects > Object Management > Alerting

Answer

Policies > Access Control > Logging

Answer

Devices > Device Management > Alerts

Question 2

An administrator needs to configure Quality of Service (QoS) on a Cisco Firepower Threat Defense device via FMC to limit peer-to-peer traffic bandwidth. Where must the QoS policy be applied for it to take effect on traffic traversing the firewall?

Accepted Answer

Assigned to Security Zones in the Access Control Policy QoS tab. In FMC, a QoS policy is applied to the Access Control Policy by assigning it to security zones on the QoS tab. The QoS policy defines rate limiting and prioritization, and it takes effect only when associated with zones that carry the traffic traversing the FTD. This is the correct location for applying QoS to limit peer-to-peer bandwidth.

Answer

Assigned to Access Control Policy rules directly

Answer

Assigned inside Prefilter Policies

Answer

Assigned globally in Platform Settings

Question 3

In the FMC, what is the purpose of the 'Network Discovery Policy'?

Accepted Answer

To define discovery scope. It is used to control which networks are monitored for host/user discovery to avoid performance impact.

Answer

To enable routing

Answer

To block unauthorized users

Answer

To monitor bandwidth

Question 4

When using a Redundant Interface, what is the primary behavior during a link failure?

Accepted Answer

The standby link becomes active.. In a redundant interface pair, one link is active and the other is standby. If the active link fails, the FTD automatically switches to the standby link.

Answer

Both links remain active and load balance.

Answer

The FTD triggers a device-level failover.

Answer

Traffic is dropped until manual reset.

Question 5

Which TWO protocols are commonly managed via Port objects in FMC?

Accepted Answer

UDP. TCP and UDP are the primary protocols managed via port objects.

Answer

ARP

Answer

IGMP

Answer

ICMP

Question 6

An administrator wants to stream security events, connection events, and intrusion events from Cisco Secure Firewall Management Center (FMC) to a third-party SIEM platform. Which built-in protocol and feature on the FMC should be configured to export these events in real-time?

Accepted Answer

eStreamer. eStreamer is the FMC's built-in event streaming service that pushes intrusion, connection, security, and malware events to external clients (such as third-party SIEMs) in real time over a proprietary TCP-based protocol on port 8302. It is purpose-built for high-volume event export from the FMC and is the documented integration path for SIEM platforms like Splunk, QRadar, and ArcSight.

Answer

pxGrid

Answer

NETCONF

Answer

RADIUS Accounting

Question 7

An enterprise integrates Cisco Secure Firewall Management Center with Cisco ISE using pxGrid for identity-based access control. The security team notices that user identity mapping works for domain users authenticating via 802.1X, but guest users connecting through a WebAuth portal do not have their user-to-IP mappings populated on the FTD. What is the root cause of this issue?

Accepted Answer

The pxGrid connection on ISE is not subscribed to the guest session topic, or guest session publishing is disabled in ISE deployment settings.. Guest users authenticated via WebAuth on ISE may not have active pxGrid session directory notifications if the guest profile or ISE profiler service is not configured to publish guest sessions, or if the pxGrid node is not subscribed to guest session topics (such as 'Session Directory' guest events).

Answer

FMC requires an active eStreamer connection to ingest guest identities because pxGrid only supports Active Directory domain accounts.

Answer

Guest users must manually log into a captive portal hosted on the FTD data plane before ISE can share their identity.

Answer

The FTD identity policy must be configured with a RADIUS server group instead of pxGrid to support guest VLANs.

Question 8

An engineer needs to analyze the connection history and security events from an FTD device that occurred three weeks ago. However, when querying the FMC event viewer, the events are missing. What is the most likely cause of this behavior?

Accepted Answer

The events were overwritten because the event database retention period or disk space limit was reached.. FMC event databases have configurable retention policies and disk space thresholds. If event retention settings are low or disk space fills up, older events are automatically purged to prevent disk exhaustion.

Answer

The administrator must run 'database-cli optimize' on the FTD CLI to unhide historical events.

Answer

The FTD automatically flushes its local event buffer every 48 hours regardless of FMC configuration.

Answer

Security events older than 7 days are automatically archived to the Cisco Cloud Analytics platform by default.

Question 9

An administrator is configuring a static route tracking mechanism on a Cisco Secure Firewall Threat Defense device using an ICMP Echo IP SLA object. What happens to the tracked static route if the SLA probe fails to receive a response?

Accepted Answer

The static route is removed from the routing table, allowing alternative routes to become active.. When an IP SLA probe fails, the tracked object changes its state to DOWN, causing the dependent static route to be removed from the routing table, allowing backup routes to take over.

Answer

The static route metric is automatically incremented by 100 while remaining active.

Answer

The firewall automatically reboots into maintenance mode to clear the routing cache.

Answer

All firewall interfaces are automatically placed in an administrative shutdown state.

Question 10

An administrator configures a Cisco Secure Firewall Threat Defense cluster. During normal operations, a data node experiences a critical hardware failure. What happens to the active connections currently processed by that specific failed data node?

Accepted Answer

Active connections are migrated or maintained by surviving cluster nodes because connection state is distributed across the cluster.. In a Cisco Secure Firewall Threat Defense cluster, connection state is synchronised across data nodes so that if one data node fails, surviving nodes can maintain or take over the active connections. This state sharing is what allows the cluster to provide high availability without forcing clients to re-establish sessions. The control node handles cluster management, but data plane continuity is preserved by the distributed state.

