300-710 SNCF Practice Test 30 — 15 Questions

Question 1

An administrator needs to troubleshoot a routing issue on an FTD device managed by FMC. Where in the FMC GUI should the administrator navigate to view and modify static and dynamic routing configurations for the device?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Devices > Device Management > Edit Device > Routing tab. Routing configurations for FTD are managed under Devices > Device Management, selecting the specific device, and clicking the Routing tab.

Answer

Objects > Object Management > Network > Routes

Answer

System > Configuration > Network Settings

Answer

Policies > Access Control > Routing

Question 2

An FTD device managed by FMC is experiencing high CPU utilization attributed to the Snort inspection engine. The administrator wants to identify which specific intrusion rules or access control rules are consuming the most resources. Which tool or report should the administrator use?

Accepted Answer

Access the FTD CLI and run 'system support diagnostic-cli' followed by 'show perfstats' or review the Intrusion Performance dashboard in FMC.. The Performance Statistics feature and Intrusion Event analysis in FMC help identify resource-heavy traffic and rules. Additionally, the 'Show Snort Statistics' or 'Perfstats' command via the FTD diagnostic CLI provides real-time rule processing metrics.

Answer

Run a packet capture on the management interface (eth0) with a BPF filter for CPU interrupts.

Answer

Navigate to Analysis > Datastores > Packet Trace and export the raw CPU register dump.

Answer

Check the Interfaces > Counters page in the Cisco Integrated Management Controller (CIMC).

Question 3

During a routine backup of the FMC, the administrator wants to ensure that the generated backup file contains critical historical events, configurations, and intrusion event data so that it can be fully restored to a replacement appliance if necessary. Which backup type should be selected in the FMC?

Accepted Answer

Manual Backup with both System Settings and Historical Event Data checkboxes enabled. FMC provides 'Manual Backup' configurations where administrators can select components. To include configuration and event data, a manual backup profile must be created with both System Configuration and Event data selected.

Answer

RAID Controller Configuration Export

Answer

System Configuration Backup only

Answer

Snort Rule Update (SRU) Snapshot Backup

Question 4

An administrator is troubleshooting a high availability (HA) failover link failure between two FTD physical appliances. Which THREE checks should be performed to diagnose physical and logical connectivity between the failover interfaces? (Choose three)

Accepted Answer

Verify physical link lights (LEDs) and cable integrity on the dedicated failover interfaces.. Troubleshooting HA failover links involves checking physical cable connections, verifying interface status via 'show failover', checking IP reachability/ping across the failover interface, and reviewing failover configuration parameters.

Answer

Change the FTD management IP address on both units.

Answer

Reboot the FMC to restart failover polling.

Question 5

An administrator is troubleshooting an issue where Snort inspection engine crashes repeatedly on an FTD device. Which THREE diagnostic artifacts or steps should the administrator collect and perform to assist Cisco TAC in resolving the core dump issue? (Choose three)

Accepted Answer

Collect the generated core dump files located in the core directory (such as /var/common/ or /var/sf/cores/).. When Snort crashes, core dump files are generated in /var/common/ or /var/sf/cores/. Collecting core files, tech-support bundles, and verifying Snort configuration rules helps TAC.

Answer

Delete all log files in /var/log to clear disk space before opening a TAC case.

Answer

Format the flash memory partition containing the Snort binaries.

Question 6

Which license state must an FTD device reach to allow the FMC to push policy configurations to it?

Accepted Answer

Registered and licensed. Devices must be registered and properly licensed (or in grace period) for policy deployment to succeed.

Answer

Disabled

Answer

Unregistered

Answer

Waiting for registration

Answer

Standby mode only

Question 7

An administrator needs to perform a full system backup of the FMC. Where is the most appropriate place to store this backup for long-term disaster recovery?

Accepted Answer

Remote server using SCP or SFTP. Backups should be stored on a remote server (e.g., via SCP or FTP) to ensure they are available if the FMC appliance fails entirely.

Answer

Local /var/log/backup partition

Answer

The FMC /tmp directory

Answer

Attached USB storage drive

Answer

The managed FTD flash memory

Question 8

When troubleshooting FTD policy deployment, which THREE of the following are common reasons for a deployment to fail?

Accepted Answer

Insufficient memory on the FTD. Resource constraints, connectivity issues, and configuration conflicts are the most frequent causes of failed deployments.

