300-710 SNCF Practice Test 27 — 15 Questions

Question 1

A security engineer is deploying a Cisco Secure Firewall Threat Defense device in transparent mode at a data center. The device must inspect traffic between two Layer 3 subnets without changing the IP addressing scheme. The engineer configures a bridge group and assigns two interfaces to it. Which statement describes the correct behavior of the bridge group in transparent mode?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bridge group bridges the two interfaces at Layer 2, and the FTD can inspect traffic without modifying the IP headers.. In transparent mode, FTD uses a bridge group to connect two interfaces at Layer 2, allowing inline inspection without changing IP addressing. The device does not route between the interfaces, so the existing subnet design remains intact. Policies such as access control and intrusion prevention still apply to the bridged traffic, making it suitable for data center insertion.

Answer

The bridge group requires NAT to translate addresses between the two interfaces.

Answer

The bridge group operates as a switched virtual interface, and each interface must be in a different VLAN.

Answer

The bridge group acts as a Layer 3 router between the two interfaces, requiring IP addresses on each interface.

Question 2

An administrator needs Cisco Secure Firewall Threat Defense to send connection and intrusion events to a third-party SIEM. The SIEM vendor requires that events arrive in a structured format over a reliable transport and supports only a specific event schema. Which FMC configuration should be used to meet these requirements?

Accepted Answer

Configure the eStreamer service on FMC and use the vendor's eStreamer client to receive events in the vendor-supported schema.. eStreamer is purpose-built to export FMC security events, including connection and intrusion data, to external consumers over a reliable TCP connection and in a structured format. Because many SIEM vendors ship an eStreamer-compatible client that understands the schema, this configuration meets the structured format, reliability, and vendor schema requirements without custom parsing or batch delays.

Answer

Export events from FMC as CSV files on a schedule and import them into the SIEM with a custom script.

Answer

Enable syslog forwarding from each Threat Defense device and rely on the SIEM's generic syslog parser.

Answer

Configure SNMP traps on FMC and map the OIDs to SIEM fields using a management information base.

Question 3

An administrator must capture and analyze traffic on a specific FTD interface to troubleshoot an intermittent connectivity problem. The administrator wants to use FMC-native capabilities rather than logging into the device CLI. Which TWO actions can the administrator perform from the FMC to capture and then inspect the traffic? (Choose two.)

Accepted Answer

Download the resulting .pcap file from the FMC packet capture task and open it in a third-party analyzer such as Wireshark.. FMC lets administrators create a packet capture on a managed FTD interface with optional filters, then download the resulting .pcap for analysis in an external tool. This provides a GUI-driven capture workflow without requiring CLI access to the device.

Answer

Use the FMC Intrusion Events page to reconstruct the raw packet bytes for the flow from the stored event payload.

Answer

Enable 'Capture All Traffic' under the FTD platform settings so every packet is retained in the FMC event database for later inspection.

Answer

Run the 'capture-traffic' command from the FMC CLI to pull packets from the managed device into the FMC local filesystem.

Question 4

A security team wants Cisco Secure Firewall Threat Defense to block traffic to domains that appear on a third-party threat feed before users connect. The feed is published as a plain-text list of malicious domains over HTTPS and changes frequently. Which integration method should be used to populate a DNS Block List on the Firewall Management Center?

Accepted Answer

Configure an External Block List with a URL source type pointing to the threat feed and assign it to a DNS policy.. The External Block List feature in FMC was designed to consume dynamic, externally hosted lists, including plain-text domain lists retrieved over HTTPS on a schedule. Because the list is bound to a DNS policy, the Threat Defense device can block resolution of the listed domains before any connection is attempted, which is exactly what the team needs for a frequently changing third-party feed without manual object updates.

Answer

Import the feed as a Network object group and apply it to an access control rule with a Block action.

Answer

Create a File Blocking policy that references the threat feed's object group and deploy it to the Threat Defense devices.

Answer

Enable Security Intelligence feeds and subscribe to the Cisco Talos domain reputation feed only.

Question 5

A security administrator is integrating Cisco Secure Firewall Management Center with Cisco Identity Services Engine (ISE) using pxGrid. The administrator wants to enforce identity-based policies on the Threat Defense devices. After configuring the pxGrid integration, the administrator notices that user identity information is not being populated in the FMC. The administrator verifies that the pxGrid certificate is valid and the FMC can reach ISE on port 8910. What is the most likely cause?

