300-710 SNCF Configuration Practice Test 5 — 15 Questions

Question 1

An administrator is configuring a Cisco FTD device managed by FMC to perform URL filtering. The administrator wants to block access to a specific category of websites for a group of users, but allow access for a different group. Which FMC configuration element should be used to differentiate the user groups?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identity Policy with Realm and User Group mappings. To differentiate user groups for URL filtering, the administrator must configure an Identity Policy that integrates with a directory server (such as Active Directory) to authenticate users and map them to groups. Access Control rules can then reference these groups and apply different URL Filtering actions. Without an Identity Policy, the FTD cannot identify users or their group memberships.

Answer

Prefilter Policy with user-based rules

Answer

URL Filtering Policy with per-user settings

Answer

Access Control Policy with different rules per user group

Question 2

An administrator is setting up a new Cisco FTD device managed by FMC. The device needs to send syslog messages to an external server for compliance. Where should the administrator configure the syslog server on the FMC?

Accepted Answer

In the FTD device's Platform Settings policy, under Syslog.. Platform Settings policies on FMC are used to configure device-specific parameters like syslog servers. This ensures the configuration is managed centrally and deployed to the FTD. Other options either configure logging events but not the server, apply only to FMC, or use unsupported CLI methods.

Answer

In the FMC's global system settings under Configuration > Syslog.

Answer

In the Access Control Policy, under Logging.

Answer

In the FTD device's CLI using the logging host command.

Question 3

An administrator is configuring a new FTD device in a high-availability pair managed by FMC. The organization requires that the failover link be redundant and that stateful failover be enabled for all traffic. Which TWO configuration steps must be performed on the FMC to meet these requirements? (Choose two.)

Accepted Answer

Configure a redundant failover link using a port-channel interface.. To achieve a redundant failover link, a port-channel must be used. To enable stateful failover for all traffic, the stateful failover option must be enabled. These two steps directly address the requirements. Other options either are unsupported or do not fulfill the specified needs.

Answer

Enable preemption to ensure the primary unit becomes active after a failure.

Answer

Set the failover link to use the management interface.

Answer

Configure a separate failover link for each type of traffic (e.g., data, management).

Question 4

An administrator is configuring a FlexConfig policy on FMC to apply custom CLI commands to an FTD device. The administrator needs to ensure that the commands are applied only when a specific condition is met, such as when a particular interface is up. Which FlexConfig feature should be used?

Accepted Answer

Use the 'Conditional' option with a variable that references the interface status.. FlexConfig conditional logic is implemented using variables and conditional statements (If-Then-Else). By defining a variable that represents interface status, you can conditionally apply CLI commands. Other options do not provide runtime condition evaluation based on interface state.

Answer

Use the 'Deployment' option to schedule the commands after the interface is up.

Answer

Use the 'Template' option to create a reusable snippet that includes the interface check.

Answer

Use the 'Policy Object' option to reference an interface object and apply commands conditionally.

Question 5

An administrator configures an Identity Policy on the FMC to authenticate users via Active Directory using captive portal. Where is the Identity Policy applied within the Firepower configuration hierarchy?

Accepted Answer

Within the Access Control Policy settings on the FMC. In FMC, Identity Policies are not standalone objects; they are referenced inside an Access Control Policy. The Access Control Policy contains the identity policy selection, and the identity policy defines the captive portal, AD realm, and authentication rules. This is why the correct placement is within the Access Control Policy settings on the FMC.

Answer

Directly under Devices > Device Management > Platform Settings

Answer

Inside the SSL/TLS Decryption Policy

Answer

As a standalone rule inside a Prefilter Policy

Question 6

A network engineer needs to configure Auto NAT on a Firepower Threat Defense device managed by FMC to translate internal subnet 10.10.10.0/24 to a single public IP address 203.0.113.50. Which translation type should be selected?

Accepted Answer

Dynamic PAT (Port Address Translation). Dynamic PAT (Port Address Translation) is the correct choice because it translates multiple internal IP addresses to a single public IP address using unique source ports. This allows the entire 10.10.10.0/24 subnet to share one public IP, which is the typical use case for PAT. Static NAT would require a one-to-one mapping, and Dynamic NAT would require a pool of public IPs.

Answer

Static NAT

Answer

Static Identity NAT

Answer

Dynamic NAT

Question 7

An administrator wants to create a Prefilter policy to fast-path (bypass Snort inspection for) a trusted backup stream between two data centers. Which action type should be selected in the Prefilter rule?

Accepted Answer

FastPath. In a Prefilter policy, the FastPath action bypasses Snort inspection for trusted traffic, allowing it to be forwarded without deep packet inspection. This is ideal for a trusted backup stream between data centers because it reduces latency and processing overhead. The FastPath action is specifically designed to fast-track traffic that does not require security inspection.

Answer

Monitor

Answer

Block

Answer

Inspect

Answer

Trust

Question 8

An administrator is configuring a new Access Control Policy on the Firepower Management Center and needs to add a rule that blocks peer-to-peer file sharing applications regardless of port. Which rule type should the administrator select?