Answer

Invalid license keys for third-party integrations

Answer

Incorrect browser version on the client

Question 9

An administrator notices that the Firepower Management Center (FMC) health monitor shows a critical warning regarding high disk utilization on the /var partition. Which built-in utility or action should the administrator perform first to safely free up disk space without disrupting critical database integrity?

Accepted Answer

Use the FMC GUI to delete unneeded packet captures and older correlation event logs or prune event data via System > Health > Monitor.. Clearing out rotated and old core dumps or troubleshooting via the system CLI using specialized scripts or purging old event data through the FMC GUI is standard. The df -h and du commands help locate space, but FMC provides specific maintenance tools to prune old events safely.

Answer

Reboot the FMC appliance into single-user mode and execute a complete filesystem format on the /var partition.

Answer

Navigate to System > Integration > Snort and delete all historical rule inspection data.

Answer

Run the 'rm -rf /var/sf/imagedb/*' command directly from the expert mode CLI to purge immediate image databases.

Question 10

An administrator wants to view system status and resource metrics directly on an FTD CLI without logging into the FMC. Which TWO commands are commonly used in the FTD diagnostic CLI or expert shell for this purpose? (Choose two)

Accepted Answer

top (in expert mode). On FTD, 'show resource usage' or 'show memory' in the diagnostic CLI and 'top' in the expert shell provide resource metrics.

Answer

show hardware firewall-stats

Answer

display cpu-memory

Answer

print system-health

Question 11

An administrator wants to configure automated email notifications from the FMC whenever a critical health monitor alert occurs on any managed device. Where should this be configured in the FMC GUI?

Accepted Answer

System > Health > Monitor > Alert Responses. Alert responses, SNMP traps, and email notifications for health monitoring are configured under System > Health > Monitor > Alert Responses.

Answer

Objects > Object Management > Alerting

Answer

Policies > Access Control > Logging

Answer

Devices > Device Management > Alerts

Question 12

An FTD device is dropping packets unexpectedly. An engineer runs a packet tracer via the FTD diagnostic CLI using 'system support diagnostic-cli' and enters the command: 'packet-tracer input inside tcp 192.168.1.50 12345 10.0.0.5 80'. The output shows a drop at the 'Access-Rule' phase with the action 'DROP'. What does this indicate?

Accepted Answer

An Access Control Policy rule matched the connection parameters and was configured with an action of Block or Block with reset.. A packet tracer drop at the Access-Rule phase with a drop action indicates that an Access Control Policy rule matched the traffic and explicitly dropped or rejected it.

Answer

The NAT translation table lacks a dynamic PAT port allocation for the source IP.

Answer

The FTD routing table does not have a valid route back to the source IP 192.168.1.50.

Answer

The SSL decryption policy failed to validate the server certificate for 10.0.0.5.

Question 13

An administrator is troubleshooting a memory leak on an FTD virtual appliance. The administrator wants to inspect real-time memory usage of individual system processes and identify top memory-consuming tasks. Which command should be run in the FTD expert mode shell?

Accepted Answer

top or ps aux --sort=-%mem. In standard Linux expert mode on FTD, standard process monitoring commands like 'top' or 'htop' (if installed) or specialized memory scripts are used. Specifically, 'top' or 'ps aux --sort=-%mem' displays active process memory consumption.

Answer

system support memory-leak-detector

Answer

show memory detail

Answer

pmtool memory-dump all

Question 14

An administrator is preparing to perform a system backup on the FMC. Which TWO data categories can be optionally included or excluded when generating the backup? (Choose two)

Accepted Answer

Cisco Smart Licensing registration tokens and certificates. FMC backup configuration allows selecting whether to include event data and historical data, as well as configuration files, health data, and certificates.

Answer

The underlying Linux kernel source code

Answer

Hardware BIOS firmware images

Answer

Raw packet capture (.pcap) files stored in temporary directories

Question 15

An FTD device managed by FMC is failing to download latest Snort Rule Updates (SRUs) and GeoDB updates automatically. The FMC has internet access via an HTTPS proxy. Where must the HTTPS proxy settings be configured on the FMC so that it can successfully reach Cisco update servers?

Accepted Answer

System > Configuration > Proxy. Proxy settings for FMC to communicate with Cisco cloud services and download updates are configured under System > Configuration > Proxy.

Answer

Objects > Object Management > Network Proxy

Answer

Devices > Device Management > Advanced > Proxy

Answer

Policies > Access Control > Updates > Proxy