Answer

Traffic destined for the failed node is permanently blackholed until the physical module is replaced.

Answer

All active connections are immediately dropped, forcing clients to re-establish TCP handshakes from scratch.

Answer

The entire cluster reboots to elect a new control node and rebuild the data plane.

Question 11

An administrator is setting up Cisco ISE pxGrid integration with Cisco Secure Firewall Management Center. Which TWO configuration steps must be performed on the Cisco ISE side to ensure successful integration? (Choose two)

Accepted Answer

Approve the FMC client registration request in the Cisco ISE pxGrid client management settings.. Option D is correct because pxGrid uses mutual certificate-based authentication, and when FMC first connects as a pxGrid client, its registration request must be approved by an ISE administrator under Administration > pxGrid Services > Client Management before the client can subscribe to or publish on the pxGrid bus. Option E is correct because the pxGrid persona is not enabled by default; the administrator must enable the pxGrid service on the appropriate ISE node (typically the PAN/MnT or a dedicated pxGrid node) under Administration > System > Deployment so the node can host the pxGrid controller and accept client connections. Option A is wrong because eStreamer is a Firepower/FSMC-side event-streaming service, not an ISE policy service node component. Option B is wrong because SNMPv2c traps are for monitoring/alerting and play no role in pxGrid integration. Option C is wrong because TACACS+ shared secrets are for device administration authentication, not for pxGrid, which relies on certificates rather than a shared secret.

Answer

Configure an eStreamer server instance on the ISE policy service node.

Answer

Enable SNMPv2c traps on the ISE administration node.

Answer

Export the ISE TACACS+ shared secret to the FTD CLI.

Question 12

An administrator configures DNS injection and rewriting in a manual NAT rule on an FTD device. What is the primary purpose of enabling DNS translation in a NAT rule?

Accepted Answer

To rewrite DNS A-records returning internal server IPs so external clients receive the correct public NAT IP. DNS translation (DNS injection and rewriting) in a manual NAT rule rewrites DNS A-records in DNS responses so that when an internal server's DNS reply contains a private IP, external clients receive the corresponding public NAT IP instead. This ensures clients connect to the correct translated address.

Answer

To cache DNS responses locally on the FTD control plane

Answer

To encrypt DNS queries over TLS (DoT)

Answer

To block malicious DNS tunneling attempts via Snort inspection

Question 13

Which type of object is best suited for defining a web server's public-to-private NAT mapping?

Accepted Answer

Network object (Host). A Network object (Host) is the correct choice because it represents a single IP address with a /32 mask, which is exactly what a one-to-one NAT mapping for a web server requires. Host objects are used in both Auto NAT and Manual NAT rules to define the specific address being translated.

Answer

VLAN object

Answer

Port object

Answer

Network object (Group)

Question 14

An administrator configures a security intelligence feed in the FMC to block known malicious IP addresses. Where are Security Intelligence feeds and lists applied in the FMC configuration?

Accepted Answer

Under the Security Intelligence tab of the Access Control Policy. Security Intelligence feeds and lists in FMC are configured under the Security Intelligence tab of the Access Control Policy. This tab lets you apply source/destination block lists and feeds globally to the policy, with options for block, monitor, or allow actions. It is not a per-rule setting or a standalone object.

Answer

Directly inside the Prefilter policy configuration

Answer

Within individual Access Control rules under the Source/Destination tabs

Answer

Under Objects > Security Intelligence > Rule Mapping

Question 15

An FTD high availability pair experiences a failover due to a hardware failure on the active unit. After the standby unit takes over, the administrator notices that existing TCP connections were dropped and did not state-fully fail over. What configuration setting should the administrator verify?

Accepted Answer

Verify that stateful failover is enabled and the failover link interface is operational and passing state packets.. Stateful failover in an FTD HA pair requires that the failover link be up and actively passing state synchronization packets between the active and standby units. If the failover link is down or stateful failover is not enabled, the standby unit takes over the interfaces but has no session table, so existing TCP connections are dropped and must be re-established.

Answer

Ensure that dynamic routing protocols are configured with graceful restart.

Answer

Verify that clustering is enabled instead of high availability.

Answer

Check that adaptive inspection is disabled in the Access Control Policy.

Question 16

What is the result of applying an 'IPS Policy' to an Access Control Rule?

Accepted Answer

It enables deep packet inspection. The IPS policy enables deep packet inspection for the traffic matched by the rule.

Answer

It bypasses decryption

Answer

It blocks traffic based on IP

Answer

It disables the rule

Question 17

Which tab in the Access Control Policy rule editor allows you to specify the source and destination zones?

Accepted Answer

Zones. The 'Zones' tab is where you define ingress and egress zones for the rule.

Answer

Ports

Answer

Networks

Answer

Applications

Question 18

Which TWO items must be defined to create a fully functional Network Object group in FMC?

Accepted Answer

Member Objects. A group needs a name and at least one member (object) assigned to it.

Answer

Object Description

Answer

SNMP Traps

Answer

Routing Table

Question 19

When configuring a NAT rule, which THREE options are valid 'Type' selections within the NAT Rule editor?

Accepted Answer

Static. Static, Dynamic, and Identity are valid NAT types in FTD/FMC.

Answer

Virtual

Answer

Transparent

Question 20

Which THREE actions can be performed by an SSL Decryption Policy?

Accepted Answer

Do Not Decrypt. SSL policy actions include Decrypt, Do Not Decrypt, and Monitor.

Answer

Redirect

Answer

Block