300-710 SNCF Practice Test 2 — 30 Questions

Question 1

An administrator is planning an Active/Standby High Availability deployment for two Cisco Secure Firewall Threat Defense devices managed by FMC. Which THREE prerequisites must be satisfied before configuring the HA pair? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A dedicated link must be available to serve as the stateful failover control and health monitoring link.. HA deployment requires identical hardware models, matching major/minor FTD software versions, and dedicated physical or logical links for stateful failover control.

Answer

The secondary unit must have a higher management IP address than the primary unit.

Answer

Both firewalls must be configured in transparent mode; routed mode is unsupported in HA.

Question 2

An engineer is designing a high-availability architecture utilizing Equal-Cost Multi-Path (ECMP) routing with Cisco Secure Firewall Threat Defense units. Which THREE characteristics or limitations apply to ECMP on FTD? (Choose three)

Accepted Answer

ECMP distributes traffic across multiple equal-cost next-hop routes to optimize bandwidth utilization and path redundancy.. ECMP on FTD balances traffic across multiple paths, requires dynamic routing protocols like OSPF/BGP or static routes, and hashes flows based on packet headers.

Answer

ECMP is restricted exclusively to transparent firewall deployments and cannot be used in routed mode.

Answer

ECMP automatically synchronizes state tables between independent firewall appliances without requiring an HA control link.

Question 3

An administrator is planning the deployment of Cisco Secure Firewall Virtual in a public cloud environment (AWS or Azure). Which TWO deployment practices are recommended for ensuring high availability and performance? (Choose two)

Accepted Answer

Deploy multiple virtual network interfaces (NICs) to separate management, internal, and external traffic paths.. Cloud deployments require proper instance sizing, multiple NIC configurations for separating management and data planes, and cloud-native HA mechanisms.

Answer

Disable Smart Licensing to avoid cloud internet egress fees.

Answer

Use physical serial console cables attached to the hypervisor for initial configuration.

Answer

Rely solely on single-NIC deployments with VLAN subinterfaces trunking all cloud traffic.

Question 4

When using a Redundant Interface, what is the primary behavior during a link failure?

Accepted Answer

The standby link becomes active.. In a redundant interface pair, one link is active and the other is standby. If the active link fails, the FTD automatically switches to the standby link.

Answer

Both links remain active and load balance.

Answer

The FTD triggers a device-level failover.

Answer

Traffic is dropped until manual reset.

Question 5

When defining a NAT rule for an internal server, what happens if the 'DNS Rewrite' option is enabled?

Accepted Answer

The FTD modifies DNS responses. DNS Rewrite modifies the payload of DNS responses to ensure clients reach the correct internal server IP instead of the NAT public IP.

Answer

The FTD forces a DNS query to an external server

Answer

The FTD creates a new NAT object

Answer

The FTD blocks all DNS traffic

Question 6

What is the effect of changing the order of rules in an Access Control Policy?

Accepted Answer

Changes the evaluation sequence. Rules are evaluated top-down; changing the order can cause a rule to be shadowed or never matched.

Answer

No effect

Answer

Resets the device

Answer

Updates the device firmware

Question 7

An FTD device is deployed behind a service provider router that performs NAT, meaning the external IP address assigned to the FTD's outside interface changes dynamically via DHCP. How should a Manual NAT rule be configured to handle outbound traffic referencing this dynamic outside IP?

Accepted Answer

Configure Dynamic PAT using the Outside Interface as the translated address.. When the outside interface IP is dynamic, Manual NAT can use the interface itself as the translated address (Interface PAT).

Answer

Configure Auto NAT with a translated network object set to dynamic.

Answer

Use a static IP address object matching the expected DHCP lease.

Answer

Use Identity NAT with dynamic DHCP options.

Question 8

You are configuring a NAT rule on an FTD device managed by FMC. You need to translate the source IP of internal hosts to a specific public IP address when they access the internet. Which NAT type must be selected in the FMC NAT Rule editor?

Accepted Answer

Dynamic NAT. Dynamic NAT allows mapping a range of internal addresses to a single or range of public addresses, typically used for internet access.

Answer

Identity NAT

Answer

Static NAT

Answer

Policy NAT

Question 9

When creating a network object in FMC, which field allows you to define a group of IP addresses using CIDR notation?

Accepted Answer

Network. The Network object type allows single hosts, ranges, or subnets using CIDR notation.

Answer

Host

Answer

Range

Answer

FQDN

Question 10

If you need to block a specific file type (e.g., .exe) from being downloaded, which feature must you enable in the Access Control Rule?

