300-710 SNCF Practice Test 5 — 25 Questions

Question 1

An enterprise integrates Cisco Secure Firewall with Cisco SecureX. The security team wants to leverage SecureX Threat Intelligence to automatically quarantine endpoints that exhibit malicious behavior. How does the integration coordinate this mitigation action across SecureX, FMC, and ISE?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SecureX instructs Cisco ISE via API/pxGrid to apply an Adaptive Network Control (ANC) quarantine policy to the endpoint, while FMC blocks associated traffic flows.. SecureX orchestrates threat response by triggering an API call to ISE (via pxGrid/ANC) to dynamically apply an Adaptive Network Control (ANC) quarantine policy or to FMC to block the IP, isolating the compromised endpoint.

Answer

SecureX directly accesses the FTD data plane via SSH to shut down the physical switchport.

Answer

The FTD continuously polls SecureX and reconfigures its VLAN database using VTP.

Answer

ISE sends a DHCP release packet to the endpoint through the FTD inspection engine.

Question 2

You need to implement static route tracking on an FTD to ensure traffic fails over to a secondary ISP. Which object is used to define the reachability check?

Accepted Answer

SLA Monitor object. SLA Monitor objects are used to track reachability to a target IP, and the static route is then associated with this monitor.

Answer

Route map

Answer

Failover group

Answer

Interface tracking group

Question 3

Which protocol is used by the FTD to communicate with the FMC for management traffic?

Accepted Answer

HTTPS/TLS (sftunnel).. The FTD communicates with the FMC using a secure, proprietary channel over HTTPS/TLS.

Answer

SSH

Answer

SNMPv3

Answer

ICMP

Question 4

An administrator is troubleshooting an eStreamer integration where the client script disconnects immediately after authentication. Upon inspecting the logs, the administrator notes an SSL certificate verification error. Which TWO areas should be checked to resolve this certificate error? (Choose two)

Accepted Answer

Verify that the FMC CA root certificate has been correctly imported into the client application's trust store.. The SSL certificate verification error during eStreamer authentication points to a trust or identity problem in the TLS handshake between the client and the FMC. Option B is correct because the eStreamer client must trust the FMC's server certificate; if the FMC CA root certificate is not imported into the client application's trust store, the client cannot validate the server's certificate chain and will abort the connection. Option C is correct because eStreamer mutual TLS requires the client to present the certificate and private key bundle generated from the FMC; if that bundle was not copied correctly or the script references the wrong path, the certificate exchange fails and the client disconnects immediately after authentication. Option A is incorrect because pxGrid client approval is an ISE concept unrelated to eStreamer, which authenticates directly against the FMC. Option D is incorrect because syslog server IP configuration in FTD Platform Settings has no bearing on eStreamer TLS certificate validation. Option E is incorrect because restarting the Snort engine on the FTD does not address certificate trust or client credential issues on the eStreamer client.

Answer

Verify the pxGrid client approval status on the Cisco ISE dashboard.

Answer

Check the FTD Platform Settings syslog server IP configuration.

Answer

Restart the Snort engine on the FTD device.

Question 5

An engineer is troubleshooting Cisco SecureX threat intelligence integration with Cisco Secure Firewall Management Center. The firewall is failing to receive updated indicators of compromise. Which TWO troubleshooting steps should the engineer perform? (Choose two)

Accepted Answer

Verify that outbound HTTPS (port 443) connectivity from the FMC management interface to the SecureX cloud is unobstructed.. Option A is correct because SecureX threat intelligence is delivered to FMC over the cloud, so the FMC management interface must have outbound HTTPS (TCP 443) access to the SecureX cloud; blocked or filtered 443 traffic prevents IoC updates from being received. Option C is correct because the FMC-to-SecureX integration relies on API credentials/tokens that can expire or be revoked, so re-authenticating or regenerating the SecureX API integration credentials restores the subscription and allows updated indicators to flow. Option B is not relevant because FTD registration with FMC is a device-management function and does not affect the SecureX cloud intelligence feed. Option D is not applicable because 'show threat-response debug' is not a valid FTD command for diagnosing SecureX IoC delivery. Option E is incorrect because pxGrid is an ISE/identity service, not an FTD CLI service used for SecureX threat intelligence retrieval.

