300-710 SNCF Configuration Practice Test 3 — 15 Questions

Question 1

An FMC administrator is configuring a URL Filtering policy. They want to block URLs categorized as 'Hacking' while logging the event. Where is this configured within the Access Control Policy?

Accepted Answer

Policies > Access Control > Access Control Policy > Rules > URLs tab. URL filtering configuration is embedded directly within Access Control rules under the URLs tab.

Answer

Objects > Object Management > URL Objects

Answer

Policies > SSL Decryption > URL Match criteria

Answer

Devices > Device Management > URL Filtering Settings

Question 2

An administrator configures a security intelligence feed in the FMC to block known malicious IP addresses. Where are Security Intelligence feeds and lists applied in the FMC configuration?

Accepted Answer

Under the Security Intelligence tab of the Access Control Policy. Security Intelligence is configured globally per Access Control Policy under the Security Intelligence tab to drop bad traffic before evaluation against regular access rules.

Answer

Directly inside the Prefilter policy configuration

Answer

Within individual Access Control rules under the Source/Destination tabs

Answer

Under Objects > Security Intelligence > Rule Mapping

Question 3

When configuring an Access Control Policy on the FMC, what is the purpose of the Default Action set at the bottom of the rules table?

Accepted Answer

It defines the action taken for traffic that matches no explicit rules in the policy.. The Default Action determines how traffic that fails to match any explicit access control rule is handled (typically Block or Pass with logging).

Answer

It sets the global timeout values for all TCP connections.

Answer

It acts as a prefilter rule for dropped packets.

Answer

It forces all unmatched traffic to be sent to the Cisco Cloud for telemetry.

Question 4

An administrator needs to configure an identity policy to authenticate users using an external RADIUS server via Passive Authentication. Which mechanism accomplishes passive user identification?

Accepted Answer

Cisco ISE pxGrid / Firepower User Agent. Passive authentication maps users without prompting them for credentials, typically achieved using Cisco Firepower User Agent or ISE pxGrid integration.

Answer

Captive Portal

Answer

RADIUS Challenge-Response prompt

Answer

HTTP Basic Authentication challenge

Question 5

An FTD device is deployed in routed mode with multiple security zones. An administrator needs to configure an Access Control rule that evaluates traffic flowing between two different security zones. How are security zones utilized in the rule?

Accepted Answer

Security zones are selected under the Zones tab of an Access Control rule as Source and Destination.. Security zones are groupings of interfaces referenced as source and destination zones within Access Control rules.

Answer

Security zones replace IP address objects entirely in all rule configurations.

Answer

Security zones are used exclusively in NAT translation rules.

Answer

Security zones are assigned globally in device platform settings, not in access rules.

Question 6

An engineer is configuring a QoS policy on an FMC-managed FTD and needs to police traffic to a maximum bandwidth limit on an interface. Which shaping/policing parameter must be configured?

Accepted Answer

Traffic Policing with specified Committed Information Rate (CIR). Interface-based QoS rate limiting uses police parameters to cap bandwidth for traffic matching the QoS policy.

Answer

Prefilter FastPath Rate Cap

Answer

Access Control Rate Limiting action

Answer

Random Early Detection (RED) drop threshold

Question 7

An administrator needs to create a Geolocation object in the FMC to block traffic originating from a specific country. Where is this object used?

Accepted Answer

In Access Control rules under the Networks tab as Country objects. Geolocation objects are used directly within Access Control rules under the Source/Destination Country criteria.

Answer

In manual NAT rules under Original Source

Answer

In Identity policies to restrict user login locations

Answer

In Prefilter policies under Geo-FastPath

Question 8

An administrator configures DNS injection and rewriting in a manual NAT rule on an FTD device. What is the primary purpose of enabling DNS translation in a NAT rule?

Accepted Answer

To rewrite DNS A-records returning internal server IPs so external clients receive the correct public NAT IP. DNS translation ensures that when an internal client queries a local DNS server for an external name that resolves to a private IP (due to NAT), the FTD rewrites the DNS A-record response to the public IP.

Answer

To cache DNS responses locally on the FTD control plane

Answer

To encrypt DNS queries over TLS (DoT)

Answer

To block malicious DNS tunneling attempts via Snort inspection

Question 9

An engineer wants to group several FTD interfaces into a single logical zone to simplify Access Control rule creation. Where are security zones created in the FMC?

Accepted Answer

Objects > Object Management > Security Zones. Security zones are created under Objects > Object Management > Security Zones.

Answer

System > Integration > Security Zones

Answer

Policies > Access Control > Zones

Answer

Devices > Device Management > Interfaces > Zones

Question 10

An administrator is configuring a Prefilter policy to handle GRE-encapsulated traffic. Which Prefilter rule option allows handling or accelerating tunneled traffic?

Accepted Answer

Tunnel rule type. Prefilter policies contain specific settings for handling tunnels such as GRE or IPsec to either bypass, accelerate, or match them.

Answer

Access Control rule with GRE protocol filter

Answer

SSL Decryption Policy Tunnel Decrypt

Answer

NAT rule with Protocol Rewriting

Question 11

An administrator wants to configure an Access Control rule that triggers an Intrusion Policy only when specific vulnerability signatures match. Where is the Intrusion Policy assigned?

Accepted Answer

Under the Inspection tab of an individual Access Control rule. Intrusion policies are assigned to Access Control rules under the Inspection tab or as the default intrusion policy for the access control policy.

Answer

Under the Advanced tab of the Access Control Policy globally

Answer

Within the Platform Settings object

Answer

In the Security Intelligence policy settings

Question 12

An administrator needs to create a custom Application filter object in the FMC to easily select cloud storage applications in Access Control rules. Where are application filters created?

Accepted Answer

Objects > Object Management > Application Filters. Application filters are created under Objects > Object Management > Application Filters.

Answer

Devices > Device Management > Apps

Answer

System > Configuration > Application Database

Answer

Policies > Access Control > Applications

Question 13

An administrator configures an SSL Decryption Policy with a rule to 'Do Not Decrypt' financial traffic. However, the administrator also wants to ensure that the encrypted session still undergoes basic certificate validation and categorization. How does FTD handle 'Do Not Decrypt' traffic?

Accepted Answer

The FTD extracts SNI and performs URL categorization using the unencrypted Client Hello handshake.. Even when traffic is set to Do Not Decrypt, FTD can inspect the TLS handshake (Client Hello) to extract SNI, categorize the URL, and validate basic certificate attributes without decrypting the payload.

Answer

All inspection, including URL categorization and SNI extraction, is completely bypassed.

Answer

The FTD converts the traffic to plaintext using a self-signed proxy certificate.

Answer

The FTD drops the connection because decryption is mandatory for any inspection.

Question 14

An administrator needs to create a variable set to define specific port or network variables used within Intrusion Rules. Where are variable sets managed in the FMC?

Accepted Answer

Objects > Object Management > Variable Sets. Variable sets are managed under Objects > Object Management > Variable Sets.

Answer

Devices > Device Management > Variables

Answer

System > Localized Variables

Answer

Policies > Access Control > Variables

Question 15

An administrator is configuring manual NAT and needs to specify an interface pair (Source Interface and Destination Interface). Why is defining interface objects important in manual NAT rules?

Accepted Answer

It scopes the translation rule to specific ingress and egress interfaces, preventing unintended translations across other subnets.. Interface specifications in manual NAT help define the directionality and scope of the translation (e.g., inside to outside).

Answer

It replaces the need for security zones in Access Control policies.

Answer

It forces the FTD to convert the packet from Layer 2 to Layer 3.

Answer

It enables automatic routing table updates for the translated IP address.