300-710 SNCF Practice Test 33 — 15 Questions

Question 1

An administrator is analyzing a troubleshooting scenario involving Snort inspection crashes on an FTD device. Which THREE locations or tools should the administrator check to diagnose why the Snort process restarted or crashed? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Examine /var/log/messages and system log files for Out-Of-Memory (OOM) killer events targeting Snort.. Snort crashes leave traces in /var/log/messages, core dump directories (/var/crash or specific core locations), and Snort specific log files in /var/log/snort/.

Answer

Check the Cisco Smart Software Manager portal for license expiration alerts.

Answer

Inspect the DHCP lease logs in /var/log/dhcpd.log.

Question 2

An FTD high availability pair experiences a failover due to a hardware failure on the active unit. After the standby unit takes over, the administrator notices that existing TCP connections were dropped and did not state-fully fail over. What configuration setting should the administrator verify?

Accepted Answer

Verify that stateful failover is enabled and the failover link interface is operational and passing state packets.. Stateful failover in FTD requires properly configured State MAC and Failover interfaces. If stateful failover is not enabled or if the failover link is down, long-lived or active TCP states are not synchronized to the standby unit.

Answer

Ensure that dynamic routing protocols are configured with graceful restart.

Answer

Verify that clustering is enabled instead of high availability.

Answer

Check that adaptive inspection is disabled in the Access Control Policy.

Question 3

When troubleshooting an issue where an FTD interface is in a 'down' state, which command helps verify if there is a physical layer issue or an administrative shutdown?

Accepted Answer

show interface. The 'show interface' command displays both the physical status and the administrative status of the interface.

Answer

show link status

Answer

show hardware interface

Answer

show run interface

Answer

show status

Question 4

During an upgrade of an FTD device managed by FMC, the pre-checks fail because of insufficient disk space in the target upgrade partition. Which CLI command sequence should the administrator use to safely clean up previous upgrade installation files and temporary packages?

Accepted Answer

system support installer cleanup. FTD upgrade installation packages are stored in specific directories. The command 'system support installer cleanup' is the built-in utility designed to safely remove leftover upgrade files and temporary install artifacts.

Answer

system support upgrade-purge

Answer

expert mode followed by apt-get clean

Answer

rm -rf /var/sf/upgrade/*

Question 5

An administrator needs to determine if the FMC has enough disk space to hold a new software upgrade image. Which menu should they check?

Accepted Answer

System > Health > Monitor. The System Information page provides current disk utilization metrics for the FMC appliance.

Answer

Devices > Device Management > System

Answer

Policies > Settings

Answer

System > Configuration > Disk

Answer

System > Updates > Disk Space

Question 6

Which tool in the FMC allows you to view the real-time flow of packets being processed by the Snort engine for troubleshooting purposes?

Accepted Answer

Packet Tracer. Packet Tracer is the primary GUI tool for simulating and tracing traffic through the FTD inspection pipeline.

Answer

Event Viewer

Answer

Health Monitor

Answer

Connection Events

Answer

Traffic Logger

Question 7

An engineer needs to troubleshoot intermittent packet loss between an FTD inside interface and a destination server. The engineer runs the 'packet-tracer' command on the FTD CLI. What limitation must the engineer keep in mind regarding packet-tracer?

Accepted Answer

Packet-tracer simulates packet processing through the firewall and Snort engine without transmitting physical packets.. Packet-tracer simulates packet processing through the firewall engine and Snort, but it does not actually transmit a real packet onto the physical wire, meaning it is a simulation tool.

Answer

Packet-tracer actually transmits physical packets out of the egress interface to test real network latency.

Answer

Packet-tracer bypasses the Snort inspection engine entirely.

Answer

Packet-tracer only works for encrypted IPsec VPN traffic.

Question 8

You are restoring an FMC backup to a new appliance. Which of the following conditions must be met for a successful restore?

Accepted Answer

The target FMC must be running the exact same version as the backup.. The FMC software version on the backup and the target system must match to ensure database schema compatibility.