Answer

Re-register the FTD with the FMC using a new registration key.

Answer

Run 'show threat-response debug' on the FTD CLI.

Answer

Restart the pxGrid service on the FTD command line.

Question 6

An administrator is configuring a Prefilter policy to handle GRE-encapsulated traffic. Which Prefilter rule option allows handling or accelerating tunneled traffic?

Accepted Answer

Tunnel rule type. In an FTD Prefilter policy, the Tunnel rule type is specifically designed to match and handle tunneled (encapsulated) traffic such as GRE, IP-in-IP, and Teredo before the outer header is stripped. A Tunnel rule lets the administrator either block the tunnel outright or 'fast-path' it so the encapsulated payload is not inspected, which is essential for performance and for handling protocols the Snort engine cannot natively parse. This is the only Prefilter rule type that explicitly addresses tunneled traffic handling.

Answer

Access Control rule with GRE protocol filter

Answer

SSL Decryption Policy Tunnel Decrypt

Answer

NAT rule with Protocol Rewriting

Question 7

An administrator is configuring a new Access Control Policy on the Firepower Management Center and needs to add a rule that blocks peer-to-peer file sharing applications regardless of port. Which rule type should the administrator select?

Accepted Answer

Access control rule. The Access Control Policy on Firepower Management Center (FMC) uses access control rules to inspect and control traffic based on applications, users, ports, and other criteria. To block peer-to-peer file sharing applications regardless of port, the administrator must create an access control rule that matches the application (e.g., BitTorrent) and sets the action to Block. Access control rules leverage Snort-based deep packet inspection to identify applications even when they use non-standard ports or encryption, making them the correct choice for application-based filtering.

Answer

NAT rule

Answer

Identity rule

Answer

Prefilter rule

Question 8

You are configuring an active/standby High Availability pair for Cisco Secure Firewall Threat Defense using FMC. You need to configure port channels for the data interfaces to increase bandwidth and redundancy. Which guideline must be followed regarding port channels in an HA deployment?

Accepted Answer

The port channel interfaces on both the primary and secondary units must have identical interface IDs and member port compositions.. In a Cisco Secure Firewall Threat Defense HA deployment, port channels must be configured identically on both the primary and secondary units — same interface IDs and same member port composition — so that failover preserves the link aggregation and the standby unit can take over seamlessly. This is a documented guideline for EtherChannel in HA.

Answer

LACP active mode is unsupported on HA secondary units; static port channels must be used instead.

Answer

Port channels are restricted to transparent mode HA configurations only.

Answer

Port channels can only be configured on the active unit; the standby unit automatically inherits them via stateful sync.

Question 9

You are defining an Access Control Policy rule to allow traffic. If you want to log the connection at the end of the flow only if it matches the rule, which Logging setting is appropriate?

Accepted Answer

Log at End. In Cisco Secure Firewall (Firepower) Access Control Policy, the 'Log at End' setting logs the connection only when the connection is terminated, and only if the connection matched the rule. This is useful for logging allowed traffic without generating a log at the beginning of the connection, which reduces log volume and provides end-of-flow details such as bytes transferred and duration.

Answer

Log at Beginning

Answer

Disable Logging

Answer

Log Both

Question 10

When configuring FMC backup schedules, which TWO storage options are natively supported for the backup files?

