300-710 SNCF Practice Test 27 — 15 Questions

Question 1

An engineer has deployed an active/standby High Availability pair of Cisco Secure Firewall Threat Defense devices. A failure occurs on the active unit, and a failover successfully takes place. However, upon recovery of the original active unit, it immediately resumes its role as the active unit, causing a brief secondary interruption. Which failover setting governs this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Failover Preempt Configuration. The 'Preempt' setting dictates whether a recovered primary unit will reclaim its active role from the current active unit. By default, preemption may be enabled or disabled depending on configuration preferences.

Answer

MAC Address Persistence Timer

Answer

HEMS Poll Frequency

Answer

Stateful Failover Sync Interval

Question 2

You are configuring an active/standby High Availability pair for Cisco Secure Firewall Threat Defense using FMC. You need to configure port channels for the data interfaces to increase bandwidth and redundancy. Which guideline must be followed regarding port channels in an HA deployment?

Accepted Answer

The port channel interfaces on both the primary and secondary units must have identical interface IDs and member port compositions.. Port channel configurations (EtherChannels) must be identically configured on both the active and standby units. The physical member ports must match across both firewalls.

Answer

LACP active mode is unsupported on HA secondary units; static port channels must be used instead.

Answer

Port channels are restricted to transparent mode HA configurations only.

Answer

Port channels can only be configured on the active unit; the standby unit automatically inherits them via stateful sync.

Question 3

An engineer is configuring static route tracking on a Cisco Secure Firewall Threat Defense to ensure high availability for outbound internet connectivity. A backup static route is configured with a higher metric. What mechanism does the firewall use to dynamically switch from the primary route to the backup route when the primary next-hop fails?

Accepted Answer

Bidirectional Forwarding Detection (BFD) or ICMP ping SLA trackers that monitor the next-hop IP.. Static route tracking utilizes Embedded Event Manager (EEM) or IP SLA monitoring (via ICMP/TCP probes) to track reachability, modifying the routing table dynamically when the probe fails.

Answer

STP topology change notifications received on the tracked interface.

Answer

FMC heartbeat loss detection between the firewall and the gateway.

Answer

Automatic generation of dynamic OSPF neighbor adjacencies over the static interface.

Question 4

An engineer is troubleshooting a passive NGIPS deployment where the Cisco Secure Firewall is connected to a switch SPAN port. Security analysts report that certain VLAN-tagged packets are not appearing in the event logs. What is the most likely cause?

Accepted Answer

The passive interface or subinterfaces on the firewall are not configured to recognize or decode the specific 802.1Q VLAN tags present in the SPAN stream.. When monitoring trunk ports via SPAN, if the firewall's passive interface is configured without VLAN tagging enabled or lacks subinterfaces matching the trunk VLANs, tagged frames may be dropped or ignored.

Answer

The firewall management IP address is misconfigured, causing packet loss on the monitoring port.

Answer

The Snort inspection engine drops all SPAN traffic by default unless inline bypass mode is active.

Answer

Passive interfaces do not support VLAN tagging; all trunk traffic must be untagged at the switch SPAN source.

Question 5

You need to configure link redundancy on a Cisco Secure Firewall Threat Defense pair using EtherChannel (Port Channel) across multiple physical interfaces. When configuring LACP (IEEE 802.3ad) for the port channel interface via the Firepower Management Center (FMC), which requirement must be met for successful negotiation?

Accepted Answer

Both the FTD and the connected switch must be configured in LACP active mode or one must be active and the other passive.. When configuring LACP on FTD, the mode must match the upstream/downstream switch configuration (Active/Active or Active/Passive) and physical parameters like speed and duplex must match identically.

Answer

The Port Channel must be configured in static mode (ON) regardless of the upstream switch settings to avoid LACP PDUs dropping.

Answer

The EtherChannel must use Source-Destination IP hashing exclusively, as MAC-based hashing is unsupported on FTD.

Answer

LACP fast rate (1-second timer) is mandatory for FTD clustering but optional for standalone firewalls.

Question 6

When considering virtual FTD deployments, which THREE factors significantly impact the performance of the instance?

Accepted Answer

The amount of provisioned RAM. Performance in virtual FTD is constrained by hardware resources like CPU cores, RAM, and the efficiency of the virtual network adapter.

Answer

The number of configured Access Control Rules

Answer

The number of active management sessions

Question 7

You are deploying a Cisco Secure Firewall Threat Defense in an existing core network as an out-of-band intrusion prevention system. Which NGIPS deployment mode should you configure to ensure the firewall performs deep packet inspection and generates alerts without dropping any production traffic in the event of a device failure or high load?

Accepted Answer

Passive deployment mode using a SPAN or tap source. Passive mode listens to a mirrored traffic stream (e.g., via SPAN or TAP). It analyzes copies of packets and cannot drop live production traffic.

Answer

Transparent mode with inline bypass enabled

Answer

Inline deployment mode with fail-open enabled

Answer

Routed mode with asymmetric routing tolerance

Question 8

An administrator configures a Cisco Secure Firewall Threat Defense cluster. During normal operations, a data node experiences a critical hardware failure. What happens to the active connections currently processed by that specific failed data node?

