300-710 SNCF Practice Test 26 — 15 Questions

Question 1

A network administrator is configuring an Access Control Policy on the FMC and needs to ensure that traffic from a specific subnet is inspected by the Snort engine for intrusion prevention. The administrator wants to achieve this with minimal performance impact on other traffic. Which action should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Access Control rule with the source subnet, set the action to Allow, and enable Intrusion Prevention under the Inspection tab.. To inspect only specific traffic with IPS, an Access Control rule with the source subnet and action Allow, with Intrusion Prevention enabled under Inspection, is correct. This limits deep inspection to that subnet, reducing performance impact on other traffic. Other actions either bypass inspection or apply it too broadly.

Answer

Create an Access Control rule with the source subnet and set the action to Allow, then enable File Policy and Intrusion Prevention.

Answer

Modify the default action of the Access Control Policy to Block with Intrusion Prevention enabled.

Answer

Create an Access Control rule with the source subnet and set the action to Trust.

Question 2

An administrator is configuring a Cisco FTD device managed by FMC in a high-availability pair. The administrator must ensure that failover occurs correctly. Which TWO interface configurations are required to support stateful failover? (Choose two.)

Accepted Answer

A dedicated failover link interface. To support stateful failover in an FTD high-availability pair, a dedicated failover link and a dedicated state link are required. The failover link exchanges status and heartbeat messages, while the state link synchronizes connection state tables. These ensure seamless failover and continuity of established connections. Other interfaces like management and data do not serve these purposes.

Answer

A management interface configured with a standby IP address

Answer

A data interface configured for stateful failover

Answer

An EtherChannel interface bundling failover and state links

Question 3

A security team is deploying a Cisco Secure Firewall Threat Defense device in a data center where the requirement is to inspect traffic flowing between two Layer 3 segments without changing the IP addressing or routing of those segments. The firewall must sit logically between the two segments and forward traffic based on MAC addresses. Which deployment mode should be used?

Accepted Answer

Transparent mode with a bridge group. Transparent mode with a bridge group allows the FTD to inspect and forward traffic as a Layer 2 bridge, keeping the existing IP addressing and routing intact. This is the intended deployment when the firewall must be inserted between segments without becoming a Layer 3 hop.

Answer

Clustering with individual interface IP addresses

Answer

Inline tap mode with a passive interface

Answer

Routed mode with static routes

Question 4

An engineer is deploying a Cisco Secure Firewall Threat Defense device in a high-availability pair using Active/Standby failover. The team wants to verify which configuration items must match on both units for failover to operate correctly. (Choose two.)

Accepted Answer

The failover link must be configured with matching interface settings and must be a dedicated interface or EtherChannel on both units.. For Active/Standby failover to operate correctly, the failover link must be consistently configured on both units and the software versions and models must match. These ensure heartbeat exchange, state replication, and configuration synchronization work, while management addressing and hostnames remain unique per unit and policies are synchronized automatically.

Answer

The hostname of both units must be identical to allow the management center to treat them as a single managed device.

Answer

The management IP addresses of both units must be identical so the management center can reach the active unit after failover.

Answer

The NAT policy on both units must be manually duplicated because NAT rules are not synchronized during failover.

Question 5

A network administrator is preparing to register a new Cisco Secure Firewall Threat Defense device with a Cisco Secure Firewall Management Center. The device is currently running a supported software version and has network connectivity to the management center. Which action must the administrator take on the FTD device to begin the registration process?

Accepted Answer

Run the configure manager add command and provide the management center hostname and registration key. Registration begins on the FTD CLI with configure manager add, which specifies the management center address and a unique registration key. Once that command is entered, the management center can discover the device and complete the addition using the same key, after which policies can be deployed.

Answer

Import a self-signed certificate from the management center onto the FTD device

Answer

Enable the REST API on the FTD device and create an administrative user for the management center

Answer

Configure a NAT exemption rule on the management center before registration

Question 6

An administrator manages several FTD devices from a single FMC. After a policy deployment, a remote-site FTD shows 'Deployment Failed' in the FMC task list, and the administrator needs to identify which specific configuration object caused the failure without opening a TAC case. Which FMC workflow should the administrator use to review the detailed deployment failure reason for that device?