Accepted Answer

Remote SCP server. FMC's backup scheduling feature natively supports exporting backups to a remote host via SCP, allowing administrators to store configuration backups off-box using the SCP protocol. Option D (Local management appliance storage) is also correct because FMC natively supports storing scheduled backups on the local disk of the management appliance itself. Options B (Local USB drive), C (Cloud S3 storage bucket), and E (Centralized Syslog server) are not natively supported backup destinations for FMC scheduled backups; USB and S3 are not built-in options in the FMC backup schedule configuration, and a Syslog server is used for event/log forwarding, not for storing backup files.

Answer

Local USB drive

Answer

Cloud S3 storage bucket

Answer

Centralized Syslog server

Question 11

When troubleshooting an issue where an FTD interface is in a 'down' state, which command helps verify if there is a physical layer issue or an administrative shutdown?

Accepted Answer

show interface. The 'show interface' command on FTD displays detailed per-interface status including line protocol state, administrative state, speed, duplex, and error counters, which lets the administrator distinguish a physical layer problem (line down, no link) from an administrative shutdown (interface administratively down). This is the standard CLI check for interface state on FTD.

Answer

show link status

Answer

show hardware interface

Answer

show run interface

Answer

show status

Question 12

An administrator is troubleshooting an SSL Decryption policy where encrypted connections are failing. The FMC logs indicate that clients are rejecting the FTD's re-signed certificate because it is not trusted. What configuration step is missing?

Accepted Answer

Deploy the FTD's Re-signing CA certificate to the trusted root certification authorities store of all internal client endpoints.. When FTD performs SSL decryption via re-signing, it acts as a man-in-the-middle: it intercepts the client's TLS session and presents a certificate signed by its own Re-signing CA. For clients to accept this certificate without errors, the FTD's Re-signing CA certificate must be installed in the trusted root CA store of every internal endpoint. Without that trust anchor, clients reject the re-signed certificate and the connection fails.

Answer

Configure a Prefilter policy to bypass SSL handshakes for those clients.

Answer

Import the server's private key into the FTD certificate store.

Answer

Enable SSL Known Key decryption for external websites.

Question 13

An enterprise network design incorporates Equal-Cost Multi-Path (ECMP) routing across two Cisco Secure Firewall Threat Defense units functioning independently in routed mode. What is the primary benefit of enabling ECMP on the firewalls?

Accepted Answer

It enables the firewall to balance outbound traffic across multiple next-hop gateways using multiple equal-cost routes.. ECMP allows the firewall to install multiple equal-cost paths to the same destination in its routing table, distributing traffic across multiple next-hop routers for load balancing and redundancy.

Answer

It allows passive NGIPS interfaces to share inspection load without SPAN replication.

Answer

It pools the CPU and memory resources of both firewalls into a single logical cluster.

Answer

It synchronizes connection state tables across both independent firewalls for zero-loss failover.

Question 14

Which type of events can be exported from Cisco Secure Firewall Management Center to a SIEM using the eStreamer protocol?

Accepted Answer

Connection, intrusion, and malware/file events. eStreamer supports exporting connection events, intrusion events, malware events, and host/identity data from the FMC database.

Answer

FMC administrator login CLI keystrokes only

Answer

Raw packet captures (PCAP) of every inspected flow

Answer

Routing table updates from OSPF and BGP protocols

Question 15

An administrator is configuring a Prefilter Policy in FMC to optimize performance on a Cisco Firepower Threat Defense device. The requirement is to completely bypass inspection for a trusted high-speed data backup tunnel between two datacenters using GRE encapsulation. Which prefilter rule action should be selected?

Accepted Answer

Fast Path. The Fast Path action in a Prefilter Policy is specifically designed to bypass all further inspection (including Snort and other deep packet inspection engines) for traffic that matches the rule. This is ideal for trusted high-speed traffic like a GRE-encapsulated backup tunnel, where inspection would add latency and reduce throughput without security benefit. Fast Path effectively offloads the flow to the hardware or fast path, preserving performance. Thus, D is correct.

Answer

Monitor

Answer

Block

Answer

Analyze

Question 16

An administrator is configuring third-party SIEM integration using eStreamer on the FMC. A custom client application is written to connect to the FMC eStreamer server, but the connection is immediately reset. What is the most likely cause of this issue?

