300-710 SNCF Configuration Practice Test 11 — 15 Questions

Question 1

What is the result of applying an 'IPS Policy' to an Access Control Rule?

Accepted Answer

It enables deep packet inspection. The IPS policy enables deep packet inspection for the traffic matched by the rule.

Answer

It bypasses decryption

Answer

It blocks traffic based on IP

Answer

It disables the rule

Question 2

In the FMC, what is the purpose of the 'Network Discovery Policy'?

Accepted Answer

To define discovery scope. It is used to control which networks are monitored for host/user discovery to avoid performance impact.

Answer

To enable routing

Answer

To block unauthorized users

Answer

To monitor bandwidth

Question 3

When you have multiple overlapping NAT rules, which rule is applied?

Accepted Answer

The first matching rule. The FTD matches NAT rules using a top-down approach, similar to Access Control rules.

Answer

The rule that matches the interface

Answer

The rule with the lowest priority

Answer

The most specific rule

Question 4

Which menu in the FMC allows you to view the list of managed FTD devices?

Accepted Answer

Devices > Device Management. Devices > Device Management is the primary menu for managing all FTD nodes.

Answer

Policies > Devices

Answer

Analysis > Devices

Answer

System > Devices

Question 5

When configuring an FTD in Transparent Mode, how is the 'Bridge Group' created?

Accepted Answer

In Device Management > Interfaces. Bridge groups are created in the Device Management interface configuration section.

Answer

In the Access Control Policy

Answer

In the Security Zone settings

Answer

In the Platform Settings

Question 6

What is the effect of changing the order of rules in an Access Control Policy?

Accepted Answer

Changes the evaluation sequence. Rules are evaluated top-down; changing the order can cause a rule to be shadowed or never matched.

Answer

No effect

Answer

Resets the device

Answer

Updates the device firmware

Question 7

What occurs when an 'Interactive Block' action is used in an Access Control rule?

Accepted Answer

The user receives a notification page. The user is shown a page explaining why the traffic was blocked and given an option to proceed.

Answer

The traffic is dropped

Answer

The traffic is automatically allowed

Answer

The rule is ignored

Question 8

What is the primary function of the 'Object Management' section in FMC?

Accepted Answer

To create reusable objects. Object Management is where you create reusable objects for policies.

Answer

To analyze traffic

Answer

To create policies

Answer

To manage firmware

Question 9

Which object type should be used to represent a group of network subnets?

Accepted Answer

Network Group. A Network Group object allows you to aggregate multiple network subnets into a single object for policy efficiency.

Answer

Host

Answer

Range

Answer

Port Group

Question 10

An administrator is deploying a new Cisco FTD device managed by FMC and needs to route traffic between two internal networks while performing NAT. The FTD must also enforce access control and inspection policies. Which interface mode must be configured on the FTD to meet these requirements?

Accepted Answer

Routed mode. Routed mode is required because the FTD must perform Layer 3 routing, NAT, and access control between different subnets. Transparent mode is Layer 2 only and cannot route between networks. Inline tap and passive modes are monitoring modes that do not forward traffic, so they cannot enforce policies or provide NAT.

Answer

Inline tap mode

Answer

Transparent mode

Answer

Passive mode

Question 11

An administrator is deploying a new Cisco FTD device in a high-availability pair managed by FMC. The security policy requires that if the primary unit fails, the secondary unit must take over immediately without dropping existing TCP sessions. Which failover configuration must the administrator verify on the FTD devices?

Accepted Answer

Stateful failover is enabled and the failover link is configured.. Stateful failover is required to maintain existing TCP sessions across a failover event. The failover link carries state updates, and without it, the standby unit cannot replicate connection state. The other options either break management, invalidate HA, or misrepresent HA traffic flow. The correct configuration ensures seamless session continuity when the primary fails.

Answer

The FMC and FTD devices are configured with identical IP addresses on their management interfaces.

Answer

The secondary unit is placed in a separate FMC domain to isolate management traffic.

Answer

The primary unit is configured to forward all traffic to the secondary unit for inspection.

Question 12

An administrator is configuring a new Cisco FTD device in FMC and needs to ensure that the device can communicate with the FMC for management and policy deployment. Which interface type must be configured on the FTD to allow FMC management?

Accepted Answer

Management interface. The management interface is dedicated for FMC communication, including registration, policy deployment, and health monitoring. It must be configured with an IP address and gateway. The diagnostic, data, and console interfaces serve different purposes and cannot be used for FMC management. Ensuring the management interface is correctly set up is essential for FTD operation.

Answer

Data interface

Answer

Console interface

Answer

Diagnostic interface

Question 13

A network security engineer is configuring an FTD device managed by FMC to inspect traffic traversing a site-to-site VPN. The engineer wants to apply intrusion prevention and malware inspection to traffic destined to an internal web server. The traffic is already allowed by an access control rule. Which configuration step is required to ensure the traffic is inspected?

Accepted Answer

Enable the 'Intrusion Prevention' and 'Malware' options within the access control rule.. To inspect traffic for intrusions and malware, you must enable the corresponding options within the access control rule that matches the traffic. The rule's Inspection tab allows selection of intrusion and malware policies. Prefilter policies handle early actions but not deep inspection. The default action cannot perform inspection. Therefore, enabling these settings on the rule is the correct approach.

Answer

Modify the default action of the access control policy to include intrusion and malware inspection.

Answer

Create a separate access control policy dedicated to VPN traffic and assign the intrusion and malware policies there.

Answer

Configure a prefilter policy with a rule that sends traffic to the intrusion and malware inspection engines.

Question 14

An administrator is troubleshooting an FTD device that is failing to register with FMC. The FTD has been configured with the correct FMC IP address, registration key, and NAT ID. Which additional setting must be verified on the FTD to allow successful registration?

Accepted Answer

The FTD must have a default route to reach the FMC.. The FTD requires a route to reach FMC. If FMC is on a different network, a default gateway or static route must be configured on the management interface. Without it, registration packets cannot reach FMC. DNS, time zone, and NAT ID are either already addressed or not blocking registration in this scenario.

Answer

The FTD must be able to resolve the FMC's hostname via DNS.

Answer

The FTD must be configured with the same NAT ID as the FMC.

Answer

The FTD must have the same time zone as the FMC.

Question 15

An administrator is troubleshooting a Site-to-Site VPN between two FTD devices managed by FMC. The VPN tunnel is up, but traffic is not passing. The administrator suspects an issue with the crypto ACL. Which configuration element should be verified on both peers to ensure the crypto ACL matches?

Accepted Answer

The protected networks defined in the VPN topology. In a policy-based VPN, the crypto ACL defines the interesting traffic. On FTD, this is configured as protected networks in the VPN topology. If the protected networks do not match on both peers, traffic will not be encrypted or decrypted, even though the tunnel is up. The other settings are for tunnel establishment and would prevent the tunnel from coming up if mismatched.

Answer

The IPsec proposal settings

Answer

The pre-shared key or certificate configuration

Answer

The IKEv2 policy encryption algorithms