300-710 SNCF Configuration Practice Test 2 — 15 Questions

Question 1

Which option is required in the SSL Policy to allow the FTD to intercept and decrypt traffic to a specific server?

Accepted Answer

SSL Decryption Rule. A Certificate object representing the CA must be trusted to allow decryption.

Answer

Access Control Rule

Answer

Custom Port Object

Answer

Prefilter Policy rule

Question 2

You need to ensure that specific traffic is always inspected by the IPS, regardless of other rules. What is the best way to ensure this?

Accepted Answer

Use an Inspect rule with IPS profile. An Access Control rule with an 'Inspect' action and an IPS policy assigned ensures this.

Answer

Use a Trust rule

Answer

Use a Monitor rule

Answer

Set as the Default Action

Question 3

Where can you see the current status of an FTD device's deployment?

Accepted Answer

Devices > Deployment. The 'Deployment' page in FMC shows the pending or successful status of policy application.

Answer

System > Updates

Answer

Objects > Deployment

Answer

Analysis > Deployment

Question 4

Which THREE items are mandatory to define when creating a new Security Zone?

Accepted Answer

Assigned Interfaces. A Zone requires a Name, a Type (Routed/Transparent), and assigned Interfaces.

Answer

MTU Size

Answer

SNMP Community

Question 5

Which THREE actions can be applied to traffic in a Prefilter rule?

Accepted Answer

Tunnel. Prefilter rules support Fastpath, Analyze, and Tunneling actions.

Answer

Block

Answer

Monitor

Question 6

Which THREE methods can be used to monitor the performance of an FTD device?

Accepted Answer

Health Dashboard. FMC provides health dashboards, connection logs, and platform status reports.

Answer

Interface statistics

Answer

Packet tracer tool

Question 7

What does 'Enable DNS Rewrite' accomplish in a NAT configuration?

Accepted Answer

It hides the real server IP. It ensures that internal servers are reached by the correct IP by updating DNS responses.

Answer

It speeds up DNS queries

Answer

It logs all DNS traffic

Answer

It blocks DNS tunneling

Question 8

An administrator configures an Identity Policy on the FMC to authenticate users via Active Directory using captive portal. Where is the Identity Policy applied within the Firepower configuration hierarchy?

Accepted Answer

Within the Access Control Policy settings on the FMC. Identity policies are associated directly with an Access Control Policy under the Advanced tab or specific settings, which links the user mapping to traffic inspection.

Answer

Directly under Devices > Device Management > Platform Settings

Answer

Inside the SSL/TLS Decryption Policy

Answer

As a standalone rule inside a Prefilter Policy

Question 9

A network engineer needs to configure Auto NAT on a Firepower Threat Defense device managed by FMC to translate internal subnet 10.10.10.0/24 to a single public IP address 203.0.113.50. Which translation type should be selected?

Accepted Answer

Dynamic PAT (Port Address Translation). Dynamic PAT translates a pool of inside IP addresses to a single outside IP address using unique port numbers, which matches mapping a subnet to a single public IP.

Answer

Static NAT

Answer

Static Identity NAT

Answer

Dynamic NAT

Question 10

An administrator wants to create a Prefilter policy to fast-path (bypass Snort inspection for) a trusted backup stream between two data centers. Which action type should be selected in the Prefilter rule?

Accepted Answer

FastPath. The FastPath action in a Prefilter policy allows matching traffic to bypass Snort inspection for performance optimization.

Answer

Monitor

Answer

Block

Answer

Inspect

Answer

Trust

Question 11

An administrator needs to configure manual NAT on an FTD device to translate both the source IP and source port of outbound packets originating from 192.168.2.50 to a specific public IP 198.51.100.10 and port 50000. Which manual NAT rule element achieves this?

Accepted Answer

Manual NAT rule with Translated Source set to an IP object and dynamic port translation enabled. Manual NAT rules allow specifying Original Source, Translated Source (IP), and Port translation options to achieve Port Address Translation.

Answer

Static NAT with Bi-directional enabled

Answer

Auto NAT rule configured with Dynamic PAT

Answer

Identity NAT with Port Forwarding enabled

Question 12

An administrator wants to decrypt inbound HTTPS traffic destined for a public web server behind a Firepower Threat Defense device. Which type of SSL/TLS decryption policy must be configured on the FMC?

Accepted Answer

Decrypt - Inbound. Decrypt - Inbound is used when the FTD device holds the private key of the server to decrypt inbound traffic destined for internal protected servers.

Answer

SSL Decryption - Do Not Decrypt

Answer

Decrypt - Resign

Answer

SSL Inspection Policy - Outbound

Question 13

An administrator is configuring a new Access Control Policy on the Firepower Management Center and needs to add a rule that blocks peer-to-peer file sharing applications regardless of port. Which rule type should the administrator select?

Accepted Answer

Access control rule. Access Control Rules of type Access are used to allow, block, or inspect traffic. To block applications regardless of port, the administrator uses the Applications tab within an Access rule.

Answer

NAT rule

Answer

Identity rule

Answer

Prefilter rule

Question 14

An administrator wants to create a Port object group containing TCP ports 80, 443, and 8080 on the FMC. Where is this object configured?

Accepted Answer

Objects > Object Management > Ports. Port object groups and individual ports are created under Objects > Object Management > Ports.

Answer

Policies > Access Control > Ports

Answer

Devices > Device Management > Object Explorer

Answer

System > Configuration > Port Groups

Question 15

An enterprise requires FTD to decrypt outbound SSL/TLS traffic so internal users visiting external websites can be inspected by Snort for malware. Which policy and action combination must be configured?

Accepted Answer

SSL/TLS Decryption Policy with Decrypt - Resign action. Outbound SSL decryption requires an SSL/TLS Decryption Policy with a 'Decrypt - Resign' action using an internal subordinate CA certificate.

Answer

Prefilter Policy configured with SSL Bypass

Answer

SSL/TLS Decryption Policy with Decrypt - Inbound action

Answer

Access Control Policy with Malware Inspection enabled and no SSL policy