300-710 SNCF Practice Test 28 — 15 Questions

Question 1

An engineer has deployed a Cisco Secure Firewall Threat Defense in transparent firewall mode. Users on the inside segment report they cannot reach a server on the outside segment. The engineer verifies that the BVI (Bridge Virtual Interface) has an IP address in the same subnet as the internal hosts and default gateway. What is a likely reason for traffic being dropped?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An EtherType access list is blocking the encapsulated traffic or ARP requests between the bridge groups.. In transparent mode, non-IP traffic is dropped by default unless EtherType rules are explicitly configured to allow protocols like BPDUs, MPLS, or IPX through the firewall bridge groups.

Answer

An explicit Access Control Policy rule is blocking the traffic, because transparent mode inspections still require standard ACP rules.

Answer

The security zones for the inside and outside interfaces are identical, causing an implicit intra-zone drop.

Answer

Dynamic routing protocols must be enabled on the BVI to advertise the transparent subnet upstream.

Question 2

An engineer is deploying a Cisco Secure Firewall Threat Defense in routed mode and must configure an internal interface connected to a data center segment. The requirement is to route traffic at Layer 3 while keeping the firewall transparent to the MAC addresses of the hosts. Which action should the engineer perform on the interface setting in Cisco FMC?

Accepted Answer

Configure the interface as a routed interface with an IP address, relying on standard Layer 3 routing.. In routed mode, the firewall acts as a Layer 3 device and routes traffic using IP addresses while rewriting MAC addresses. Transparent mode operates at Layer 2. To operate at Layer 3 in routed mode while avoiding Layer 2 transparent bridge groups, standard routed interface configuration is used.

Answer

Set the operational mode of the interface to inline set for passive inspection without MAC rewriting.

Answer

Configure the interface as a BVI member to bridge the traffic across the subnet.

Answer

Enable the passive tap option on the physical port to monitor the data center segment out-of-band.

Question 3

An engineer is configuring a Cisco Secure Firewall Threat Defense cluster in a data center. To ensure high availability and prevent split-brain scenarios, what is the specific function of the cluster control link (CCL)?

Accepted Answer

It synchronizes configuration, connection state tables, and heartbeat health checks between cluster members.. The Cluster Control Link (CCL) is dedicated to synchronization, health monitoring, and control messaging between cluster nodes, preventing split-brain conditions by maintaining quorum and state sync.

Answer

It serves as the dedicated data forwarding path for all east-west traffic between different subnets.

Answer

It offloads all Snort inspection processing from data nodes to the control node.

Answer

It connects the cluster directly to the Cisco FMC management cloud over an encrypted TLS tunnel.

Question 4

An administrator is configuring a new Cisco Secure Firewall Threat Defense in routed mode on Firepower Device Manager (FDM). During the initial setup, the administrator needs to define the routing behavior for a multi-zone deployment. Which configuration step is mandatory when setting up routed mode?

Accepted Answer

Assign a unique Layer 3 IP address to each data interface and associate it with a security zone.. In routed mode, every interface must belong to a security zone and possess an IP address. Routed mode operates as a Layer 3 hop, unlike transparent mode which operates at Layer 2.

Answer

Disable the Snort inspection engine on all interfaces to allow bridging.

Answer

Assign a unique MAC address override to every physical interface.

Answer

Create a BVI (Bridge Virtual Interface) for each pair of physical interfaces.

Question 5

An engineer is deploying Cisco Secure Firewall Threat Defense in a complex multi-zone routed environment. Which THREE design considerations apply when implementing routed mode interfaces? (Choose three)

Accepted Answer

Each routed interface must belong to a distinct IP subnet and act as a Layer 3 gateway for connected segments.. Routed mode interfaces require IP addresses, participate in routing protocols or static routes, and handle MAC address rewriting as Layer 3 gateways.

Answer

NAT configuration is strictly prohibited on routed mode interfaces.

Answer

All physical interfaces must be combined into a single Bridge Virtual Interface (BVI).

Question 6

Which interface configuration is required to allow traffic to pass between two interfaces that belong to the same bridge group?

Accepted Answer

A bridge group interface (BVI) with an IP address.. Bridge group members are treated as segments of the same L2 domain, allowing traffic to pass without routing.

Answer

A static route to the BVI.

Answer

A VLAN trunk configuration.

Answer

An IP address on both interfaces.

Question 7

An administrator is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) on-premises using a KVM hypervisor. During the initial deployment, the virtual machine fails to boot and console logs indicate an issue with interface mapping. What is a key requirement for physical interface mapping on KVM-based FTDv deployments?

Accepted Answer

Interface eth0 must be dedicated exclusively to the management network, and data interfaces must follow a strict sequential mapping starting with eth1.. KVM deployments require correct mapping of virtual NICs (vNICs) to specific bridge or SR-IOV interfaces, where eth0 is strictly reserved for management, eth1 for internal, and eth2 for external data traffic.

Answer

KVM requires SR-IOV drivers for the management interface only.

Answer

Management must be mapped to eth2 while data interfaces use eth0 and eth1.

