300-710 SNCF Practice Test 2 — 30 Questions

Question 1

When deploying an FTD in a virtual environment, what is the primary role of the 'GigabitEthernet0/0' interface by default?

Accepted Answer

Management interface.. In most virtual FTD deployments, the first interface is typically reserved for the management or diagnostic connectivity.

Answer

Failover link.

Answer

Data transit.

Answer

State link.

Question 2

In the context of FTD, what does 'FMC' stand for?

Accepted Answer

Firepower Management Center. FMC is the central management platform for FTD devices.

Answer

Firewall Management Console

Answer

Firewall Monitoring Center

Answer

Firepower Managed Cloud

Question 3

An engineer is troubleshooting a stateful failover issue in a Cisco Secure Firewall Threat Defense Active/Standby high availability pair. The firewall units are passing data traffic, but failover state synchronization fails. Which dedicated interface must be verified for correct physical connectivity and configuration?

Accepted Answer

The Failover and State Link. In a Cisco Secure Firewall Threat Defense Active/Standby high availability pair, stateful failover requires a dedicated Failover and State Link to synchronize state information (such as connection tables and VPN state) between the units. If data traffic passes but failover state synchronization fails, this dedicated link must be verified for physical connectivity and correct configuration.

Answer

The Cluster Control Link (CCL)

Answer

The Management Interface (eth0)

Answer

The Diagnostic Interface

Question 4

Which TWO protocols or mechanisms are used to integrate Cisco Identity Services Engine (ISE) with Cisco Secure Firewall Threat Defense? (Choose two)

Accepted Answer

SXP. Cisco ISE integrates with Secure Firewall using pxGrid (for identity/context sharing) and SXP (for SGT tag and IP mapping propagation).

Answer

NetFlow v5

Answer

LDAP direct bind

Answer

SNMPv1

Question 5

Which THREE steps are part of a standard FTD upgrade workflow managed via the FMC?

Accepted Answer

Upload the upgrade package to the FMC. Option C is correct because the standard FTD upgrade workflow managed through the FMC begins by uploading the FTD software upgrade package (image) to the FMC, which then stages it for deployment to managed devices. Option E is correct because after the package is available, the administrator selects the target device(s) in the FMC's Upgrade management page to initiate and schedule the upgrade. Option D is correct because the workflow includes running a readiness/health check on the device and reviewing and approving the resulting health check report before proceeding with the actual upgrade. Options A and B are incorrect: manually deleting all existing access rules is not a step in the upgrade workflow and would disrupt policy, and running a factory reset on the FTD is not part of a standard upgrade—it would wipe the configuration rather than upgrade the software.

Answer

Manually delete all existing access rules

Answer

Run a factory reset on the FTD

Question 6

You are deploying a Cisco Secure Firewall Threat Defense in an existing core network as an out-of-band intrusion prevention system. Which NGIPS deployment mode should you configure to ensure the firewall performs deep packet inspection and generates alerts without dropping any production traffic in the event of a device failure or high load?

Accepted Answer

Passive deployment mode using a SPAN or tap source. Passive deployment mode using a SPAN or tap source copies traffic to the Threat Defense without placing it inline in the forwarding path, so deep packet inspection and alerts occur without any risk of dropping production traffic. Even if the device fails or is overloaded, the production network is unaffected because traffic never flows through the firewall. This matches the requirement for out-of-band IPS with zero traffic impact.

Answer

Transparent mode with inline bypass enabled

Answer

Inline deployment mode with fail-open enabled

Answer

Routed mode with asymmetric routing tolerance

Question 7

An engineer is configuring an Identity Policy in FMC to enforce user-based access control. Active Directory integration has been established via User Agent, but the engineer notices that some users authenticated via remote access VPN are not being resolved to their IP addresses. Which feature must be integrated into the identity configuration to capture IP-to-user mappings for remote access VPN users?

Accepted Answer

Cisco Identity Services Engine (ISE) via pxGrid or RADIUS Accounting. Remote access VPN users are authenticated by the VPN headend (e.g., Cisco ASA/FTD or ISE), and their IP-to-user mappings are not learned by the User Agent, which relies on Active Directory security event log parsing on domain controllers. To capture these mappings, FMC must integrate with Cisco ISE via pxGrid or receive RADIUS Accounting records, which provide the user-to-IP binding at the time of VPN session establishment. This allows the Identity Policy to resolve VPN users to their assigned IP addresses.