Accepted Answer

Active connections are migrated or maintained by surviving cluster nodes because connection state is distributed across the cluster.. In a firewall cluster, connection states are shared or can be redistributed/failed over. When a data node fails, existing connections handled by that node are re-hashed or terminated unless state is synchronized across the cluster nodes.

Answer

Traffic destined for the failed node is permanently blackholed until the physical module is replaced.

Answer

All active connections are immediately dropped, forcing clients to re-establish TCP handshakes from scratch.

Answer

The entire cluster reboots to elect a new control node and rebuild the data plane.

Question 9

An administrator is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) in Microsoft Azure. The architecture calls for a 3-NIC deployment (Management, Inside, and Outside). After deployment, asymmetric routing issues are observed because Azure Load Balancer is forwarding return traffic directly back to a different backend instance. What configuration must be applied to prevent asymmetric drops?

Accepted Answer

Configure Source NAT (SNAT) on the FTDv so that traffic appears to originate from the firewall interface IP, ensuring symmetrical return paths.. Cloud deployments utilizing load balancers often require enabling SNAT (Source NAT) on the firewall so that return traffic flows back through the exact same firewall instance, preventing asymmetric drop behavior.

Answer

Enable Strict Asymmetric Routing Bypass mode in the FTDv Advanced Firewall Settings.

Answer

Disable the Azure UDR (User Defined Route) on the inside subnet.

Answer

Convert the FTDv deployment from routed mode to transparent mode.

Question 10

An administrator is configuring a secure firewall deployment in an environment where dynamic routing via OSPF is required across multiple security zones. Which configuration requirement must be met on the Cisco Secure Firewall Threat Defense?

Accepted Answer

OSPF must be enabled globally, associated with specific areas, and enabled on the specific routed interfaces belonging to security zones.. OSPF on FTD requires configuring OSPF routing processes via FMC, defining areas, enabling router IDs, and explicitly identifying the interfaces participating in OSPF routing.

Answer

OSPF neighbor adjacencies must terminate on the firewall management interface.

Answer

OSPF requires all participating interfaces to be assigned to the exact same security zone.

Answer

OSPF can only be enabled on transparent bridge virtual interfaces (BVIs).

Question 11

When deploying Cisco Secure Firewall Threat Defense in transparent mode, which TWO operational characteristics or restrictions apply to the deployment? (Choose two)

Accepted Answer

The firewall bridges traffic at Layer 2 between interfaces belonging to the same BVI bridge group.. Transparent firewalls operate at Layer 2, bridge traffic using BVIs, do not support dynamic routing protocols, and require management IP addresses for the bridge group.

Answer

Every physical interface must be configured with a unique public routable IP address.

Answer

The firewall must act as the primary DHCP server for all downstream VLANs.

Answer

Network Address Translation (NAT) is fully supported for changing IP addresses across interfaces.

Question 12

You are deploying a Cisco Secure Firewall Threat Defense in transparent mode. How are frames forwarded between the internal and external interfaces of the firewall?

Accepted Answer

By bridging frames at Layer 2 based on destination MAC addresses within a configured Bridge Group.. Transparent mode bridges traffic at Layer 2 using Bridge Groups and Bridge Virtual Interfaces (BVIs), forwarding frames based on destination MAC addresses rather than Layer 3 routing.

Answer

By encapsulating all packets inside GRE tunnels between the ingress and egress ports.

Answer

By translating all private IP addresses to public IP addresses using NAT overload.

Answer

By performing IP route lookups and decrementing the TTL on every packet.

Question 13

An administrator is configuring high availability for Cisco Secure Firewall Threat Defense using Cisco FMC. Which TWO configuration steps are required during the initial setup of an Active/Standby HA pair? (Choose two)

Accepted Answer

Configure a dedicated failover interface and IP address scheme for stateful heartbeat communication.. Active/Standby HA setup requires assigning roles (Primary/Secondary), configuring the failover link interface parameters, and matching interface configurations.

Answer

Configure the management interfaces to use DHCP so the standby unit can adopt the primary IP address.

Answer

Ensure both units are configured in different firewall modes (one routed, one transparent).

Answer

Disable stateful synchronization to improve failover switching speed.

Question 14

When deploying a Cisco Secure Firewall Threat Defense device, what is the purpose of configuring Security Zones?

Accepted Answer

To logically group one or more interfaces together for simplified Access Control Policy application.. Security zones logically group one or more interfaces together, simplifying access control policy enforcement by allowing rules to apply to a zone rather than individual interfaces.

Answer

To establish High Availability stateful synchronization between primary and secondary nodes.

Answer

To assign VLAN IDs to physical switch ports connected to the firewall.

Answer

To encrypt traffic passing between interfaces belonging to different zones using IPsec.

Question 15

An administrator is configuring static route tracking on a Cisco Secure Firewall Threat Defense deployment to handle link failure. If the tracked object goes down, the static route should be removed from the routing table. Where is this configuration managed when using Cisco FMC?

Accepted Answer

Under Devices > Device Management > Routing > Static Route, by editing the route and selecting a Monitor Track object.. Static route tracking in FMC is managed under Devices > Device Management > Routing > Static Route, where you associate an IP SLA Monitor object or Track object to a specific static route entry.

Answer

Under Policies > Access Control > Routing Policies, by enabling SLA tracking hooks.

Answer

Under System > Configuration > High Availability > Route Tracking.

Answer

Under Objects > Object Management > SIEM > Route Track.