Accepted Answer

The FMC is not configured to subscribe to the correct pxGrid topics, such as Session Directory and User Identity.. For pxGrid integration to populate user identity information, the FMC must subscribe to the appropriate pxGrid topics, such as Session Directory and User Identity. Without these subscriptions, the FMC will not receive the data even if the connection and certificates are valid. Verifying and enabling the correct subscriptions is essential for successful integration.

Answer

The FMC is using the wrong certificate for pxGrid, and the ISE rejects the connection.

Answer

The Threat Defense devices are not configured to send user identity information to the FMC.

Answer

The ISE pxGrid persona is not enabled on the ISE node, and the FMC cannot authenticate.

Question 6

An engineer is troubleshooting an integration between Cisco Secure Firewall Management Center and Cisco Identity Services Engine (ISE) using pxGrid. The FMC shows the pxGrid connection as 'Connected', but user identity information is not being populated in the FMC. Which action should the engineer take first to resolve the issue?

Accepted Answer

Verify that the FMC is subscribed to the correct pxGrid topics in ISE.. When the pxGrid connection is 'Connected' but identity data is not populated, the most likely cause is that the FMC is not subscribed to the necessary pxGrid topics in ISE. The FMC must subscribe to topics like session directory to receive user identity updates. Verifying subscriptions is the correct first troubleshooting step.

Answer

Verify that the FTD devices are registered with ISE.

Answer

Check the FMC's certificate expiration date.

Answer

Restart the pxGrid service on ISE.

Question 7

A security administrator is deploying a Cisco Secure Firewall Threat Defense (FTD) device and needs to configure the management interface for initial setup. The administrator plans to use the default management IP address and then change it to a static address. Which default management IP address and subnet mask are preconfigured on a new FTD appliance?

Accepted Answer

192.168.45.45/28. A new FTD appliance is preconfigured with a management IP address of 192.168.45.45 and a subnet mask of 255.255.255.240 (/28). This allows initial access to the management interface so the administrator can perform setup and change the address as needed.

Answer

10.0.0.1/8

Answer

192.168.1.1/24

Answer

192.168.45.45/24

Question 8

An administrator is deploying a new Cisco FTD device managed by FMC and needs to route traffic between two internal networks while performing NAT. The FTD must also enforce access control and inspection policies. Which interface mode must be configured on the FTD to meet these requirements?

Accepted Answer

Routed mode. Routed mode is required because the FTD must perform Layer 3 routing, NAT, and access control between different subnets. Transparent mode is Layer 2 only and cannot route between networks. Inline tap and passive modes are monitoring modes that do not forward traffic, so they cannot enforce policies or provide NAT.

Answer

Inline tap mode

Answer

Transparent mode

Answer

Passive mode

Question 9

A security administrator has integrated Cisco Secure Firewall Management Center (FMC) with Cisco Identity Services Engine (ISE) using pxGrid. The administrator wants to verify that the integration is working and that user identity data is being received. Which FMC feature should be used to view the learned user identities and their associated IP addresses?

Accepted Answer

Analysis > Users. FMC provides the Analysis > Users page to view user identity data learned from ISE. This page lists usernames, IP addresses, and other session details, allowing administrators to verify that the pxGrid integration is functioning correctly. Other pages like Access Control or Integration do not display this information.

Answer

Analysis > Connections

Answer

Policies > Access Control

Answer

System > Integration

Question 10

An engineer is troubleshooting an FTD device that is not sending events to the FMC. The engineer suspects that the connection between the FTD and FMC is down. Which CLI command on the FTD should the engineer use to verify the status of the management connection to the FMC?

Accepted Answer

show managers. The 'show managers' command is specifically designed to display the status of the FTD's management connection to FMC, including registration state and last heartbeat. It is the quickest way to verify if the FTD is successfully communicating with the FMC.

Answer

show running-config

Answer

show events

Answer

show interface

Question 11

A network security engineer is integrating Cisco Secure Firewall Threat Defense (FTD) with Cisco Identity Services Engine (ISE) for user identity-based policies. The engineer wants to use the Cisco Platform Exchange Grid (pxGrid) to share user identity information. Which component must be configured as a pxGrid client to receive user identity data from ISE?