Answer

FMC Captive Portal

Answer

Terminal Services Agent (TS Agent)

Answer

SNMP polling of the DHCP server

Question 8

When deploying a Cisco Secure Firewall Threat Defense device, what is the purpose of configuring Security Zones?

Accepted Answer

To logically group one or more interfaces together for simplified Access Control Policy application.. Security Zones on FTD are used to logically group one or more interfaces together so that Access Control Policies can be applied to the zone rather than individual interfaces. This simplifies policy management and allows consistent enforcement across multiple interfaces that share the same security posture.

Answer

To establish High Availability stateful synchronization between primary and secondary nodes.

Answer

To assign VLAN IDs to physical switch ports connected to the firewall.

Answer

To encrypt traffic passing between interfaces belonging to different zones using IPsec.

Question 9

When you have multiple overlapping NAT rules, which rule is applied?

Accepted Answer

The first matching rule. The FTD matches NAT rules using a top-down approach, similar to Access Control rules.

Answer

The rule that matches the interface

Answer

The rule with the lowest priority

Answer

The most specific rule

Question 10

In an FTD cluster, what happens if the cluster control link fails?

Accepted Answer

The cluster nodes may disable themselves to avoid split-brain.. If the control link fails, the cluster members cannot synchronize state or status, typically leading to a split-brain scenario or the standby nodes disabling themselves to prevent inconsistency.

Answer

The FMC takes over the cluster.

Answer

The cluster continues to operate normally.

Answer

The entire cluster reboots.

Question 11

You are deploying a Cisco Secure Firewall Threat Defense in transparent mode. How are frames forwarded between the internal and external interfaces of the firewall?

Accepted Answer

By bridging frames at Layer 2 based on destination MAC addresses within a configured Bridge Group.. In transparent mode, the FTD forwards frames at Layer 2 by bridging based on destination MAC addresses within a configured Bridge Group. The firewall does not perform IP route lookups or decrement TTL; it acts like a Layer 2 switch with security inspection. This allows the firewall to be inserted into an existing network without changing IP addressing.

Answer

By encapsulating all packets inside GRE tunnels between the ingress and egress ports.

Answer

By translating all private IP addresses to public IP addresses using NAT overload.

Answer

By performing IP route lookups and decrementing the TTL on every packet.

Question 12

A network engineer needs to configure Auto NAT on a Firepower Threat Defense device managed by FMC to translate internal subnet 10.10.10.0/24 to a single public IP address 203.0.113.50. Which translation type should be selected?

Accepted Answer

Dynamic PAT (Port Address Translation). Dynamic PAT (Port Address Translation) is the correct choice because it translates multiple internal IP addresses to a single public IP address using unique source ports. This allows the entire 10.10.10.0/24 subnet to share one public IP, which is the typical use case for PAT. Static NAT would require a one-to-one mapping, and Dynamic NAT would require a pool of public IPs.

Answer

Static NAT

Answer

Static Identity NAT

Answer

Dynamic NAT

Question 13

An administrator is troubleshooting an FTD device that is failing to register with FMC. The FTD has been configured with the correct FMC IP address, registration key, and NAT ID. Which additional setting must be verified on the FTD to allow successful registration?

Accepted Answer

The FTD must have a default route to reach the FMC.. The FTD requires a route to reach FMC. If FMC is on a different network, a default gateway or static route must be configured on the management interface. Without it, registration packets cannot reach FMC. DNS, time zone, and NAT ID are either already addressed or not blocking registration in this scenario.

Answer

The FTD must be able to resolve the FMC's hostname via DNS.

Answer

The FTD must be configured with the same NAT ID as the FMC.

Answer

The FTD must have the same time zone as the FMC.

Question 14

An administrator needs to create a variable set to define specific port or network variables used within Intrusion Rules. Where are variable sets managed in the FMC?

Accepted Answer

Objects > Object Management > Variable Sets. In FMC, variable sets used by Intrusion Rules are managed under Objects > Object Management > Variable Sets. This is where administrators define variables such as $HOME_NET, $EXTERNAL_NET, and port variables that Snort rules reference. The variable sets are then applied to the Intrusion Policy.

Answer

Devices > Device Management > Variables

Answer

System > Localized Variables

Answer

Policies > Access Control > Variables

Question 15

A security requirement mandates that QoS be applied to limit bandwidth for guest users. Where is QoS configured on an FMC-managed FTD?

