300-710 SNCF Configuration Practice Test 7 — 15 Questions

Question 1

An administrator is configuring SSL Decryption to inspect internal clients browsing external websites. The organization wants to ensure that traffic to financial and health-related websites is bypassed to maintain privacy and regulatory compliance. How should this be configured in the SSL Policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a rule matching the Financial/Health URL categories with the action 'Do Not Decrypt'.. Privacy and regulatory compliance for financial and health traffic is achieved by creating an SSL policy rule that matches the Financial and Health URL categories and sets the action to 'Do Not Decrypt'. This bypasses decryption for those flows while still allowing the rest of the SSL policy to decrypt other traffic. The rule should be placed above any broader Decrypt rules so it matches first.

Answer

Use an Intrusion Policy rule to drop packets destined for financial URLs.

Answer

Add financial servers to an SSL Decryption Known Key list.

Answer

Configure a Prefilter policy to fast-path financial URL categories.

Question 2

An FTD device is deployed behind a service provider router that performs NAT, meaning the external IP address assigned to the FTD's outside interface changes dynamically via DHCP. How should a Manual NAT rule be configured to handle outbound traffic referencing this dynamic outside IP?

Accepted Answer

Configure Dynamic PAT using the Outside Interface as the translated address.. When the outside interface IP is dynamic, Manual NAT can use the interface itself as the translated address (Interface PAT).

Answer

Configure Auto NAT with a translated network object set to dynamic.

Answer

Use a static IP address object matching the expected DHCP lease.

Answer

Use Identity NAT with dynamic DHCP options.

Question 3

An administrator wants to ensure that specific internal subnets are never subjected to NAT translation when communicating with a partner VPN tunnel. Which NAT feature achieves this?

Accepted Answer

Identity NAT. Identity NAT (also called NAT exemption or 'no NAT') is the feature that explicitly excludes specified source/destination subnet pairs from translation. In Cisco FTD/FMC, an Identity NAT rule is placed in the manual NAT policy with the original source and destination as both the translated source and destination, effectively creating a 'do not translate' entry. This is the standard method for ensuring VPN traffic to a partner tunnel traverses without address rewriting, which is required for IPsec/ISAKMP selectors to match correctly.

Answer

Auto NAT Static

Answer

Dynamic PAT

Answer

Port Address Translation

Question 4

An administrator is troubleshooting an SSL Decryption policy where encrypted connections are failing. The FMC logs indicate that clients are rejecting the FTD's re-signed certificate because it is not trusted. What configuration step is missing?

Accepted Answer

Deploy the FTD's Re-signing CA certificate to the trusted root certification authorities store of all internal client endpoints.. When FTD performs SSL decryption via re-signing, it acts as a man-in-the-middle: it intercepts the client's TLS session and presents a certificate signed by its own Re-signing CA. For clients to accept this certificate without errors, the FTD's Re-signing CA certificate must be installed in the trusted root CA store of every internal endpoint. Without that trust anchor, clients reject the re-signed certificate and the connection fails.

Answer

Configure a Prefilter policy to bypass SSL handshakes for those clients.

Answer

Import the server's private key into the FTD certificate store.

Answer

Enable SSL Known Key decryption for external websites.

Question 5

An administrator is configuring Security Intelligence on the FMC to drop traffic from known malicious IP addresses. Where in the Access Control Policy is Security Intelligence evaluated relative to standard access rules?

Accepted Answer

Before Access Control rules are evaluated. Security Intelligence is evaluated before access control rules in the FMC access control policy. This allows the system to quickly drop traffic from known malicious IP addresses, URLs, or DNS names without having to process the full access control rule set. This pre-evaluation improves performance and security by blocking threats early.

Answer

Inside the Prefilter policy configuration menu

Answer

After all Access Control rules are evaluated as a fallback action

Answer

Concurrently with Intrusion Policy inspection

Question 6

An administrator is creating an Access Control Policy rule on the FMC. Which TWO elements are required to create a basic rule? (Choose two)

Accepted Answer

Rule Name. Option A (Rule Name) is correct because the FMC Access Control Policy rule editor requires a unique name to identify the rule within the policy; without a name, the rule cannot be saved. Option C (Action) is correct because every access control rule must specify what happens to matching traffic — Allow, Block, Monitor, Trust, or Block with Reset — and this action determines how the rule is enforced. The remaining options are not mandatory for a basic rule: Source Security Zone (B) is optional and defaults to any zone, Destination Port Object (D) is optional and defaults to any port, and Intrusion Policy assignment (E) is an optional inspection setting applied only when the rule action permits further inspection.

Answer

Source Security Zone

Answer

Destination Port Object

Answer

Intrusion Policy assignment

Question 7

An administrator needs to define network objects in the FMC Object Management menu. Which THREE object types are natively supported for network definition? (Choose three)

Accepted Answer

Host Object. FMC supports Host, Range, Network (subnet), FQDN, and Network Group objects for network definitions.

Answer

Port Object

Answer

Application Filter Object

Question 8

An administrator is configuring an Identity Policy to enforce user-based access control. Which THREE identity sources are supported by the FMC for user awareness? (Choose three)

Accepted Answer

RADIUS Server (Authentication and Accounting). Option A (RADIUS Server with Authentication and Accounting) is correct because FMC can consume RADIUS accounting records (via the RADIUS Accounting Start/Stop messages) to map IP addresses to usernames for user awareness, and it can also use RADIUS authentication events as an identity source. Option B (Captive Portal for active web authentication) is correct because FMC supports an active authentication identity source where users are redirected to a captive portal and must log in, after which their IP-to-user mapping is learned for the duration of the session. Option D (Active Directory via AD Agent or Cisco ISE Passive Authentication) is correct because FMC integrates with Active Directory through the Cisco AD Agent (or directly via ISE) and with Cisco ISE using passive authentication (pxGrid/MnT) to receive user-to-IP mappings without user interaction. Option C is not a supported FMC user awareness identity source because FMC does not scrape arbitrary syslog servers for user identity without an agent or supported integration. Option E is not supported because SNMP MIB walks retrieve device and interface statistics, not user identity information, and FMC has no local SNMP MIB-walk identity source.