Accepted Answer

Access control rule. The Access Control Policy on Firepower Management Center (FMC) uses access control rules to inspect and control traffic based on applications, users, ports, and other criteria. To block peer-to-peer file sharing applications regardless of port, the administrator must create an access control rule that matches the application (e.g., BitTorrent) and sets the action to Block. Access control rules leverage Snort-based deep packet inspection to identify applications even when they use non-standard ports or encryption, making them the correct choice for application-based filtering.

Answer

NAT rule

Answer

Identity rule

Answer

Prefilter rule

Question 9

An administrator wants to create a Port object group containing TCP ports 80, 443, and 8080 on the FMC. Where is this object configured?

Accepted Answer

Objects > Object Management > Ports. Port object groups and individual ports are created under Objects > Object Management > Ports.

Answer

Policies > Access Control > Ports

Answer

Devices > Device Management > Object Explorer

Answer

System > Configuration > Port Groups

Question 10

An enterprise requires FTD to decrypt outbound SSL/TLS traffic so internal users visiting external websites can be inspected by Snort for malware. Which policy and action combination must be configured?

Accepted Answer

SSL/TLS Decryption Policy with Decrypt - Resign action. To inspect outbound SSL/TLS traffic from internal users to external sites, FTD must decrypt the traffic using an SSL/TLS Decryption Policy with the Decrypt - Resign action. Resign means FTD acts as a man-in-the-middle, presenting its own certificate to the client and re-establishing a separate TLS session to the server, allowing Snort to see cleartext. This is the only action that enables full inspection of outbound encrypted sessions.

Answer

Prefilter Policy configured with SSL Bypass

Answer

SSL/TLS Decryption Policy with Decrypt - Inbound action

Answer

Access Control Policy with Malware Inspection enabled and no SSL policy

Question 11

An FMC administrator is configuring a URL Filtering policy. They want to block URLs categorized as 'Hacking' while logging the event. Where is this configured within the Access Control Policy?

Accepted Answer

Policies > Access Control > Access Control Policy > Rules > URLs tab. URL Filtering is enforced as part of Access Control rules in the FMC. Within an ACP rule, the URLs tab lets the administrator select URL categories (such as 'Hacking') and set the action to Block while enabling logging on the rule. This binds the URL category match directly to the rule's action and logging behavior.

Answer

Objects > Object Management > URL Objects

Answer

Policies > SSL Decryption > URL Match criteria

Answer

Devices > Device Management > URL Filtering Settings

Question 12

An administrator configures a security intelligence feed in the FMC to block known malicious IP addresses. Where are Security Intelligence feeds and lists applied in the FMC configuration?

Accepted Answer

Under the Security Intelligence tab of the Access Control Policy. Security Intelligence feeds and lists in FMC are configured under the Security Intelligence tab of the Access Control Policy. This tab lets you apply source/destination block lists and feeds globally to the policy, with options for block, monitor, or allow actions. It is not a per-rule setting or a standalone object.

Answer

Directly inside the Prefilter policy configuration

Answer

Within individual Access Control rules under the Source/Destination tabs

Answer

Under Objects > Security Intelligence > Rule Mapping

Question 13

When configuring an Access Control Policy on the FMC, what is the purpose of the Default Action set at the bottom of the rules table?

Accepted Answer

It defines the action taken for traffic that matches no explicit rules in the policy.. The Default Action at the bottom of the FMC Access Control Policy rules table specifies what happens to traffic that does not match any explicit rule above it. Common settings are Block (default deny) or Allow (permit), and it can also invoke an intrusion policy or send to a captive portal.

Answer

It sets the global timeout values for all TCP connections.

Answer

It acts as a prefilter rule for dropped packets.

Answer

It forces all unmatched traffic to be sent to the Cisco Cloud for telemetry.

Question 14

An FTD device is deployed in routed mode with multiple security zones. An administrator needs to configure an Access Control rule that evaluates traffic flowing between two different security zones. How are security zones utilized in the rule?

Accepted Answer

Security zones are selected under the Zones tab of an Access Control rule as Source and Destination.. In FMC, an Access Control rule includes a Zones tab where you select the source and destination security zones (interface groups) that the rule should match. Traffic flowing between two different security zones is matched by specifying those zones as Source and Destination in the rule, allowing zone-based policy enforcement.

Answer

Security zones replace IP address objects entirely in all rule configurations.

Answer

Security zones are used exclusively in NAT translation rules.

Answer

Security zones are assigned globally in device platform settings, not in access rules.

Question 15

An engineer is configuring a QoS policy on an FMC-managed FTD and needs to police traffic to a maximum bandwidth limit on an interface. Which shaping/policing parameter must be configured?

Accepted Answer

Traffic Policing with specified Committed Information Rate (CIR). Traffic policing on FTD is configured via a QoS policy that enforces a maximum bandwidth limit using a Committed Information Rate (CIR). The CIR defines the average rate allowed, and traffic exceeding it is dropped or marked down, directly capping bandwidth. This is the standard mechanism for rate limiting on an interface in Cisco Secure Firewall, and it must be applied through the FMC QoS policy.

Answer

Prefilter FastPath Rate Cap

Answer

Access Control Rate Limiting action

Answer

Random Early Detection (RED) drop threshold