Accepted Answer

Open the FMC Task Status page, select the failed deployment task, and download the troubleshooting file (.tar.gz) generated for that deployment attempt.. Deployment failures on managed FTD devices are diagnosed through the FMC Task Status page, where each deployment task exposes a downloadable troubleshooting file containing the pushed configuration and the device's error output. This is the supported method for identifying the exact object that caused the failure without CLI access on the FTD.

Answer

Open the FTD device's Health Monitor page and review the CPU and disk usage graphs captured during the deployment window.

Answer

Run the 'show managers' command on the FTD CLI and read the deployment error code returned in the registration status output.

Answer

Navigate to Policies > Access Control and click the Deploy icon on the individual access control policy to regenerate the failure report.

Question 7

An engineer is comparing configuration states between FMC and a managed FTD after several changes were made directly on the FTD CLI by a local technician. The engineer wants to confirm whether the device configuration currently running differs from what FMC last deployed, without pushing any new policy. Which FMC feature provides this comparison?

Accepted Answer

The 'Compare' option on the Device Management page, which shows the running configuration versus the last-deployed configuration for the managed device.. FMC provides a Compare feature on the Device Management page that pulls the device's running configuration and diffs it against the last configuration FMC deployed. This lets administrators detect out-of-band CLI changes without deploying new policy, which is essential for identifying configuration drift.

Answer

The FTD CLI command 'show configuration diff' executed from the diagnostic CLI, which outputs the delta against the FMC-deployed policy.

Answer

The 'show running-config' output captured automatically in the FMC audit log after each CLI session on the device.

Answer

The Health Monitor's 'Analysis' tab, which correlates configuration drift with performance anomalies on the device.

Question 8

An administrator needs to verify that a newly registered FTD device is healthy and reachable from FMC before assigning it to a high-availability pair. Which FMC indicator confirms that the FMC-to-FTD management connection and device heartbeat are functioning normally?

Accepted Answer

The device appears in Device Management with a green check and 'Managed' status, and Health Monitor shows current CPU, memory, and interface metrics for the device.. A managed FTD is confirmed healthy when Device Management shows it as 'Managed' with a green check and Health Monitor displays live performance metrics. These signals prove the management channel and heartbeat are working, which is a prerequisite for HA pairing.

Answer

The device is listed under System > Updates with a firmware version matching the FMC, confirming the management channel is active.

Answer

The device shows a 'Pending' status with a yellow warning icon, indicating the registration is queued and awaiting approval.

Answer

The device appears with a red X and 'Unreachable' status, which FMC uses to indicate the heartbeat is being retried in the background.

Question 9

An engineer is deploying a Cisco Secure Firewall Threat Defense device in a routed environment where the inside network uses private RFC 1918 addressing and the outside interface receives a dynamic address from the ISP. The requirement is to allow inside hosts to reach the internet without exposing their private addresses, while preserving the ability to add static translations later. Which deployment configuration should be used?

Accepted Answer

Configure dynamic PAT using the outside interface address and apply it to the inside subnets, leaving room for manual NAT rules for static translations.. Dynamic PAT using the outside interface address lets all inside hosts share the single dynamic ISP address, satisfying the requirement to hide RFC 1918 addressing. Because manual NAT rules can be added alongside, the deployment remains flexible for future static translations without reworking the outbound translation design.

Answer

Configure dynamic NAT with a NAT pool on the outside interface and apply it to all inside subnets.

Answer

Configure identity NAT for the inside subnets so their private addresses are preserved across the outside interface.

Answer

Configure static NAT for each inside host to the outside interface address, mapping each host individually.

Question 10

A security team is deploying a Cisco Secure Firewall Threat Defense device in a routed mode at the perimeter. They need to ensure that the device can be managed out-of-band on a dedicated network, separate from the data traffic, and that management traffic does not traverse the data interfaces. Which deployment approach should they use?

Accepted Answer

Configure a separate management interface with its own IP address and default gateway. Out-of-band management requires a physically separate management interface with its own addressing and gateway. This keeps management traffic independent of the data interfaces, so administrative access remains available even during data-plane failures or heavy load, and management traffic is not routed through the data path.