Answer

All interfaces must be bundled into a single virtio bridge without VLAN tagging.

Question 8

An administrator is deploying a Cisco Secure Firewall Virtual (Fv) appliance in an Amazon Web Services (AWS) environment. Which licensing model is typically supported for traffic throughput and feature activation during this cloud deployment?

Accepted Answer

Smart Licensing (BYOL) and Pay-As-You-Go (PAYG) through the AWS Marketplace.. Cisco Secure Firewall Virtual supports both Bring Your Own License (BYOL) using Smart Licensing and Pay-As-You-Go (PAYG) directly from cloud marketplaces.

Answer

Activation via automatic license generation from the Amazon VPC DHCP options list.

Answer

Perpetual hardware-locked PAK files applied via the command line interface.

Answer

Activation exclusively through an on-premises Cisco Smart Software Manager (CSSM) satellite server without internet access.

Question 9

When using clustering with FTD, what is the 'Flow Owner' in the context of traffic distribution?

Accepted Answer

The unit that maintains the connection state for a specific flow.. In a cluster, the Flow Owner is the specific unit that has received the initial TCP SYN for a connection and is responsible for all subsequent packets in that flow to ensure consistency.

Answer

The master unit that manages the configuration.

Answer

Any unit that has the highest CPU availability.

Answer

The unit that performs the SSL decryption for the flow.

Question 10

An administrator is deploying Cisco Secure Firewall Threat Defense Virtual (FTDv) in an enterprise cloud environment (such as AWS or Azure). Which THREE considerations are unique to cloud-based firewall deployments compared to physical hardware deployments? (Choose three)

Accepted Answer

The administrator must manage cloud provider route tables (e.g., AWS Route Tables or Azure UDRs) to steer traffic through the firewall ENIs.. Cloud deployments involve managing cloud routing tables (UDRs), utilizing specific licensing models (BYOL or Pay-As-You-Go), and managing network interface limits per VM instance.

Answer

Physical hardware bypass network interface modules must be manually installed into the virtual hypervisor slot.

Answer

FTDv in the cloud requires transparent mode with BVI grouping for all data interfaces.

Question 11

An administrator is troubleshooting an active/standby Cisco Secure Firewall High Availability pair. Stateful failover is enabled, but active long-lived TCP connections are dropping when a failover occurs. Upon checking the stateful inspection settings, what is the most likely cause of this behavior?

Accepted Answer

Dynamic NAT translation entries are not being synchronized across the failover link because stateful NAT translation sync is disabled.. If 'Stateful Inspection' or the specific protocol inspection is disabled or not synchronized, or if the asymmetric routing path prevents state synchronization, long-lived connections will drop. Specifically, if the TCP state bypass feature or asynchronous state settings are misconfigured, state tables will not match.

Answer

The units are running different minor patch versions of Cisco FTD, causing the state payload to be silently dropped by the receiver.

Answer

The stateful failover link (FMC control link) is using a management-only interface instead of a dedicated high-speed data interface.

Answer

The active unit is configured with stateful failover, but the standby unit is configured for stateless failover via CLI.

Question 12

You are configuring a high availability pair of FTDs. Which interface type is strictly reserved for state synchronization?

Accepted Answer

Dedicated Failover/State link. The failover link (specifically the dedicated state link) is used to synchronize connection state, NAT tables, and other session data between the active and standby units.

Answer

Management interface

Answer

Data interface

Answer

Diagnostic interface

Question 13

You have an FTD device and need to perform deep packet inspection without changing the network topology or IP addressing. Which deployment mode should you choose?

Accepted Answer

Transparent mode. Transparent mode sits in the middle of a segment as a layer 2 bridge, requiring no changes to IP addressing or routing on the existing infrastructure.

Answer

Routed mode

Answer

Virtual wire mode

Answer

Inline set mode with routing

Question 14

An administrator is configuring inline interface pairs on a Cisco Secure Firewall Threat Defense device. Which THREE characteristics apply to inline deployment mode? (Choose three)

Accepted Answer

Asymmetric routing must be carefully managed or avoided because inline inspection expects to see both directions of a TCP flow.. Inline mode inspects traffic live, can drop packets based on policy or threats, and supports hardware bypass (fail-open) capabilities.

Answer

Inline interfaces require SPAN or TAP configurations on upstream core switches to receive mirrored traffic copies.

Answer

Inline mode prevents the firewall from operating in routed mode.

Question 15

An administrator is configuring security zones on a Cisco Secure Firewall Threat Defense. Which TWO rules regarding security zones and interface assignments are correct? (Choose two)

Accepted Answer

Multiple interfaces (such as physical ports, subinterfaces, or EtherChannels) can be grouped into a single security zone.. Security zones can contain multiple interfaces, but a single physical or logical interface can only belong to one security zone at a time.

Answer

Every security zone must contain at least one BVI interface.

Answer

Security zones replace the need for Access Control Policies entirely.

Answer

Security zones are only supported in transparent mode and cannot be used in routed mode deployments.