300-710 SNCF Configuration Practice Test 4 — 15 Questions

Question 1

Which tab in the FMC Object Manager allows you to manage pre-defined objects?

Accepted Answer

System Objects. FMC provides a list of pre-defined objects under the 'Network' or 'Port' categories; you can filter for 'System' objects.

Answer

User Objects

Answer

Global Objects

Answer

Custom Objects

Question 2

Which THREE items are mandatory to define when creating a new Security Zone?

Accepted Answer

Assigned Interfaces. A Zone requires a Name, a Type (Routed/Transparent), and assigned Interfaces.

Answer

MTU Size

Answer

SNMP Community

Question 3

Which THREE actions can be applied to traffic in a Prefilter rule?

Accepted Answer

Tunnel. Prefilter rules support Fastpath, Analyze, and Tunneling actions.

Answer

Block

Answer

Monitor

Question 4

Which TWO items can be used to filter traffic in a QoS policy?

Accepted Answer

Port object. In a QoS policy, traffic is matched using the same classification criteria as firewall policy, and both Port object (A) and Network object (E) are valid match conditions: a Port object specifies TCP/UDP ports or port ranges (e.g., 443 or 8000-8080) to identify applications/services, while a Network object specifies source/destination IP addresses or subnets (e.g., 10.0.0.0/8) to identify the traffic's endpoints, so both can be used to filter which traffic the QoS rules apply to. User Identity (B) is not a QoS match criterion in this context, and License status (C) and Device name (D) are administrative/inventory attributes, not traffic classification fields, so they cannot filter traffic in a QoS policy.

Answer

User Identity

Answer

License status

Answer

Device name

Question 5

Which TWO tasks are required to delete a NAT rule safely?

Accepted Answer

Deploy changes. Before deleting, ensure no other policies reference it and save/deploy the changes.

Answer

Backup the FMC

Answer

Disable the rule

Answer

Rename the rule

Question 6

Which THREE methods can be used to monitor the performance of an FTD device?

Accepted Answer

Health Dashboard. FMC provides health dashboards, connection logs, and platform status reports.

Answer

Interface statistics

Answer

Packet tracer tool

Question 7

Which TWO fields are commonly used in the 'NAT Rule' editor to define the source address?

Accepted Answer

Translated Source. In a NAT Rule editor, the source address is defined by the Original Source (C), which specifies the pre-translation source IP address or network that the rule matches, and the Translated Source (B), which specifies the post-translation source IP address or range that the original source is rewritten to. These two fields work together to implement source NAT (SNAT), where Original Source identifies the traffic to match and Translated Source defines the new source address applied to that traffic. Destination Port (A) is incorrect because it identifies the destination service port for the traffic, not the source address. Access List (D) is incorrect because it is a filtering construct used to permit or deny traffic, not a field that defines a NAT source address. Interface Group (E) is incorrect because it groups interfaces for policy or routing purposes rather than specifying a source address in a NAT rule.

Answer

Destination Port

Answer

Access List

Answer

Interface Group

Question 8

How do you ensure that a specific host object is only used in a specific interface?

Accepted Answer

Use an Interface Object. An Interface Object in Cisco Secure Firewall (formerly Firepower) is a named object that represents a specific physical or logical interface. When you use an Interface Object in an access control or NAT policy, the policy applies only to traffic entering or exiting that interface, effectively binding the host object to that interface. This ensures the host object is only used in the context of that specific interface.

Answer

Use a VLAN group

Answer

Use a Security Zone

Answer

Use a Port object

Question 9

Which tab in the Access Control Policy rule allows you to choose the 'Logging' action?

Accepted Answer

Logging. The Logging tab in the rule editor is dedicated to logging configuration.

Answer

General

Answer

Inspection

Answer

Advanced

Question 10

What does 'Enable DNS Rewrite' accomplish in a NAT configuration?

