300-710 SNCF Practice Questions 2 — 50 Questions

Question 1

An engineer needs to troubleshoot high CPU usage on an FTD device caused by Snort. Which THREE actions or features can be adjusted or implemented to mitigate Snort CPU load? (Choose three)

Accepted Answer

Configure SSL Decryption policies to bypass trusted internal traffic or known safe applications.. Option B is correct because SSL Decryption is one of the most CPU-intensive operations Snort performs; bypassing trusted internal traffic or known safe applications in the SSL policy prevents Snort from decrypting and inspecting that traffic, directly reducing CPU load. Option D is correct because the Intrusion Policy determines which Snort rules are evaluated, and disabling rules not applicable to the network environment reduces the number of signatures Snort must process per packet, lowering CPU utilization. Option E is correct because Access Control rules are evaluated top-down, and placing frequently matched allow rules higher with fewer inspection requirements (e.g., no intrusion or file inspection) lets traffic be allowed early with minimal Snort processing, reducing overall CPU demand. Option A is incorrect because converting physical interfaces to switchports without IP addresses is a Layer 2 deployment consideration and does not by itself reduce Snort CPU load. Option C is incorrect because disabling the FTD kernel and running Snort in standalone user-space loopback mode is not a supported or valid FTD configuration and would not mitigate CPU usage.

Answer

Convert all physical interfaces into switchports without IP addresses.

Answer

Disable the FTD kernel entirely and run Snort in standalone user-space loopback mode.

Question 2

An engineer has modified several access control rules and object groups on the FMC. Before deploying these changes to the FTD, the engineer wants to review all pending changes to ensure no unauthorized modifications are included. Where in the FMC GUI should the engineer go to view pending deployment changes?

Accepted Answer

Deploy > Deployment (or clicking the Deploy icon in the top header). To view pending deployment changes, the engineer should go to Deploy > Deployment (or click the Deploy icon in the top header). This shows a list of all pending changes across policies and objects, allowing review before deployment.

Answer

Objects > Object Management > Diff Viewer

Answer

Analysis > Audit > Pending

Answer

System > Updates > Pending Changes

Question 3

Which TWO benefits are gained by integrating Cisco Secure Firewall with Cisco Identity Services Engine (ISE) using TrustSec SGTs? (Choose two)

Accepted Answer

Propagation of security tags across network boundaries via SXP for consistent enforcement. Option A is correct because integrating Cisco Secure Firewall with ISE via TrustSec uses SXP (SGT Exchange Protocol) to propagate Security Group Tags (SGTs) across network boundaries, allowing consistent policy enforcement even where inline tagging is not supported. Option B is correct because ISE supplies identity and group information (user roles, AD group membership) that maps to SGTs, so firewall rules can be written against security group tags instead of volatile IP addresses. Option C is incorrect because the firewall does not send quarantine commands directly to Active Directory; remediation is typically handled by ISE/pxGrid and endpoint tools, not AD. Option D is incorrect because TrustSec is a segmentation/policy framework and does not replace routing protocols such as OSPF or BGP. Option E is incorrect because access control rules are still required on the firewall; SGTs enrich and simplify them rather than eliminating them.

Answer

Automatic remediation of endpoint malware infections via direct quarantine commands sent from the firewall to Active Directory

Answer

Replacement of traditional routing protocols with TrustSec matrix routing

Answer

Elimination of the need for access control rules on the firewall

Question 4

You are troubleshooting high availability. The units are connected, but the failover link shows as 'Down'. What is the most likely cause?

Accepted Answer

Mismatched failover link configuration or physical layer issues.. The failover link must be a direct cable connection or a dedicated VLAN. Mismatched cable types or misconfigured link settings are common causes for the link to remain down.

Answer

The primary unit is in routed mode.

Answer

The standby unit has an expired license.

Answer

Mismatched IP addresses on the data interface.

Question 5

You are deploying a Cisco FTD High Availability pair. During the synchronization process, what occurs when the standby unit fails to receive three consecutive heartbeat hellos from the primary?

Accepted Answer

The standby unit transitions to the Active state.. In FTD HA, three consecutive missed hellos trigger a state change, and the standby unit initiates a failover because it assumes the primary has failed.

Answer

The standby unit initiates a full configuration overwrite from the secondary flash.

Answer

The standby unit enters a suspended state to wait for administrative intervention.

Answer

The primary unit is rebooted automatically by the standby unit.

Question 6

A security engineer is creating an Access Control Policy (ACP) in FMC. The policy must block all traffic matching specific URL categories while allowing standard web browsing. However, the administrator wants users to receive a warning page before continuing to pages categorized as "Potentially Damaging Content" rather than a hard block. Which action should the engineer assign to the URL category in the ACP Rules tab?