Answer

Assign a management IP address to one of the data interfaces and use policy-based routing

Answer

Use a subinterface on the data port with a dedicated VLAN for management and a separate default gateway

Answer

Enable the management interface and configure a static route on the data interface for management return traffic

Question 11

An administrator is troubleshooting an FTD device that is not registering with the FMC. The administrator suspects a certificate or network issue. Which FTD CLI command should be used to verify the registration status and connectivity to the FMC?

Accepted Answer

show managers. The 'show managers' command is the correct tool to verify FTD registration with the FMC. It provides details such as the manager type, IP address, registration status, and last heartbeat. When an FTD fails to register, this command will indicate the current state, helping the administrator determine if the issue is network-related, certificate-related, or configuration-related. The other options are non-existent commands.

Answer

show cisco-fmc

Answer

show registration status

Answer

show fmc-connection

Question 12

A security team uses Cisco Secure Firewall Management Center (FMC) to manage several Cisco Secure Firewall Threat Defense (FTD) devices. They need to integrate with Cisco Identity Services Engine (ISE) to enforce identity-based access policies. The ISE deployment uses a standalone node with pxGrid enabled. After configuring the pxGrid client on FMC, the administrator notices that user identity data is not being populated in FMC. Which action should be taken to allow FMC to receive identity information from ISE?

Accepted Answer

Enable the pxGrid service on ISE and subscribe FMC to the session directory topic.. The integration between FMC and ISE relies on pxGrid to share user identity and session data. Enabling pxGrid on ISE and subscribing FMC to the session directory topic allows FMC to receive real-time updates about user sessions, which can then be used in access control policies. Other methods like syslog, RADIUS, or SXP do not provide the necessary identity context.

Answer

Configure a TrustSec SXP connection between FMC and ISE.

Answer

Add FMC as a RADIUS client on ISE and configure RADIUS accounting.

Answer

Configure a syslog source on ISE to send identity events to FMC.

Question 13

A security operations team deploys Cisco Secure Firewall Management Center and wants to share indicators of compromise with Cisco SecureX. The team also wants to see which internal endpoints have communicated with those indicators. Which integrated capability should be enabled to provide this context?

Accepted Answer

Enable the Cisco SecureX integration in FMC by registering the management center with the SecureX cloud and enabling eventing.. The SecureX integration in FMC is enabled by registering the management center with the SecureX cloud and turning on eventing, which allows FMC security events to flow into SecureX. There, indicators of compromise can be correlated with endpoint telemetry so analysts can identify which internal hosts communicated with malicious infrastructure, delivering the visibility the security operations team requested.

Answer

Configure a custom Security Intelligence feed that pulls indicators from SecureX and applies them to access control policies.

Answer

Deploy a Cisco Secure Network Analytics appliance and configure it to receive NetFlow from the Threat Defense devices.

Answer

Enable Cisco Umbrella integration on FMC and configure the DNS policy to log all domain requests to the Umbrella dashboard.

Question 14

A network administrator is asked to provide a real-time view of active connections passing through a managed FTD device, including source and destination IP addresses, ports, and the applied access control rule, for an ongoing incident. Which FMC analysis tool should the administrator use?

Accepted Answer

The Analysis > Connections > Events page, which displays connection events with the matching access control rule and initiating user information.. Connection events in FMC capture per-flow details including the 5-tuple, the access control rule that matched, and identity or application context. This gives investigators the real-time and historical view of active connections needed to understand what traffic is traversing the managed FTD.

Answer

The System > Monitoring > Audit Log page, which records configuration changes made to the FMC and managed devices.

Answer

The Analysis > Intrusions > Events page, which lists every packet that traversed the device regardless of whether an intrusion was detected.

Answer

The Device Management > Interfaces page, which shows per-interface packet counters and error statistics for the managed device.

Question 15

An administrator needs to generate a troubleshooting file from an FTD device to send to Cisco TAC. The file must include detailed configuration and diagnostic information. Which FTD CLI command should the administrator use?

Accepted Answer

show tech-support. The 'show tech-support' command is the correct choice because it generates a detailed troubleshooting file containing configuration, logs, and diagnostic information. This is the standard procedure for collecting data for Cisco TAC. Other commands like 'show running-config' or 'show system resources' provide only partial information and are not sufficient for a comprehensive troubleshooting file.

Answer

show running-config

Answer

show system resources

Answer

show diagnostic