Accepted Answer

It hides the real server IP. It ensures that internal servers are reached by the correct IP by updating DNS responses.

Answer

It speeds up DNS queries

Answer

It logs all DNS traffic

Answer

It blocks DNS tunneling

Question 11

An administrator is deploying a Cisco Firepower Threat Defense (FTD) device managed by Cisco Firepower Management Center (FMC) in a high-availability pair. The administrator must configure the FTD interfaces to support stateful failover. Which interface type should be configured on both FTD devices to exchange failover status and state information?

Accepted Answer

Failover link interface. In an FTD high-availability configuration, a dedicated failover link is required to exchange failover status and heartbeat messages between the active and standby devices. This link ensures that both devices are aware of each other's operational state. The state link is separate and used for stateful failover synchronization. The management and data interfaces serve other purposes and are not used for failover control.

Answer

State link interface

Answer

Data interface

Answer

Management interface

Question 12

An administrator is configuring an Access Control Policy on FMC and needs to ensure that traffic from the guest network is inspected for malware while allowing web browsing. Which action should be selected in the Access Control rule to enable intrusion and malware inspection?

Accepted Answer

Allow with Intrusion Policy. To inspect traffic for malware while allowing web browsing, the Access Control rule must use the Allow action and have an Intrusion Policy and File Policy attached. The Allow action alone permits traffic; the inspection is performed by the attached policies. Trust bypasses inspection, and Monitor only logs without inspection.

Answer

Trust

Answer

Allow

Answer

Monitor

Question 13

An administrator is configuring an FTD device through FMC and needs to ensure that management traffic to the FTD's management interface is allowed. The FTD is using a management interface with IP 10.1.1.1/24. Which configuration object must be created and applied to allow HTTPS access to the FMC?

Accepted Answer

A management access control list (ACL) within the FTD's platform settings.. Management access to an FTD device is controlled by a management ACL configured in the platform settings. This ACL defines which hosts can access management services on the management interface. To allow the FMC to manage the FTD via HTTPS, the FMC's IP must be permitted in this ACL. Other options like access control policies or NAT rules do not govern management interface access.

Answer

An access control policy applied to the management interface.

Answer

A NAT rule that translates the management IP to a public address.

Answer

A platform settings policy with an access list allowing HTTPS from the FMC IP.

Question 14

An administrator is configuring a Site-to-Site VPN on an FTD managed by FMC. The administrator wants to ensure that only specific remote subnets are allowed to initiate VPN connections, while other subnets can only receive connections. Which configuration element should be used to enforce this restriction?

Accepted Answer

VPN filter. In FTD Site-to-Site VPN, a VPN filter is used to control which remote networks can initiate connections. By default, any protected network can initiate. The VPN filter allows granular control, enabling the administrator to permit only specific subnets to initiate while others can only respond. This is configured within the VPN topology settings.

Answer

Access Control List (ACL) on the outside interface

Answer

Protected networks

Answer

IKEv2 policy

Question 15

An engineer is configuring a new Cisco FTD device registered to an FMC. The organization requires that all management traffic between the FMC and the FTD be encrypted and mutually authenticated. The FMC's certificate must be validated by the FTD using a specific internal CA. Which configuration step must be performed on the FTD to meet these requirements?

Accepted Answer

Enroll the FTD with the internal CA using the FMC's PKI enrollment object and enable certificate-based authentication for the management connection.. To achieve encrypted and mutually authenticated management traffic, the FTD must enroll with the internal CA and use certificate-based authentication. This allows the FTD to validate the FMC's certificate and present its own for the FMC to validate. Other options provide encryption but lack mutual authentication or rely on untrusted certificates.

Answer

Enable HTTPS on the FTD management interface and import the FMC's certificate into the FTD trust store.

Answer

Use the default self-signed certificates generated during FTD initialization and enable TLS 1.2.

Answer

Configure a site-to-site VPN tunnel between the FMC and FTD for management traffic.