Accepted Answer

Interactive Block. In an FMC Access Control Policy, the 'Interactive Block' action for a URL category presents users with a warning page that they can acknowledge to continue to the site. This matches the requirement to warn users before proceeding to 'Potentially Damaging Content' pages rather than hard-blocking them. The other actions either block outright, allow silently, or only log.

Answer

Block

Answer

Allow

Answer

Monitor

Question 7

An administrator integrates Cisco Secure Firewall with Cisco SecureX. Which TWO components or settings are required on the FMC to establish and maintain this cloud integration? (Choose two)

Accepted Answer

Valid API integration keys / credentials generated from the Cisco SecureX cloud management console and pasted into the FMC.. Option A is correct because integrating the FMC with Cisco SecureX requires generating API credentials (client ID and secret / API key) in the SecureX cloud portal and entering them on the FMC under the SecureX/Cloud Services registration, which authenticates the FMC to the cloud service. Option E is correct because the FMC management interface must reach the SecureX cloud endpoints over outbound HTTPS on TCP 443 for registration, token exchange, and ongoing telemetry/health updates. Option B is incorrect: eStreamer (TCP 8302) is a legacy event-streaming service used by other integrations, not the mechanism SecureX uses to poll the FMC. Option C is incorrect because SecureX integration uses REST APIs over HTTPS, not a direct SSH tunnel to the FTD data plane. Option D is incorrect because pxGrid is an ISE-based identity sharing framework and is not required on each managed FTD for SecureX cloud integration.

Answer

An active eStreamer daemon listening on TCP port 8302 for SecureX incoming connection polls.

Answer

A direct SSH tunnel between the FTD data plane and the SecureX cloud.

Answer

An active pxGrid session client on every managed FTD device.

Question 8

An administrator wants to create a Prefilter policy to fast-path (bypass Snort inspection for) a trusted backup stream between two data centers. Which action type should be selected in the Prefilter rule?

Accepted Answer

FastPath. In a Prefilter policy, the FastPath action bypasses Snort inspection for trusted traffic, allowing it to be forwarded without deep packet inspection. This is ideal for a trusted backup stream between data centers because it reduces latency and processing overhead. The FastPath action is specifically designed to fast-track traffic that does not require security inspection.

Answer

Monitor

Answer

Block

Answer

Inspect

Answer

Trust

Question 9

An administrator wants to group multiple existing port objects (e.g., TCP 80, TCP 443, TCP 8080) into a single object for use in Access Control Policy rules. Which object container should be created?

Accepted Answer

Port Group Object. A Port Group Object is a container that groups multiple port objects (e.g., TCP 80, 443, 8080) into a single reusable object. This allows administrators to reference the group in Access Control rules instead of listing each port individually, simplifying policy management. Port Group Objects are specifically designed for this purpose in FMC.

Answer

Port Object

Answer

Protocol Object

Answer

Application Filter Object

Question 10

A security engineer is integrating Cisco Secure Firewall with a third-party SIEM using eStreamer. The SIEM vendor's connector documentation requires the eStreamer event types to be parsed correctly. Which file format or protocol encoding does eStreamer use to transmit event records over TCP port 8305?

Accepted Answer

Compressed binary-encoded records over a custom TCP session. eStreamer transmits serialized binary event records over a secured TCP connection.

Answer

JSON over HTTPS REST API

Answer

XML-formatted SOAP messages

Answer

Syslog-formatted plain text over TLS

Question 11

When a packet capture is running on the FTD, where can you download the resulting .pcap file for analysis in Wireshark?

Accepted Answer

Devices > Device Management > Captures. Packet capture files (.pcap) generated on the FTD can be downloaded from Devices > Device Management > Captures in the FMC GUI. This page lists active and completed captures and provides a download option for the resulting pcap file, which can then be opened in Wireshark for detailed analysis. It is the designated location for managing and retrieving capture files.

Answer

Devices > Device Management > Diagnostics

Answer

System > Tools > File Transfer

Answer

Objects > File Lists

Answer

Analysis > Packet Analysis

Question 12

An engineer is troubleshooting a Cisco ISE and Secure Firewall pxGrid integration. The administrator notices that user group memberships are not populating correctly on the FTD, even though IP-to-user mappings are visible. What is the most likely reason user group information is missing?

Accepted Answer

ISE is not configured to include user group attributes in pxGrid publication feeds, or the FMC requires direct LDAP/AD integration to resolve user group hierarchies.. While pxGrid shares IP-to-user mappings, user group attribute resolution often relies on Active Directory integration or LDAP directory configurations mapped within ISE or synchronized via Active Directory Agent / ISE Active Directory attribute retrieval. If ISE is not configured to publish user group attributes over pxGrid or if the FMC lacks AD LDAP integration to resolve the groups, group-based rules will fail.

Answer

The FMC eStreamer service is blocking group attribute propagation.

Answer

User groups can only be resolved via RADIUS accounting attributes, making pxGrid fundamentally incompatible with user group filtering.

Answer

The FTD Snort engine must be configured with a local flat file containing all user group names.