Answer

The target FMC must be a different model.

Answer

The target FMC must have a lower software version.

Answer

You must re-license the unit before the restore starts.

Answer

All FTD devices must be disconnected before restore.

Question 9

An administrator is preparing to troubleshoot a complex routing and NAT issue on an FTD device using packet tracer. Which TWO statements regarding the FTD packet tracer tool are correct? (Choose two.)

Accepted Answer

Packet tracer can be executed from both the FTD CLI and the FMC GUI under Device > Packet Trace.. Packet tracer simulates traffic flow through the FTD, allowing administrators to test policies, NAT, and routing without sending live packets, and can be executed via both FMC and FTD CLI.

Answer

Packet tracer captures live packets traversing the wire in real-time.

Answer

Packet tracer requires Smart Licensing to be in an out-of-compliance state to function.

Answer

Packet tracer permanently alters the firewall state table to allow future return traffic.

Question 10

Which action must be taken on the FTD CLI after a manual configuration change is made, if you want to ensure the FMC does not overwrite it?

Accepted Answer

Manual changes should be avoided; perform all changes in FMC.. Manual CLI changes are generally discouraged because the FMC will overwrite them during the next deployment. The best practice is to always perform changes via the FMC.

Answer

Set the device to 'Read-Only' mode.

Answer

Run 'fmc update lock'.

Answer

Run 'write memory' to lock the configuration.

Answer

Run 'commit configuration' to save the state.

Question 11

Which THREE commands are valid for gathering information about the FTD's current status and health from the CLI?

Accepted Answer

show interface ip brief. These commands provide insight into hardware, processes, and network state.

Answer

show network health

Answer

show snort traffic

Question 12

An administrator needs to restore an FMC configuration backup onto a replacement hardware appliance. Which of the following conditions must be met for the backup restoration to succeed successfully?

Accepted Answer

The target FMC must run the exact same software version and patch level as the source appliance.. FMC backups require the target appliance to run the exact same version of software and have matching or compatible network configurations (like license entitlements and serial structures) to ensure a clean restoration.

Answer

Smart Licensing must be disabled on the target appliance prior to importing the backup.

Answer

The target FMC must be running a newer major software version than the backup file.

Answer

The target appliance hardware model must be different to allow schema remapping.

Question 13

Which THREE items are included in an FMC backup archive?

Accepted Answer

Device configuration policies. An FMC backup typically includes the system configuration, policies, and the database, but excludes event data to keep file sizes manageable.

Answer

Historical connection event logs

Answer

Raw traffic payload data

Question 14

An administrator is troubleshooting high memory utilization on an FMC appliance. Which TWO actions or tools can be used to identify resource-heavy processes or clean up storage? (Choose two)

Accepted Answer

Navigate to Analysis > Health > Monitor to review historical memory utilization graphs and identify anomalies.. On FMC, administrators can check process resource utilization using Linux top/ps via expert mode or review the Health Monitor. Cleaning up disk space and checking logs are standard troubleshooting steps.

Answer

Run 'system support memory-dump' from the FMC GUI.

Answer

Restart the Snort inspection engine on the FMC.

Answer

Execute 'clear memory cache' in the FMC CLI.

Question 15

An administrator notices that the FMC Health Monitor shows a 'Critical' alert for the Snort process utilization on an FTD device. What is the most appropriate first-line troubleshooting step from the FMC GUI or FTD CLI to investigate the cause of high Snort CPU usage?

Accepted Answer

Check the Snort performance statistics and rule update status via Devices > Device Management > Advanced > Snort Statistics.. Analyzing inspection performance metrics, packet rates, and specific traffic patterns via FMC or running 'show perf-stat' or 'top' on the FTD CLI helps identify whether specific rules or traffic spikes are causing Snort queuing.

Answer

Restart the database process via 'pmtool restartbyname mysqld'.

Answer

Change the Access Control policy action from 'Inspect' to 'Block' globally without logging.

Answer

Delete all custom intrusion rules immediately to clear the buffer.