300-710 SNCF Practice Test 5 — 10 Questions

Question 1

What occurs when an 'Interactive Block' action is used in an Access Control rule?

Accepted Answer

The user receives a notification page. The user is shown a page explaining why the traffic was blocked and given an option to proceed.

Answer

The traffic is dropped

Answer

The traffic is automatically allowed

Answer

The rule is ignored

Question 2

An enterprise network design incorporates Equal-Cost Multi-Path (ECMP) routing across two Cisco Secure Firewall Threat Defense units functioning independently in routed mode. What is the primary benefit of enabling ECMP on the firewalls?

Accepted Answer

It enables the firewall to balance outbound traffic across multiple next-hop gateways using multiple equal-cost routes.. ECMP allows the firewall to install multiple equal-cost paths to the same destination in its routing table, distributing traffic across multiple next-hop routers for load balancing and redundancy.

Answer

It allows passive NGIPS interfaces to share inspection load without SPAN replication.

Answer

It pools the CPU and memory resources of both firewalls into a single logical cluster.

Answer

It synchronizes connection state tables across both independent firewalls for zero-loss failover.

Question 3

An organization is planning to deploy a Cisco Secure Firewall Threat Defense Cluster using three Secure Firewall 9300 security modules to handle a massive aggregate throughput requirement. Which consideration is critical when designing this cluster?

Accepted Answer

All security modules in the cluster must be identical in model, memory, and interface module composition.. In a firewall cluster, one unit is automatically elected as the control node, while the others act as data nodes. All units share a common configuration and distributed connection table, but session handling is managed across the cluster nodes via a central cluster control link.

Answer

Cluster nodes can be spread across different geographical data centers over high-latency WAN links.

Answer

The control node processes all data traffic while data nodes only handle control plane heartbeats.

Answer

Clustering requires transparent mode; routed mode is unsupported on clustered Secure Firewall platforms.

Question 4

An Identity Policy is configured on the FMC to authenticate users connecting through the FTD. The administrator wants to use Active Directory as the identity source. Which mechanism must be configured to map user IP addresses to usernames without requiring explicit web authentication?

Accepted Answer

Passive Authentication via AD Agent or ISE. Passive authentication utilizes the Cisco User Agent or Firepower Identity Services Engine (ISE) / AD agent to map IP addresses to usernames transparently.

Answer

Captive Portal

Answer

Local User Database

Answer

RADIUS Server Authentication

Question 5

An administrator needs to define network objects in the FMC Object Management menu. Which THREE object types are natively supported for network definition? (Choose three)

Accepted Answer

Host Object. FMC supports Host, Range, Network (subnet), FQDN, and Network Group objects for network definitions.

Answer

Port Object

Answer

Application Filter Object

Question 6

An administrator needs to ensure that internal users can access the internet using a public IP while hiding their private address. Which NAT rule type should be configured on the FMC?

Accepted Answer

Dynamic NAT. Dynamic NAT or PAT is used to map internal private addresses to public addresses for outbound internet traffic.

Answer

Policy NAT

Answer

Identity NAT

Answer

Static NAT

Question 7

You are troubleshooting a connectivity issue. The traffic is being dropped by a Prefilter rule. What is the characteristic of traffic handled by a Prefilter policy?

Accepted Answer

It bypasses the Snort engine. Prefilter policies provide a fast path to inspect traffic without the overhead of deep packet inspection.

Answer

It performs full IPS inspection

Answer

It operates at the L7 layer

Answer

It only applies to encrypted traffic

Question 8

Which TWO types of objects can be created in the FMC Object Manager?

Accepted Answer

Network. Network and Port objects are standard types in FMC.

Answer

License

Answer

System Health

Answer

Dashboard

Question 9

What is the result of using a 'Security Group' object in an Access Control rule?

Accepted Answer

Matches based on SGT. Security Group objects allow policy matching based on Cisco TrustSec tags.

Answer

Matches based on IP address

Answer

Matches based on VLAN

Answer

Matches based on Interface

Question 10

An administrator configures QoS on an FTD interface to prioritize VoIP traffic. Which traffic matching mechanism within the QoS policy allows the FTD to identify VoIP traffic (such as SIP or RTP) based on Layer 7 application inspection?

Accepted Answer

Access Control Rules with Application Filters. QoS policies can match traffic based on Access Control lists or Application Filters to apply rate shaping or priority queuing.

Answer

Prefilter Policy Bandwidth Limits

Answer

Intrusion Policy Rule Actions

Answer

Platform Settings QoS Class Maps