300-710 SNCF Configuration Practice Test 4 — 15 Questions

Question 1

An administrator is configuring manual NAT on an FTD device managed by FMC. Which TWO parameters must be defined when creating a manual NAT rule? (Choose two)

Accepted Answer

Original Source. Manual NAT rules require defining the NAT type (Static or Dynamic) and the Original Source (along with other matching parameters like interfaces or destination).

Answer

Prefilter FastPath action

Answer

Security Intelligence Whitelist

Answer

Snort Inspection Engine Mode

Question 2

An administrator is troubleshooting an Access Control Policy where multiple rules could potentially match a specific packet. In what order does the FMC evaluate rules within an Access Control Policy?

Accepted Answer

Top-down within the configured sections: first Prefilter, then Security Intelligence, then Mandatory Access Rules, then Default Access Rules, then Default Action.. Access Control rules are evaluated in a top-down, first-match manner within sections (Mandatory, Default, etc.).

Answer

From bottom to top, with more specific rules evaluated last.

Answer

Simultaneously across all rules using hardware ASIC parallel processing.

Answer

Based on rule hit count optimization, putting frequently matched rules at the top automatically.

Question 3

An administrator needs to configure Active Authentication using a captive portal on an FTD device. Which firewall feature must be properly configured and running to present the authentication prompt to users?

Accepted Answer

HTTP/HTTPS Response Page and Authentication Certificate configuration. Captive portal active authentication requires an HTTP/HTTPS response server configuration on the FTD to intercept unauthenticated HTTP sessions and prompt for credentials.

Answer

Prefilter Bypass rule with SSL Resign

Answer

SNMPv3 trap notification server

Answer

Platform Settings AAA server group for SSH/Telnet

Question 4

Which THREE actions can be assigned to an individual rule within an Access Control Policy on the FMC? (Choose three)

Accepted Answer

Allow. Access Control rules support actions such as Allow, Block, Interactive Block, Trust, and Monitor.

Answer

Decrypt

Answer

FastPath

Question 5

Which THREE criteria can be used to match traffic within an Access Control rule on the FMC? (Choose three)

Accepted Answer

URL Categories. Access Control rules support matching based on Networks, Ports, Applications, URL categories, Users, and Zones.

Answer

Intrusion Policy Signatures

Answer

Device Platform Settings

Question 6

Which THREE settings can be configured within a Prefilter Policy on the FMC? (Choose three)

Accepted Answer

FastPath action to bypass Snort inspection. Prefilter policies support FastPath, Tunnel rules, and Default Actions (Analyze or FastPath).

Answer

Intrusion Policy signature tuning

Answer

Security Intelligence block lists

Question 7

An administrator is configuring Identity Policies on the FMC. Which TWO identity sources are supported for user mapping and authentication? (Choose two)

Accepted Answer

Active Directory via Firepower User Agent. FMC Identity Policies support Active Directory via User Agent or ISE/pxGrid integration, along with RADIUS and captive portal.

Answer

Syslog server parsing for DHCP leases

Answer

SNMP trap listener

Answer

Local FTD administrator database

Question 8

When configuring manual NAT on an FTD device, which THREE options are available for configuring the Translated Source? (Choose three)

Accepted Answer

Specific IP Address or Network Object. Translated source options in manual NAT include Interface (PAT), Network/Host Object, and Dynamic Pool.

Answer

Prefilter FastPath target

Answer

Security Intelligence blacklist feed

Question 9

An administrator is managing object configurations on the FMC. Which TWO of the following are valid object types that can be created under Object Management? (Choose two)

Accepted Answer

Port. FMC Object Management supports Networks, Ports, URLs, Security Zones, Application Filters, and more.

Answer

NAT Rule Set

Answer

Platform Setting

Answer

Access Control Rule

Question 10

Which THREE methods can be used to populate IP address objects or groups in the FMC Object Management? (Choose three)

Accepted Answer

CIDR Network subnet. IP objects can be populated using individual IP addresses, CIDR network subnets, IP ranges, or FQDNs.

Answer

Intrusion Signature ID number

Answer

Mac Address OUI prefix

Question 11

An administrator is configuring Security Intelligence in FMC. Which TWO types of objects can be added to Security Intelligence blacklists or whitelists? (Choose two)

Accepted Answer

URL objects. Security Intelligence supports IP address objects/networks and URL objects/feeds.

Answer

Intrusion policy objects

Answer

Security Zone objects

Answer

Application filter objects

Question 12

A network engineer is deploying a Firepower Threat Defense (FTD) device and must configure NAT to translate an internal server IP of 10.10.10.50 to a public IP of 203.0.113.50 while preserving the original source port for inbound traffic. Which NAT type accomplishes this?

Accepted Answer

Manual Static NAT. Manual Static NAT allows the translation of a specific internal IP to a specific external public IP while supporting port translation and preservation options.

Answer

Auto NAT (Dynamic PAT)

Answer

Manual Identity NAT

Answer

Auto NAT (Static Patched)

Question 13

An administrator configures an SSL Decryption Policy on the FMC to decrypt inbound HTTPS traffic destined for an internal web server. The administrator imports the private key and server certificate into the FMC. Which decryption action must be selected to allow the FTD to decrypt this traffic using the server's private key?

Accepted Answer

Decrypt - Known Key. Decrypt - Resign is used for outbound, while Decrypt - Known Key is used when you own the server and supply its private key to decrypt inbound traffic.

Answer

Do Not Decrypt

Answer

Decrypt - Resign

Answer

Block

Question 14

An Identity Policy is configured on the FMC to authenticate users connecting through the FTD. The administrator wants to use Active Directory as the identity source. Which mechanism must be configured to map user IP addresses to usernames without requiring explicit web authentication?

Accepted Answer

Passive Authentication via AD Agent or ISE. Passive authentication utilizes the Cisco User Agent or Firepower Identity Services Engine (ISE) / AD agent to map IP addresses to usernames transparently.

Answer

Captive Portal

Answer

Local User Database

Answer

RADIUS Server Authentication

Question 15

An administrator wants to group multiple existing port objects (e.g., TCP 80, TCP 443, TCP 8080) into a single object for use in Access Control Policy rules. Which object container should be created?

Accepted Answer

Port Group Object. Port Group objects allow administrators to combine multiple port or port range objects into a single manageable item.

Answer

Port Object

Answer

Protocol Object

Answer

Application Filter Object