300-710 SNCF Configuration Practice Test 6 — 15 Questions

Question 1

An administrator configures DNS injection and rewriting in a manual NAT rule on an FTD device. What is the primary purpose of enabling DNS translation in a NAT rule?

Accepted Answer

To rewrite DNS A-records returning internal server IPs so external clients receive the correct public NAT IP. DNS translation (DNS injection and rewriting) in a manual NAT rule rewrites DNS A-records in DNS responses so that when an internal server's DNS reply contains a private IP, external clients receive the corresponding public NAT IP instead. This ensures clients connect to the correct translated address.

Answer

To cache DNS responses locally on the FTD control plane

Answer

To encrypt DNS queries over TLS (DoT)

Answer

To block malicious DNS tunneling attempts via Snort inspection

Question 2

An engineer wants to group several FTD interfaces into a single logical zone to simplify Access Control rule creation. Where are security zones created in the FMC?

Accepted Answer

Objects > Object Management > Security Zones. Security zones are created under Objects > Object Management > Security Zones.

Answer

System > Integration > Security Zones

Answer

Policies > Access Control > Zones

Answer

Devices > Device Management > Interfaces > Zones

Question 3

An administrator is configuring a Prefilter policy to handle GRE-encapsulated traffic. Which Prefilter rule option allows handling or accelerating tunneled traffic?

Accepted Answer

Tunnel rule type. In an FTD Prefilter policy, the Tunnel rule type is specifically designed to match and handle tunneled (encapsulated) traffic such as GRE, IP-in-IP, and Teredo before the outer header is stripped. A Tunnel rule lets the administrator either block the tunnel outright or 'fast-path' it so the encapsulated payload is not inspected, which is essential for performance and for handling protocols the Snort engine cannot natively parse. This is the only Prefilter rule type that explicitly addresses tunneled traffic handling.

Answer

Access Control rule with GRE protocol filter

Answer

SSL Decryption Policy Tunnel Decrypt

Answer

NAT rule with Protocol Rewriting

Question 4

An administrator wants to configure an Access Control rule that triggers an Intrusion Policy only when specific vulnerability signatures match. Where is the Intrusion Policy assigned?

Accepted Answer

Under the Inspection tab of an individual Access Control rule. In Cisco Secure Firewall Management Center (FMC), an Intrusion Policy is assigned under the Inspection tab of an individual Access Control rule. This allows the rule to trigger intrusion inspection only when the traffic matches the rule's conditions (e.g., specific source/destination, application, or URL). This granular assignment ensures that intrusion detection/prevention is applied selectively based on the rule's match criteria.

Answer

Under the Advanced tab of the Access Control Policy globally

Answer

Within the Platform Settings object

Answer

In the Security Intelligence policy settings

Question 5

An administrator needs to create a custom Application filter object in the FMC to easily select cloud storage applications in Access Control rules. Where are application filters created?

Accepted Answer

Objects > Object Management > Application Filters. Application Filters are reusable objects created under Objects > Object Management > Application Filters in the FMC. They let administrators group applications by characteristics such as category, risk, business relevance, or tags, so a single filter can be referenced in Access Control rules instead of listing dozens of individual applications. This is the canonical location for creating custom application filter objects.

Answer

Devices > Device Management > Apps

Answer

System > Configuration > Application Database

Answer

Policies > Access Control > Applications

Question 6

An administrator configures an SSL Decryption Policy with a rule to 'Do Not Decrypt' financial traffic. However, the administrator also wants to ensure that the encrypted session still undergoes basic certificate validation and categorization. How does FTD handle 'Do Not Decrypt' traffic?

Accepted Answer

The FTD extracts SNI and performs URL categorization using the unencrypted Client Hello handshake.. When an SSL policy rule is set to 'Do Not Decrypt', FTD still inspects the TLS Client Hello to extract the Server Name Indication (SNI) and uses it for URL categorization and basic certificate validation. The session remains encrypted, but metadata from the handshake is available for policy enforcement. This allows the administrator to apply URL filtering and other non-decryption inspections without breaking the encrypted flow.

Answer

All inspection, including URL categorization and SNI extraction, is completely bypassed.

Answer

The FTD converts the traffic to plaintext using a self-signed proxy certificate.

Answer

The FTD drops the connection because decryption is mandatory for any inspection.

Question 7

An administrator needs to create a variable set to define specific port or network variables used within Intrusion Rules. Where are variable sets managed in the FMC?

Accepted Answer

Objects > Object Management > Variable Sets. In FMC, variable sets used by Intrusion Rules are managed under Objects > Object Management > Variable Sets. This is where administrators define variables such as $HOME_NET, $EXTERNAL_NET, and port variables that Snort rules reference. The variable sets are then applied to the Intrusion Policy.

Answer

Devices > Device Management > Variables

Answer

System > Localized Variables

Answer

Policies > Access Control > Variables

Question 8

An administrator is configuring manual NAT and needs to specify an interface pair (Source Interface and Destination Interface). Why is defining interface objects important in manual NAT rules?

Accepted Answer

It scopes the translation rule to specific ingress and egress interfaces, preventing unintended translations across other subnets.. In manual NAT on FTD, specifying the source and destination interface objects scopes the translation rule to a specific ingress/egress path. This prevents the rule from matching traffic that enters or exits through other interfaces, which could otherwise cause unintended translations of traffic that should not be NATed. Interface objects in manual NAT are the equivalent of 'interface pair' matching in classic ASA NAT, giving the administrator granular control over where the translation applies.

