300-710 SNCF Practice Test 9 — 10 Questions

Question 1

When registering a new Cisco Secure Firewall Threat Defense device to Cisco Defense Orchestrator (CDO) or Cisco FMC, what is the primary prerequisite protocol or connectivity requirement that must be established from the managed device toward the management platform?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Outbound TCP connection on port 8305 from the FTD to the manager's IP address or registration FQDN.. Managed devices initiate outbound secure communication (typically over TCP port 8305 / sftunnel) to the management platform (FMC or CDO).

Answer

An active SNMPv3 trap receiver configured on the manager pointing to the FTD.

Answer

Inbound SSH access from the management platform IP address to the firewall management interface.

Answer

An IPSec site-to-site VPN tunnel terminating on the data interfaces.

Question 2

An administrator is configuring an NGIPS deployment using a Cisco Secure Firewall Threat Defense inline set. Traffic needs to be analyzed, but certain trusted bulk data transfers should bypass the Snort inspection engine without breaking the inline flow. Which feature should the administrator configure?

Accepted Answer

Enable an Inline Set with Snort Bypass enabled so traffic passes through the hardware interface pair without inspection when Snort is busy.. Inline Bypass or Advanced Inspection and Prevention settings allow traffic to bypass Snort inspection under specific conditions. Specifically, Snort performance overload or configured bypass settings on inline sets can drop or pass traffic without inspection.

Answer

Deploy a BVI interface pair in transparent mode with asymmetric routing enabled.

Answer

Configure a Network Analysis Policy (NAP) to use the Inline Tap mode for the specific VLAN range.

Answer

Configure an Access Control Policy rule with the action set to Trust, combined with an Intrusion Policy set to drop.

Question 3

Which TWO components must be configured in FMC to enable User Identity mapping for Access Control Rules?

Accepted Answer

Identity Policy. An identity realm (Active Directory connector) and the Identity Policy are both required to map users to their IP addresses.

Answer

QoS Policy

Answer

Network Discovery Policy

Answer

SSL Policy

Question 4

What must be done to apply a change made in the Access Control Policy?

Accepted Answer

Click 'Deploy'. You must click 'Deploy' in the FMC to push the changes to the FTD.

Answer

Wait 24 hours

Answer

Click 'Save'

Answer

Restart the device

Question 5

Which menu in the FMC allows you to view the list of managed FTD devices?

Accepted Answer

Devices > Device Management. Devices > Device Management is the primary menu for managing all FTD nodes.

Answer

Policies > Devices

Answer

Analysis > Devices

Answer

System > Devices

Question 6

An engineer is setting up a Cisco Secure Firewall Threat Defense cluster. Which TWO statements accurately describe the architecture and behavior of FTD clustering? (Choose two)

Accepted Answer

One unit is elected as the control node, while the other units function as data nodes sharing the processing load.. Clustering combines multiple devices into a single logical entity with a control node and data nodes, sharing configuration and connection tables.

Answer

Clustering is exclusively supported on virtual machine instances and cannot be used on physical appliances.

Answer

Data nodes do not process any traffic; they remain idle until the control node fails.

Answer

Clustering can be established across different cities over high-latency WAN connections.

Question 7

When configuring an NGIPS appliance in passive mode, how does the system handle traffic flow to ensure monitoring without impacting the production network?

Accepted Answer

It receives a copy of traffic via a SPAN or TAP port and performs out-of-band analysis.. Passive mode utilizes a TAP or SPAN port to ingest a copy of the traffic. It does not sit in the traffic path, meaning it cannot block traffic directly.

Answer

It uses an inline set with a bypass feature enabled.

Answer

It drops malicious packets by sending TCP resets to the source.

Answer

It requires an EtherChannel configuration to load balance traffic.

Question 8

Which component is responsible for processing traffic in an FTD cluster when 'Distributed' mode is used?

Accepted Answer

All cluster members.. In distributed mode, traffic is load-balanced across all members of the cluster, and each node processes its own traffic flows.

Answer

The management node.

Answer

A separate load-balancing virtual machine.

Answer

Only the primary node.

Question 9

Which TWO of the following are benefits of using a Port Channel on an FTD?

Accepted Answer

Improved link redundancy.. Port channels increase aggregate bandwidth and provide physical link redundancy.

Answer

Reduced latency.

Answer

Elimination of spanning tree.

Answer

Automatic NAT mapping.

Question 10

Which THREE criteria can be used to match traffic in an Access Control Policy rule?

Accepted Answer

Application. Access control rules can match based on Source/Destination Network, Applications, and URL categories.

Answer

SSL Certificate Name

Answer

QoS Priority