300-710 SNCF Configuration Practice Test 10 — 15 Questions

Question 1

When defining a NAT rule for an internal server, what happens if the 'DNS Rewrite' option is enabled?

Accepted Answer

The FTD modifies DNS responses. DNS Rewrite modifies the payload of DNS responses to ensure clients reach the correct internal server IP instead of the NAT public IP.

Answer

The FTD forces a DNS query to an external server

Answer

The FTD creates a new NAT object

Answer

The FTD blocks all DNS traffic

Question 2

You have a large number of NAT rules. How does the FTD process them?

Accepted Answer

Top-down. NAT rules are processed in a top-down order until the first match is found.

Answer

Bottom-up

Answer

Specific to General

Answer

Alphabetical

Question 3

What is the purpose of 'Network Discovery' in FMC?

Accepted Answer

To identify hosts and user activity. Network Discovery identifies hosts, applications, and operating systems on the network.

Answer

To push firmware updates

Answer

To configure routing protocols

Answer

To perform active IPS scanning

Question 4

Which tab in the Access Control Policy rule editor allows you to specify the source and destination zones?

Accepted Answer

Zones. The 'Zones' tab is where you define ingress and egress zones for the rule.

Answer

Ports

Answer

Networks

Answer

Applications

Question 5

How do you enable 'High Availability' (HA) for an FTD pair managed by FMC?

Accepted Answer

Under Devices > Device Management. HA is configured in the Device Management section by selecting two devices to pair.

Answer

Under Policies > HA

Answer

Via the System > Configuration menu

Answer

In the Access Control Policy

Question 6

When configuring a QoS policy, what happens if you exceed the 'Rate Limit' set for a traffic class?

Accepted Answer

The excess traffic is policed. Traffic exceeding the rate limit is policed (dropped or shaped).

Answer

The traffic is redirected to another interface

Answer

The traffic is logged as critical

Answer

The connection is reset

Question 7

What must be configured before an Access Control Rule can use a URL category?

Accepted Answer

URL Filtering License. The URL filtering license must be enabled/configured for the category database to be available.

Answer

Identity Policy

Answer

Prefilter Policy

Answer

QoS Policy

Question 8

What action should you take if you want to test a new Access Control Rule without impacting production traffic?

Accepted Answer

Use the 'Monitor' action. The Monitor action in an Access Control Rule allows traffic to pass while logging it, without enforcing any block or trust action. This is ideal for testing a new rule because it does not impact production traffic—traffic is still allowed but you can see what would have matched. It provides visibility without disruption.

Answer

Delete the rule

Answer

Use the 'Block' action

Answer

Use the 'Trust' action

Question 9

What is the result of using a 'Security Group' object in an Access Control rule?

Accepted Answer

Matches based on SGT. Security Group objects allow policy matching based on Cisco TrustSec tags.

Answer

Matches based on IP address

Answer

Matches based on VLAN

Answer

Matches based on Interface

Question 10

What is the purpose of an 'FQDN' object in FMC?

Accepted Answer

To define a domain name. FQDN objects are used to define network resources by domain name, which the FTD resolves.

Answer

To define a protocol port

Answer

To define a zone

Answer

To define a static IP

Question 11

How do you identify which Access Control Rule triggered a specific connection log?

Accepted Answer

Check the 'Rule Name' field in the connection event. The connection event log contains a field identifying the specific Rule Name that matched.

Answer

Check the 'Policy Name' field

Answer

Check the 'Device Name'

Answer

Check the 'Ingress Zone'

Question 12

If you need to block a specific file type (e.g., .exe) from being downloaded, which feature must you enable in the Access Control Rule?

Accepted Answer

File Policy. File policies are associated with Access Control rules to inspect and block files.

Answer

SSL Policy

Answer

IPS Policy

Answer

QoS Policy

Question 13

When configuring an FQDN object, which THREE options are valid for the FQDN field?

Accepted Answer

Subdomain. In an FQDN object, the FQDN field accepts a single domain name (E), such as example.com, which resolves to one or more IP addresses and is the standard hostname form. It also accepts a subdomain (B), such as www.example.com or mail.example.com, since a subdomain is still a fully qualified domain name with a complete host and domain hierarchy. A wildcard domain (C), such as *.example.com, is likewise valid because it lets the object match any hostname within that domain. An IP address (A) is not valid in the FQDN field because IP addresses belong in address or IP-netmask objects, not in a name-based FQDN object. A protocol name (D) is also invalid, since protocols such as TCP, UDP, or ICMP are specified in service objects, not in an FQDN field.

Answer

IP address

Answer

Protocol name

Question 14

Which THREE components of an Access Control rule can be used to identify traffic as 'Application' based?

Accepted Answer

Application Category. In an Access Control rule, traffic can be identified as Application-based by matching on the Application Name (D), which targets a specific application signature such as 'facebook' or 'ssh'; by the Application Category (A), which groups applications by function such as 'social-networking' or 'file-sharing'; and by the Application Tag (C), which matches applications sharing a common attribute such as 'evasive' or 'high-risk'. These three are the application-identification criteria available in the rule's Application column, since App-ID classifies traffic by name, category, and tag. Device Type (B) and OS Version (E) are host/endpoint attributes used for policy matching (for example in HIP or User-ID based rules), not application identifiers, so they cannot be used to identify traffic as Application based.

Answer

Device Type

Answer

OS Version

Question 15

What must be done to apply a change made in the Access Control Policy?

Accepted Answer

Click 'Deploy'. You must click 'Deploy' in the FMC to push the changes to the FTD.

Answer

Wait 24 hours

Answer

Click 'Save'

Answer

Restart the device