Answer

It replaces the need for security zones in Access Control policies.

Answer

It forces the FTD to convert the packet from Layer 2 to Layer 3.

Answer

It enables automatic routing table updates for the translated IP address.

Question 9

An administrator is configuring manual NAT on an FTD device managed by FMC. Which TWO parameters must be defined when creating a manual NAT rule? (Choose two)

Accepted Answer

Original Source. Manual NAT rules require defining the NAT type (Static or Dynamic) and the Original Source (along with other matching parameters like interfaces or destination).

Answer

Prefilter FastPath action

Answer

Security Intelligence Whitelist

Answer

Snort Inspection Engine Mode

Question 10

Which THREE criteria can be used to match traffic within an Access Control rule on the FMC? (Choose three)

Accepted Answer

URL Categories. In Cisco FMC, an Access Control rule can match traffic using criteria such as URL Categories (C), which let you filter based on reputation or category of requested web destinations; Applications (D), which identify traffic by application or application group via Snort/App-ID; and Security Zones (E), which match the ingress/egress interfaces assigned to zones. These three are all valid match conditions on the rule's main criteria tabs. Intrusion Policy Signatures (A) are not a match criterion — an Intrusion Policy is an inspection action applied to traffic that already matched the rule. Device Platform Settings (B) are also not a match condition; platform settings are applied via a Platform Settings policy to managed devices, not used to select traffic in an access rule.

Answer

Intrusion Policy Signatures

Answer

Device Platform Settings

Question 11

Which THREE settings can be configured within a Prefilter Policy on the FMC? (Choose three)

Accepted Answer

FastPath action to bypass Snort inspection. Option B is correct because a Prefilter Policy's central purpose is to let early-pass traffic skip deep inspection, and the FastPath action explicitly bypasses Snort so matching flows are forwarded without intrusion or file analysis. Option C is correct because every Prefilter Policy defines a Default Action applied to traffic that matches no prefilter rule, and that default is chosen as either Analyze (send to Snort for full inspection) or FastPath (bypass Snort). Option E is correct because Prefilter Policies include tunnel handling settings that let you analyze or fastpath tunneled traffic such as GRE and IPsec, including inspecting the outer or inner flow. Option A is not part of a Prefilter Policy: Intrusion Policy signature tuning is configured in the Intrusion Policy itself, which the Prefilter Policy only references via the Analyze action. Option D is also not a Prefilter setting: Security Intelligence block lists are configured in the Access Control Policy's Security Intelligence tab, not in the Prefilter Policy.

Answer

Intrusion Policy signature tuning

Answer

Security Intelligence block lists

Question 12

When configuring manual NAT on an FTD device, which THREE options are available for configuring the Translated Source? (Choose three)

Accepted Answer

Specific IP Address or Network Object. In FTD manual NAT, the Translated Source field offers three choices: A 'Specific IP Address or Network Object' lets you statically translate the source to a single host or subnet object; D 'Dynamic IP Address Pool' translates to an address drawn from a configured pool (dynamic NAT); and E 'Interface (Dynamic PAT)' translates to the selected interface's IP using PAT/overload. These correspond to the standard static, dynamic, and PAT source translation methods available in the NAT policy. The unmarked options do not belong: B 'Prefilter FastPath target' relates to prefilter policy actions, not NAT translation, and C 'Security Intelligence blacklist feed' is a Security Intelligence feature for blocking traffic, not a source translation type.

Answer

Prefilter FastPath target

Answer

Security Intelligence blacklist feed

Question 13

Which THREE methods can be used to populate IP address objects or groups in the FMC Object Management? (Choose three)

Accepted Answer

CIDR Network subnet. In Cisco FMC Object Management, IP address objects can be populated by entering a CIDR Network subnet (option B), such as 192.168.1.0/24, which defines a network block by prefix length. Option C, an Individual Host IP address, is also valid because FMC allows creating a host object with a single IPv4 or IPv6 address (for example, 10.10.10.10). Option D, an IP Address Range (start to end), is supported as well, letting you specify a contiguous range such as 192.168.1.10–192.168.1.20. The unmarked options do not belong: an Intrusion Signature ID number (option A) is used for intrusion policy/signature identification, not for defining IP address objects, and a MAC Address OUI prefix (option E) identifies a hardware vendor prefix, not an IP address or subnet.

Answer

Intrusion Signature ID number

Answer

Mac Address OUI prefix

Question 14

An Identity Policy is configured on the FMC to authenticate users connecting through the FTD. The administrator wants to use Active Directory as the identity source. Which mechanism must be configured to map user IP addresses to usernames without requiring explicit web authentication?

Accepted Answer

Passive Authentication via AD Agent or ISE. Passive authentication utilizes the Cisco User Agent or Firepower Identity Services Engine (ISE) / AD agent to map IP addresses to usernames transparently.

Answer

Captive Portal

Answer

Local User Database

Answer

RADIUS Server Authentication

Question 15

An administrator wants to group multiple existing port objects (e.g., TCP 80, TCP 443, TCP 8080) into a single object for use in Access Control Policy rules. Which object container should be created?

Accepted Answer

Port Group Object. A Port Group Object is a container that groups multiple port objects (e.g., TCP 80, 443, 8080) into a single reusable object. This allows administrators to reference the group in Access Control rules instead of listing each port individually, simplifying policy management. Port Group Objects are specifically designed for this purpose in FMC.

Answer

Port Object

Answer

Protocol Object

Answer

Application Filter Object