Accepted Answer

In a separate QoS Policy. QoS policies are defined as a separate policy type in the FMC and then applied to the Access Control Policy.

Answer

Within the Access Control Policy rules

Answer

Under the Platform Settings

Answer

In the Prefilter Policy

Question 16

An administrator is implementing an SSL Decryption Policy on a Cisco Firepower Threat Defense device managed by FMC. The policy must decrypt outbound HTTPS traffic to inspect for malware, but certain financial domains must be excluded from decryption to comply with privacy regulations. Which rule action should be configured for these specific financial domains in the SSL Decryption Policy?

Accepted Answer

Do Not Decrypt. To prevent inspection and decryption of sensitive traffic while allowing it to pass through the firewall, the Do Not Decrypt action is used in the SSL Decryption Policy.

Answer

Decrypt - Known Key

Answer

Block

Answer

Decrypt - Resign

Question 17

You are analyzing connection events and notice a block action. Which field in the connection event details best explains why the connection was dropped by the policy?

Accepted Answer

Reason. The 'Reason' field in a connection event explicitly states why the connection was dropped, such as 'Blocked by Access Control Rule' or 'Drop due to Snort rule'. It is the most direct indicator of the policy enforcement cause. Other fields like Policy Enforcement or Connection Policy may show related metadata but do not provide the specific drop reason.

Answer

Policy Enforcement

Answer

Connection Policy

Answer

Traffic Log

Answer

Drop Description

Question 18

An administrator is planning an upgrade of an FMC managing multiple FTD devices across various software versions. Which THREE factors must be validated according to Cisco compatibility guidelines before proceeding? (Choose three)

Accepted Answer

Supported upgrade paths (e.g., whether a direct jump from v6.4 to v7.4 is supported or requires an intermediate upgrade).. Option A is correct because Cisco upgrade planning requires verifying supported upgrade paths; for example, a direct jump from v6.4 to v7.4 may not be supported and may require an intermediate release such as v7.0 or v7.2 before reaching v7.4. Option B is correct because the upgrade process must have sufficient free space on FMC and FTD partitions, including /var and /root, so that downloaded packages and temporary files can be unpacked and staged without filling the filesystem. Option E is correct because the Cisco Firepower Compatibility Guide must be consulted to confirm that the target FMC software version interoperates with and supports the FTD versions currently managed by that FMC. Option C is not required because NTP stratum 1 is not a Cisco Firepower upgrade prerequisite; time synchronization matters, but the local NTP server does not have to be stratum 1. Option D is not required because the serial numbers of external power supplies are irrelevant to software compatibility and upgrade validation.

Answer

The local NTP server stratum level must be exactly stratum 1.

Answer

The serial number of the external power supplies attached to the rack mount chassis.

Question 19

An administrator is configuring Cisco SecureX threat intelligence integration with Cisco Secure Firewall Threat Defense via the FMC. Which TWO actions can be performed directly through the SecureX integration? (Choose two)

Accepted Answer

Automatic synchronization of dynamic Indicators of Compromise (IoCs) to block malicious traffic.. SecureX integration allows sharing indicators of compromise (IoCs) for automated blocking/alerting and pivoting to Threat Response for investigation.

Answer

Real-time firmware updates pushed from the SecureX cloud console to the managed firewalls.

Answer

Replacement of local FMC policy administration with cloud-only RBAC management.

Answer

Direct deployment of Snort 3 custom intrusion rules compiled locally on the SecureX cloud platform.

Question 20

Which THREE criteria can be used to match traffic within an Access Control rule on the FMC? (Choose three)

Accepted Answer

URL Categories. In Cisco FMC, an Access Control rule can match traffic using criteria such as URL Categories (C), which let you filter based on reputation or category of requested web destinations; Applications (D), which identify traffic by application or application group via Snort/App-ID; and Security Zones (E), which match the ingress/egress interfaces assigned to zones. These three are all valid match conditions on the rule's main criteria tabs. Intrusion Policy Signatures (A) are not a match criterion — an Intrusion Policy is an inspection action applied to traffic that already matched the rule. Device Platform Settings (B) are also not a match condition; platform settings are applied via a Platform Settings policy to managed devices, not used to select traffic in an access rule.

Answer

Intrusion Policy Signatures

Answer

Device Platform Settings