Accepted Answer

Cisco Secure Firewall Management Center (FMC). FMC serves as the pxGrid client in an FTD deployment, receiving user identity data from ISE and distributing it to managed FTD devices. This centralized approach simplifies configuration and management. Other components like FTD or ISE do not fulfill this role.

Answer

Cisco Secure Network Analytics (Stealthwatch)

Answer

Cisco Identity Services Engine (ISE) itself

Answer

Cisco Secure Firewall Threat Defense (FTD) device

Question 12

An engineer is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. The SIEM requires that messages be reliably delivered and that the source of the messages be authenticated. The engineer enables syslog over TCP and configures a syslog server. Which additional configuration is required to meet the SIEM's authentication requirement?

Accepted Answer

Configure the Threat Defense device to use TLS for syslog and install a certificate on the device that the SIEM trusts.. To meet both reliability and source authentication for syslog to a SIEM, syslog over TLS is the appropriate choice. TLS provides encryption, integrity, and certificate-based authentication of the sender. The Threat Defense device can be configured with a certificate that the SIEM trusts, allowing the SIEM to verify the origin of the messages. Plain TCP syslog offers reliability but not authentication, while UDP and checksum-based approaches do not satisfy the authentication requirement.

Answer

Configure the Threat Defense device to use TCP syslog with an MD5 checksum on each message.

Answer

Configure the Threat Defense device to use UDP syslog with a shared secret key.

Answer

Configure the Threat Defense device to use TCP syslog and enable IPsec on the management interface.

Question 13

An administrator is configuring a NAT policy on FMC for an FTD device. The requirement is to translate the source IP address of internal users to a single public IP address when accessing the Internet, while preserving the source port. Which NAT type should be used?

Accepted Answer

Dynamic PAT. Dynamic PAT (NAT overload) allows multiple internal hosts to share a single public IP address by translating both the source IP and source port. This is the standard method for outbound Internet access from a private network. Static NAT and Static PAT are used for inbound access or one-to-one mappings, and Dynamic NAT without PAT does not allow multiple hosts to share one IP.

Answer

Static NAT

Answer

Static PAT

Answer

Dynamic NAT

Question 14

An engineer is deploying Cisco Secure Firewall Threat Defense in a routed environment where the inside network uses private RFC 1918 addresses and the outside interface connects to an ISP. The requirement is that inside hosts can reach the internet, but the firewall must not translate traffic destined for an internal server farm that is also reachable through a secondary internal interface. Which configuration approach correctly meets this requirement?

Accepted Answer

Configure a manual NAT rule with the inside source networks translated to the outside interface address, and place a no-NAT (identity) rule above it for traffic destined to the internal server farm.. Selective translation requires ordered rules. A manual NAT policy lets the engineer place an identity rule for internal server farm destinations above a dynamic PAT rule for internet-bound traffic, so only the intended flows are translated. This ordering is the key to meeting both the translation and the exemption requirements in one policy.

Answer

Disable NAT control entirely and let the upstream ISP router perform translation for all inside traffic.

Answer

Rely solely on auto NAT applied to the inside interface object, because auto NAT automatically excludes internal destinations.

Answer

Apply dynamic identity NAT to all inside networks and use a policy-based route to redirect internet traffic to the ISP.

Question 15

An administrator is integrating Cisco Secure Firewall Management Center with a third-party SIEM using eStreamer. The administrator needs to ensure that the eStreamer client can receive events from the FMC. Which two actions are required to configure eStreamer on the FMC? (Choose two.)

Accepted Answer

Configure the eStreamer service on the FMC to allow connections from the client's IP address.. To enable an eStreamer client to receive events from the FMC, you must generate a client certificate on the FMC and configure the client to use it, and you must allow the client's IP address in the eStreamer configuration. These two actions establish secure authentication and network access, allowing the client to connect and receive event streams.

Answer

Configure a syslog server object on the FMC and set it to forward events to the eStreamer client.

Answer

Enable the eStreamer service on the Threat Defense devices and configure them to forward events to the FMC.

Answer

Install the eStreamer service on the FMC and start it.