300-710 SNCF Practice Test 9 — 10 Questions

Question 1

An administrator wants to stream security events, connection events, and intrusion events from Cisco Secure Firewall Management Center (FMC) to a third-party SIEM platform. Which built-in protocol and feature on the FMC should be configured to export these events in real-time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

eStreamer. eStreamer is the FMC's built-in event streaming service that pushes intrusion, connection, security, and malware events to external clients (such as third-party SIEMs) in real time over a proprietary TCP-based protocol on port 8302. It is purpose-built for high-volume event export from the FMC and is the documented integration path for SIEM platforms like Splunk, QRadar, and ArcSight.

Answer

pxGrid

Answer

NETCONF

Answer

RADIUS Accounting

Question 2

An enterprise integrates Cisco Secure Firewall Management Center with Cisco ISE using pxGrid for identity-based access control. The security team notices that user identity mapping works for domain users authenticating via 802.1X, but guest users connecting through a WebAuth portal do not have their user-to-IP mappings populated on the FTD. What is the root cause of this issue?

Accepted Answer

The pxGrid connection on ISE is not subscribed to the guest session topic, or guest session publishing is disabled in ISE deployment settings.. Guest users authenticated via WebAuth on ISE may not have active pxGrid session directory notifications if the guest profile or ISE profiler service is not configured to publish guest sessions, or if the pxGrid node is not subscribed to guest session topics (such as 'Session Directory' guest events).

Answer

FMC requires an active eStreamer connection to ingest guest identities because pxGrid only supports Active Directory domain accounts.

Answer

Guest users must manually log into a captive portal hosted on the FTD data plane before ISE can share their identity.

Answer

The FTD identity policy must be configured with a RADIUS server group instead of pxGrid to support guest VLANs.

Question 3

An engineer needs to analyze the connection history and security events from an FTD device that occurred three weeks ago. However, when querying the FMC event viewer, the events are missing. What is the most likely cause of this behavior?

Accepted Answer

The events were overwritten because the event database retention period or disk space limit was reached.. FMC event databases have configurable retention policies and disk space thresholds. If event retention settings are low or disk space fills up, older events are automatically purged to prevent disk exhaustion.

Answer

The administrator must run 'database-cli optimize' on the FTD CLI to unhide historical events.

Answer

The FTD automatically flushes its local event buffer every 48 hours regardless of FMC configuration.

Answer

Security events older than 7 days are automatically archived to the Cisco Cloud Analytics platform by default.

Question 4

An administrator is configuring a static route tracking mechanism on a Cisco Secure Firewall Threat Defense device using an ICMP Echo IP SLA object. What happens to the tracked static route if the SLA probe fails to receive a response?

Accepted Answer

The static route is removed from the routing table, allowing alternative routes to become active.. When an IP SLA probe fails, the tracked object changes its state to DOWN, causing the dependent static route to be removed from the routing table, allowing backup routes to take over.

Answer

The static route metric is automatically incremented by 100 while remaining active.

Answer

The firewall automatically reboots into maintenance mode to clear the routing cache.

Answer

All firewall interfaces are automatically placed in an administrative shutdown state.

Question 5

An administrator configures a Cisco Secure Firewall Threat Defense cluster. During normal operations, a data node experiences a critical hardware failure. What happens to the active connections currently processed by that specific failed data node?

Accepted Answer

Active connections are migrated or maintained by surviving cluster nodes because connection state is distributed across the cluster.. In a Cisco Secure Firewall Threat Defense cluster, connection state is synchronised across data nodes so that if one data node fails, surviving nodes can maintain or take over the active connections. This state sharing is what allows the cluster to provide high availability without forcing clients to re-establish sessions. The control node handles cluster management, but data plane continuity is preserved by the distributed state.

Answer

Traffic destined for the failed node is permanently blackholed until the physical module is replaced.

Answer

All active connections are immediately dropped, forcing clients to re-establish TCP handshakes from scratch.

Answer

The entire cluster reboots to elect a new control node and rebuild the data plane.

