300-710 SNCF Practice Test 26 — 15 Questions

Question 1

An administrator is configuring manual NAT and needs to specify an interface pair (Source Interface and Destination Interface). Why is defining interface objects important in manual NAT rules?

Accepted Answer

It scopes the translation rule to specific ingress and egress interfaces, preventing unintended translations across other subnets.. Interface specifications in manual NAT help define the directionality and scope of the translation (e.g., inside to outside).

Answer

It replaces the need for security zones in Access Control policies.

Answer

It forces the FTD to convert the packet from Layer 2 to Layer 3.

Answer

It enables automatic routing table updates for the translated IP address.

Question 2

An administrator is configuring an Identity Policy with Active Directory integration. The requirement is to ensure that users who fail primary AD authentication are assigned to a restricted guest VLAN using ISE integration. Which component in the FMC architecture handles this user-to-group association?

Accepted Answer

Realm Configuration under Integration Settings. The Realm configuration defines how the FTD connects to Active Directory (via LDAP/AD Agent) and associates users and groups for identity policies.

Answer

Network Analysis Policy (NAP)

Answer

Prefilter Policy Rule Match

Answer

Security Intelligence Feed

Question 3

An administrator is troubleshooting a Prefilter Policy configured on an FMC. Which THREE actions are available when creating a rule in a Prefilter Policy? (Choose three)

Accepted Answer

Slow Path (send traffic through normal inspection pipeline). Prefilter policies support Fast Path, Slow Path, and Block actions to handle traffic before access control and inspection.

Answer

Decrypt - Resign (intercept and re-sign SSL certificate)

Answer

Inspect with Snort 3 Intrusion Prevention

Question 4

An administrator is configuring a Network Address Translation (NAT) rule on a Cisco FMC managed Threat Defense device. The requirement is to translate the source IP address of traffic coming from the inside zone going to the outside zone, but only for a specific internal subnet. Which NAT type must the administrator select in the FMC NAT rule configuration?

Accepted Answer

Auto NAT (Object NAT). Manual NAT or Auto NAT can be used, but for granular control over source and destination zones and interfaces, an Auto NAT rule or a Manual NAT rule configured as Source NAT (Dynamic NAT or PAT) from inside to outside is required. Specifically, for translating source IP addresses of an internal subnet going out, Auto NAT (Network Object NAT) using a network object for the source is the most direct method.

Answer

Twice NAT (Destination NAT)

Answer

Prefilter NAT

Answer

Manual NAT (Identity NAT)

Question 5

An administrator is configuring a Prefilter Policy in FMC to optimize performance on a Cisco Firepower Threat Defense device. The requirement is to completely bypass inspection for a trusted high-speed data backup tunnel between two datacenters using GRE encapsulation. Which prefilter rule action should be selected?

Accepted Answer

Fast Path. To completely bypass Snort inspection and fast-path the traffic at the hardware/driver level for performance, the Fast Path action is used within a Prefilter policy.

Answer

Monitor

Answer

Block

Answer

Analyze

Question 6

An administrator is configuring Security Intelligence on the FMC to drop traffic from known malicious IP addresses. Where in the Access Control Policy is Security Intelligence evaluated relative to standard access rules?

Accepted Answer

Before Access Control rules are evaluated. Security Intelligence is evaluated before Access Control Policy rules are processed, providing an efficient early drop mechanism.

Answer

Inside the Prefilter policy configuration menu

Answer

After all Access Control rules are evaluated as a fallback action

Answer

Concurrently with Intrusion Policy inspection

Question 7

An administrator is troubleshooting a Stateful High Availability (HA) pair of Cisco Secure Firewall 4100 series devices managed by FMC. The units are failing to form an HA state, and logs indicate a state mismatch on the control link. Which underlying cause is most likely preventing the HA synchronization?

Accepted Answer

One unit is running a slightly different maintenance patch release of FTD than its peer.. Firewall High Availability requires identical hardware models, identical interface counts/types, matching deployment modes (routed/transparent), and identical software/patch versions.

Answer

The MTU on the data interfaces differs by 4 bytes.