Answer

Syslog server log scraping without agent integration

Answer

Local SNMP MIB walk queries

Question 9

An administrator is configuring an SSL Decryption Policy on the FMC. Which TWO conditions or actions can be configured within an SSL rule? (Choose two)

Accepted Answer

Matching traffic based on URL Categories (e.g., Banking, Gambling). Option A is correct because SSL rules on the FMC can match traffic using URL Category conditions (such as Banking or Gambling), which are evaluated against the URL/certificate information available before or during decryption. Option B is correct because 'Decrypt - Resign' is one of the standard SSL rule actions, in which the firewall acts as a man-in-the-middle, re-signing the server certificate with its own internal CA so the traffic can be inspected. Option C is incorrect because static route metrics are configured in the routing table (virtual router), not within an SSL decryption rule. Option D is incorrect because QoS rate limiting is handled by QoS policies, not SSL rules. Option E is incorrect because Snort 3 intrusion signatures are enforced through intrusion policies that are invoked as part of access control, not directly inside the SSL policy itself.

Answer

Configuring static route metrics for decrypted packets

Answer

Defining QoS rate limits for HTTPS sessions

Answer

Enforcing Snort 3 Intrusion rule signatures directly inside the SSL policy

Question 10

An administrator is troubleshooting a Prefilter Policy configured on an FMC. Which THREE actions are available when creating a rule in a Prefilter Policy? (Choose three)

Accepted Answer

Slow Path (send traffic through normal inspection pipeline). In an FMC Prefilter Policy, each rule can take one of three actions: Block, which drops matching traffic immediately without further inspection (option D); Fast Path, which bypasses the inspection pipeline and fast-forwards traffic (option E); and Slow Path, which sends traffic through the normal inspection pipeline for further analysis (option C). These three actions are the only ones available at the prefilter stage, which exists to reduce the load on the Snort inspection engine by handling traffic before it reaches the access control policy. Option A (Decrypt - Resign) is an SSL policy action, not a prefilter rule action, and option B (Inspect with Snort 3 Intrusion Prevention) is an access control rule action, so neither belongs in a Prefilter Policy rule.

Answer

Decrypt - Resign (intercept and re-sign SSL certificate)

Answer

Inspect with Snort 3 Intrusion Prevention

Question 11

An administrator is configuring Security Intelligence feeds on the FMC. Which TWO types of objects or feeds can be used to populate Security Intelligence blacklists? (Choose two)

Accepted Answer

Custom Network/IP Lists (Objects). Security Intelligence supports custom network/IP lists and Cisco provided dynamic feeds (like reputation feeds for URLs and IPs).

Answer

Local user identity realm database

Answer

Prefilter fast-path exclusion rules

Answer

QoS class map profile objects

Question 12

An administrator is configuring interface-level QoS on an FTD device. Which THREE parameters or features can be configured within an FTD QoS policy? (Choose three)

Accepted Answer

DSCP Marking. Qos policies on FTD support rate limiting, traffic shaping, priority queuing, and marking DSCP values.

Answer

Active Directory user group mapping

Answer

Automatic IP address translation (NAT mapping)

Question 13

An administrator is configuring a Network Address Translation (NAT) rule on a Cisco FMC managed Threat Defense device. The requirement is to translate the source IP address of traffic coming from the inside zone going to the outside zone, but only for a specific internal subnet. Which NAT type must the administrator select in the FMC NAT rule configuration?

Accepted Answer

Auto NAT (Object NAT). Auto NAT (Object NAT) in Cisco FMC is used to translate the source IP address of traffic for a specific object (such as an internal subnet) when it matches the specified conditions. It is configured within the object definition and is the simplest way to perform source NAT for a given subnet. Manual NAT is used for more complex scenarios, such as when both source and destination translation are needed or when NAT rules must be ordered.

Answer

Twice NAT (Destination NAT)

Answer

Prefilter NAT

Answer

Manual NAT (Identity NAT)

Question 14

A security engineer is creating an Access Control Policy (ACP) in FMC. The policy must block all traffic matching specific URL categories while allowing standard web browsing. However, the administrator wants users to receive a warning page before continuing to pages categorized as "Potentially Damaging Content" rather than a hard block. Which action should the engineer assign to the URL category in the ACP Rules tab?

Accepted Answer

Interactive Block. In an FMC Access Control Policy, the 'Interactive Block' action for a URL category presents users with a warning page that they can acknowledge to continue to the site. This matches the requirement to warn users before proceeding to 'Potentially Damaging Content' pages rather than hard-blocking them. The other actions either block outright, allow silently, or only log.

Answer

Block

Answer

Allow

Answer

Monitor

Question 15

An administrator is implementing an SSL Decryption Policy on a Cisco Firepower Threat Defense device managed by FMC. The policy must decrypt outbound HTTPS traffic to inspect for malware, but certain financial domains must be excluded from decryption to comply with privacy regulations. Which rule action should be configured for these specific financial domains in the SSL Decryption Policy?

Accepted Answer

Do Not Decrypt. To prevent inspection and decryption of sensitive traffic while allowing it to pass through the firewall, the Do Not Decrypt action is used in the SSL Decryption Policy.

Answer

Decrypt - Known Key

Answer

Block

Answer

Decrypt - Resign