Question 13

When editing an Access Control Rule, which action allows you to drop traffic while simultaneously sending a TCP RST to the client?

Accepted Answer

Block with Reset. The 'Block with Reset' action drops the connection and sends a reset packet to notify the sender.

Answer

Interactive Block

Answer

Block

Answer

Trust

Question 14

You are deploying an FTD in a cloud environment and need to ensure high availability. Which technology is typically used to manage the virtual IP failover?

Accepted Answer

Cloud API calls to update route tables.. In cloud environments, FTD high availability failover is managed by cloud API calls that update route tables to redirect traffic from the failed instance to the standby instance. Because cloud providers like AWS and Azure do not support traditional Layer 2 protocols such as VRRP or gratuitous ARP for floating IPs, the FTD uses cloud-native mechanisms (e.g., AWS API calls to reassign an Elastic IP or update route tables) to achieve failover. This is the standard HA approach for FTDv in public clouds.

Answer

VRRP.

Answer

EtherChannel hashing.

Answer

Gratuitous ARP.

Question 15

What is the result of assigning a 'Trust' action to a rule in an Access Control Policy?

Accepted Answer

Traffic is permitted without inspection. Trust allows traffic through the firewall without any further inspection by the Snort engine.

Answer

Traffic is inspected by IPS

Answer

Traffic is blocked

Answer

Traffic is decrypted

Question 16

Which component in an FTD cluster handles the 'Health Check' process to determine if a node is still active?

Accepted Answer

Cluster control link.. The cluster control link is used to exchange heartbeats and health information between cluster members to verify node status.

Answer

Primary management IP.

Answer

The standby unit's data interface.

Answer

FMC communication channel.

Question 17

You are configuring an NGIPS mode deployment on an FTD device. You need to ensure that the FTD can drop malicious traffic in real-time. Which mode must you select?

Accepted Answer

Inline Mode. Inline Mode places the FTD directly in the traffic path so packets must traverse the sensor, allowing it to drop malicious frames in real time before they reach the protected host. This is the only NGIPS deployment mode that supports blocking/drop actions; the other modes are detection-only.

Answer

Promiscuous Mode

Answer

Bypass Mode

Answer

Passive Mode

Question 18

An administrator is performing health monitoring on an FMC appliance. Which TWO health monitors are available out-of-the-box in the FMC Health Monitor dashboard to track system resource utilization? (Choose two)

Accepted Answer

CPU Utilization. The FMC Health Monitor dashboard ships with a set of default, out-of-the-box monitors that focus on appliance-level system resources, and CPU Utilization (A) is one of them, tracking processor load on the FMC so administrators can detect performance degradation. Disk Utilization (B) is also a built-in monitor, reporting how full the FMC's disk partitions are, which is critical because a full disk can halt logging, event storage, and database operations. Both A and B are standard system-resource monitors present by default without any additional configuration. The other options do not belong: SSL Handshake Latency (C) is not a default FMC health monitor, SNMP Trap Queue Depth (D) is not an out-of-the-box FMC system-resource monitor, and BGP Peer Flap Counter (E) relates to routing protocol state rather than FMC appliance resource utilization.

Answer

SSL Handshake Latency

Answer

SNMP Trap Queue Depth

Answer

BGP Peer Flap Counter

Question 19

An administrator needs to create a custom Application filter object in the FMC to easily select cloud storage applications in Access Control rules. Where are application filters created?

Accepted Answer

Objects > Object Management > Application Filters. Application Filters are reusable objects created under Objects > Object Management > Application Filters in the FMC. They let administrators group applications by characteristics such as category, risk, business relevance, or tags, so a single filter can be referenced in Access Control rules instead of listing dozens of individual applications. This is the canonical location for creating custom application filter objects.

Answer

Devices > Device Management > Apps

Answer

System > Configuration > Application Database

Answer

Policies > Access Control > Applications

Question 20

An administrator configures pxGrid integration between Cisco ISE and Secure Firewall Management Center. During the pxGrid certificate generation on ISE, the administrator must export the client certificate and keystore. What format must the client keystore be in when importing it into the FMC to establish the pxGrid trust relationship?

Accepted Answer

PKCS#12 (.pfx/.p12) bundle containing the client certificate, private key, and CA certificate.. The pxGrid client keystore must be a PKCS#12 (.pfx/.p12) bundle because FMC needs the client certificate, its matching private key, and the CA certificate together in one password-protected container to authenticate to the ISE pxGrid controller. ISE's pxGrid certificate generation workflow explicitly produces a .p12 file for download, and FMC's pxGrid client import expects exactly that bundle. Without the private key and CA chain in the same file, the TLS mutual-authentication handshake with ISE cannot complete.

Answer

Plaintext DER binary format without private keys.

Answer

Microsoft Exchange Web Services (EWS) XML format.

Answer

Java KeyStore (.jks) format exclusively.