Accepted Answer

File Policy. File policies are associated with Access Control rules to inspect and block files.

Answer

SSL Policy

Answer

IPS Policy

Answer

QoS Policy

Question 11

What occurs when an 'Interactive Block' action is used in an Access Control rule?

Accepted Answer

The user receives a notification page. The user is shown a page explaining why the traffic was blocked and given an option to proceed.

Answer

The traffic is dropped

Answer

The traffic is automatically allowed

Answer

The rule is ignored

Question 12

An enterprise network design incorporates Equal-Cost Multi-Path (ECMP) routing across two Cisco Secure Firewall Threat Defense units functioning independently in routed mode. What is the primary benefit of enabling ECMP on the firewalls?

Accepted Answer

It enables the firewall to balance outbound traffic across multiple next-hop gateways using multiple equal-cost routes.. ECMP allows the firewall to install multiple equal-cost paths to the same destination in its routing table, distributing traffic across multiple next-hop routers for load balancing and redundancy.

Answer

It allows passive NGIPS interfaces to share inspection load without SPAN replication.

Answer

It pools the CPU and memory resources of both firewalls into a single logical cluster.

Answer

It synchronizes connection state tables across both independent firewalls for zero-loss failover.

Question 13

An organization is planning to deploy a Cisco Secure Firewall Threat Defense Cluster using three Secure Firewall 9300 security modules to handle a massive aggregate throughput requirement. Which consideration is critical when designing this cluster?

Accepted Answer

All security modules in the cluster must be identical in model, memory, and interface module composition.. In a firewall cluster, one unit is automatically elected as the control node, while the others act as data nodes. All units share a common configuration and distributed connection table, but session handling is managed across the cluster nodes via a central cluster control link.

Answer

Cluster nodes can be spread across different geographical data centers over high-latency WAN links.

Answer

The control node processes all data traffic while data nodes only handle control plane heartbeats.

Answer

Clustering requires transparent mode; routed mode is unsupported on clustered Secure Firewall platforms.

Question 14

An Identity Policy is configured on the FMC to authenticate users connecting through the FTD. The administrator wants to use Active Directory as the identity source. Which mechanism must be configured to map user IP addresses to usernames without requiring explicit web authentication?

Accepted Answer

Passive Authentication via AD Agent or ISE. Passive authentication utilizes the Cisco User Agent or Firepower Identity Services Engine (ISE) / AD agent to map IP addresses to usernames transparently.

Answer

Captive Portal

Answer

Local User Database

Answer

RADIUS Server Authentication

Question 15

An administrator needs to define network objects in the FMC Object Management menu. Which THREE object types are natively supported for network definition? (Choose three)

Accepted Answer

Host Object. FMC supports Host, Range, Network (subnet), FQDN, and Network Group objects for network definitions.

Answer

Port Object

Answer

Application Filter Object

Question 16

An administrator needs to ensure that internal users can access the internet using a public IP while hiding their private address. Which NAT rule type should be configured on the FMC?

Accepted Answer

Dynamic NAT. Dynamic NAT or PAT is used to map internal private addresses to public addresses for outbound internet traffic.

Answer

Policy NAT

Answer

Identity NAT

Answer

Static NAT

Question 17

You are troubleshooting a connectivity issue. The traffic is being dropped by a Prefilter rule. What is the characteristic of traffic handled by a Prefilter policy?

Accepted Answer

It bypasses the Snort engine. Prefilter policies provide a fast path to inspect traffic without the overhead of deep packet inspection.

Answer

It performs full IPS inspection

Answer

It operates at the L7 layer

Answer

It only applies to encrypted traffic

Question 18

Which TWO types of objects can be created in the FMC Object Manager?

Accepted Answer

Network. Network and Port objects are standard types in FMC.

Answer

License

Answer

System Health

Answer

Dashboard

Question 19

What is the result of using a 'Security Group' object in an Access Control rule?

Accepted Answer

Matches based on SGT. Security Group objects allow policy matching based on Cisco TrustSec tags.

Answer

Matches based on IP address

Answer

Matches based on VLAN

Answer

Matches based on Interface

Question 20

An administrator configures QoS on an FTD interface to prioritize VoIP traffic. Which traffic matching mechanism within the QoS policy allows the FTD to identify VoIP traffic (such as SIP or RTP) based on Layer 7 application inspection?

Accepted Answer

Access Control Rules with Application Filters. QoS policies can match traffic based on Access Control lists or Application Filters to apply rate shaping or priority queuing.

Answer

Prefilter Policy Bandwidth Limits

Answer

Intrusion Policy Rule Actions

Answer

Platform Settings QoS Class Maps