Answer

The stateful HA control link is configured across a routed switch interface instead of a direct cross-over cable.

Answer

The management IP addresses on the active and standby units are identical.

Question 8

An engineer deploys an NGIPS in passive mode using a SPAN (Switched Port Analyzer) port on a core switch. During traffic analysis, the engineer notices that the firewall is not seeing TCP reset packets generated by internal servers. What is the primary operational limitation of deploying an NGIPS in passive mode that explains this behavior?

Accepted Answer

Passive sensors operate out-of-band and cannot block traffic inline or guarantee packet delivery state synchronization.. Passive mode sensors receive a copy of traffic via SPAN or tap. Because they are out-of-band, they cannot block traffic inline or actively drop packets; they can only generate alerts or send TCP resets (if configured and supported), but cannot guarantee inline remediation.

Answer

Passive mode forces the Snort engine to disable all custom intrusion rules.

Answer

Passive sensors cannot inspect encrypted TLS traffic due to missing cryptographic keys.

Answer

SPAN ports automatically drop TCP reset flags for security reasons.

Question 9

An administrator is creating an Access Control Policy rule on the FMC. Which TWO elements are required to create a basic rule? (Choose two)

Accepted Answer

Rule Name. Every Access Control Policy rule requires at least an Action (e.g., Allow, Block) and a Name. Other fields like source/destination zones or applications can be set to 'Any'.

Answer

Source Security Zone

Answer

Destination Port Object

Answer

Intrusion Policy assignment

Question 10

An administrator needs to configure Quality of Service (QoS) on a Cisco Firepower Threat Defense device via FMC to limit peer-to-peer traffic bandwidth. Where must the QoS policy be applied for it to take effect on traffic traversing the firewall?

Accepted Answer

Assigned to Security Zones in the Access Control Policy QoS tab. QoS policies in Firepower Threat Defense are applied to security zones (either inbound or outbound relative to the zone interface) within the QoS tab of the Access Control Policy.

Answer

Assigned to Access Control Policy rules directly

Answer

Assigned inside Prefilter Policies

Answer

Assigned globally in Platform Settings

Question 11

An administrator is deploying static route tracking combined with IP SLA on a Cisco Secure Firewall Threat Defense device managed by Cisco FMC. Which TWO components must be configured to implement this feature successfully? (Choose two)

Accepted Answer

A Track object that monitors the state of the IP SLA operation.. Route tracking requires creating an IP SLA Monitor object to test reachability and configuring a Track object linked to that SLA, which is then referenced in the static route.

Answer

A secondary management interface configured for out-of-band SLA telemetry.

Answer

A BGP routing peer group that automatically advertises SLA status to upstream routers.

Answer

An Access Control Rule explicitly permitting ICMP traffic destined for the firewall's loopback interface.

Question 12

You are configuring an NGIPS mode deployment on an FTD device. You need to ensure that the FTD can drop malicious traffic in real-time. Which mode must you select?

Accepted Answer

Inline Mode. Inline mode allows the FTD to actively inspect and drop packets, whereas passive mode only inspects traffic via a copy/span port and cannot drop packets.

Answer

Promiscuous Mode

Answer

Bypass Mode

Answer

Passive Mode

Question 13

You are configuring a NAT rule and need to hide the internal network behind a single interface IP. Which NAT translation setting is required?

Accepted Answer

Interface PAT. Interface PAT (Port Address Translation) uses the IP of the egress interface for all source translations.

Answer

Static IP

Answer

Dynamic IP

Answer

Identity NAT

Question 14

You are setting up an FTD interface. What is the difference between a 'Routed' and 'Transparent' interface mode?

Accepted Answer

Transparent mode operates at L2. Routed mode acts as a L3 gateway, while Transparent mode acts as a L2 bridge.

Answer

Routed mode does not support VLANs

Answer

Transparent mode requires a default gateway

Answer

Routed mode requires NAT

Question 15

Which TWO items can be used to filter traffic in a QoS policy?

Accepted Answer

Port object. QoS policies use Network and Port objects to classify traffic for bandwidth management.

Answer

User Identity

Answer

License status

Answer

Device name