Accepted Answer

The eStreamer client certificate and pkcs12 password have not been generated and configured on the FMC.. Before an eStreamer client can connect to FMC, an eStreamer certificate and password must be generated on the FMC and imported into the client application.

Answer

The SIEM is using TCP port 443 instead of eStreamer default port 8305.

Answer

Syslog facility levels are set to local0 instead of daemon.

Answer

pxGrid service is disabled on the FMC.

Question 17

You have a large number of NAT rules. How does the FTD process them?

Accepted Answer

Top-down. NAT rules are processed in a top-down order until the first match is found.

Answer

Bottom-up

Answer

Specific to General

Answer

Alphabetical

Question 18

An administrator is setting up health monitoring alerts on the FMC. Which TWO notification methods can be configured when a health alert is triggered? (Choose two)

Accepted Answer

Email notification. On the Cisco Firepower Management Center (FMC), health monitoring alerts can be delivered through the built-in notification mechanisms, and the two supported methods are Email notification (B) and SNMP Trap (C). Email notification (B) is correct because FMC's health monitor configuration allows you to specify recipient email addresses and an SMTP server so that alert messages are sent when a health event occurs. SNMP Trap (C) is correct because FMC can be configured with SNMP trap receivers, allowing health alerts to be forwarded as SNMP traps to a monitoring station. The remaining options are not valid FMC health alert delivery methods: FMC has no built-in cellular SIM for SMS (A), no Bluetooth broadcast capability for alerts (D), and no SIP trunking integration to place automated phone calls (E).

Answer

Automated SMS text message directly via built-in cellular SIM

Answer

Direct Bluetooth broadcast

Answer

Automated phone call via SIP trunking

Question 19

An engineer is troubleshooting a passive NGIPS deployment where the Cisco Secure Firewall is connected to a switch SPAN port. Security analysts report that certain VLAN-tagged packets are not appearing in the event logs. What is the most likely cause?

Accepted Answer

The passive interface or subinterfaces on the firewall are not configured to recognize or decode the specific 802.1Q VLAN tags present in the SPAN stream.. In a passive NGIPS deployment fed by a switch SPAN port, the firewall's passive interface must be able to parse the frames it receives. If the SPAN source is a trunk carrying 802.1Q-tagged frames, the passive interface (or its subinterfaces) must be configured to recognize those VLAN tags; otherwise the Snort engine cannot correctly decode the packets and they never generate events. This is a classic SPAN/trunk mismatch issue in Firepower troubleshooting.

Answer

The firewall management IP address is misconfigured, causing packet loss on the monitoring port.

Answer

The Snort inspection engine drops all SPAN traffic by default unless inline bypass mode is active.

Answer

Passive interfaces do not support VLAN tagging; all trunk traffic must be untagged at the switch SPAN source.

Question 20

An engineer is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) instance in an Amazon Web Services (AWS) VPC. The deployment requires the FTDv to inspect traffic crossing between public and private subnets. Which AWS architectural construct is mandatory for routing traffic through the FTDv instance?

Accepted Answer

Custom AWS Route Tables associated with the subnets, pointing traffic destined outside the VPC to the FTDv data interface ENI.. In AWS, traffic is routed between subnets and to the internet based on Route Tables associated with each subnet. To force traffic through an FTDv instance, you must create custom Route Tables whose default route (0.0.0.0/0) or specific destination prefixes point to the FTDv's data interface ENI, and associate those route tables with the public and private subnets. This is the standard AWS 'firewall appliance' architecture and is mandatory for inline inspection.

Answer

Cisco TrustSec Security Group Tags (SGTs) applied to AWS security groups.

Answer

AWS Transit Gateway with static BGP peering enabled to the FTDv management interface.

Answer

Physical bypass NICs installed in the AWS hypervisor layer.