Question 6

An administrator is setting up Cisco ISE pxGrid integration with Cisco Secure Firewall Management Center. Which TWO configuration steps must be performed on the Cisco ISE side to ensure successful integration? (Choose two)

Accepted Answer

Approve the FMC client registration request in the Cisco ISE pxGrid client management settings.. Option D is correct because pxGrid uses mutual certificate-based authentication, and when FMC first connects as a pxGrid client, its registration request must be approved by an ISE administrator under Administration > pxGrid Services > Client Management before the client can subscribe to or publish on the pxGrid bus. Option E is correct because the pxGrid persona is not enabled by default; the administrator must enable the pxGrid service on the appropriate ISE node (typically the PAN/MnT or a dedicated pxGrid node) under Administration > System > Deployment so the node can host the pxGrid controller and accept client connections. Option A is wrong because eStreamer is a Firepower/FSMC-side event-streaming service, not an ISE policy service node component. Option B is wrong because SNMPv2c traps are for monitoring/alerting and play no role in pxGrid integration. Option C is wrong because TACACS+ shared secrets are for device administration authentication, not for pxGrid, which relies on certificates rather than a shared secret.

Answer

Configure an eStreamer server instance on the ISE policy service node.

Answer

Enable SNMPv2c traps on the ISE administration node.

Answer

Export the ISE TACACS+ shared secret to the FTD CLI.

Question 7

An administrator configures DNS injection and rewriting in a manual NAT rule on an FTD device. What is the primary purpose of enabling DNS translation in a NAT rule?

Accepted Answer

To rewrite DNS A-records returning internal server IPs so external clients receive the correct public NAT IP. DNS translation (DNS injection and rewriting) in a manual NAT rule rewrites DNS A-records in DNS responses so that when an internal server's DNS reply contains a private IP, external clients receive the corresponding public NAT IP instead. This ensures clients connect to the correct translated address.

Answer

To cache DNS responses locally on the FTD control plane

Answer

To encrypt DNS queries over TLS (DoT)

Answer

To block malicious DNS tunneling attempts via Snort inspection

Question 8

Which type of object is best suited for defining a web server's public-to-private NAT mapping?

Accepted Answer

Network object (Host). A Network object (Host) is the correct choice because it represents a single IP address with a /32 mask, which is exactly what a one-to-one NAT mapping for a web server requires. Host objects are used in both Auto NAT and Manual NAT rules to define the specific address being translated.

Answer

VLAN object

Answer

Port object

Answer

Network object (Group)

Question 9

An administrator configures a security intelligence feed in the FMC to block known malicious IP addresses. Where are Security Intelligence feeds and lists applied in the FMC configuration?

Accepted Answer

Under the Security Intelligence tab of the Access Control Policy. Security Intelligence feeds and lists in FMC are configured under the Security Intelligence tab of the Access Control Policy. This tab lets you apply source/destination block lists and feeds globally to the policy, with options for block, monitor, or allow actions. It is not a per-rule setting or a standalone object.

Answer

Directly inside the Prefilter policy configuration

Answer

Within individual Access Control rules under the Source/Destination tabs

Answer

Under Objects > Security Intelligence > Rule Mapping

Question 10

An FTD high availability pair experiences a failover due to a hardware failure on the active unit. After the standby unit takes over, the administrator notices that existing TCP connections were dropped and did not state-fully fail over. What configuration setting should the administrator verify?

Accepted Answer

Verify that stateful failover is enabled and the failover link interface is operational and passing state packets.. Stateful failover in an FTD HA pair requires that the failover link be up and actively passing state synchronization packets between the active and standby units. If the failover link is down or stateful failover is not enabled, the standby unit takes over the interfaces but has no session table, so existing TCP connections are dropped and must be re-established.

Answer

Ensure that dynamic routing protocols are configured with graceful restart.

Answer

Verify that clustering is enabled instead of high availability.

Answer

Check that adaptive inspection is disabled in the Access Control Policy.