300-710 SNCF Configuration Practice Test 8 — 15 Questions

Question 1

An administrator needs to configure Quality of Service (QoS) on a Cisco Firepower Threat Defense device via FMC to limit peer-to-peer traffic bandwidth. Where must the QoS policy be applied for it to take effect on traffic traversing the firewall?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assigned to Security Zones in the Access Control Policy QoS tab. In FMC, a QoS policy is applied to the Access Control Policy by assigning it to security zones on the QoS tab. The QoS policy defines rate limiting and prioritization, and it takes effect only when associated with zones that carry the traffic traversing the FTD. This is the correct location for applying QoS to limit peer-to-peer bandwidth.

Answer

Assigned to Access Control Policy rules directly

Answer

Assigned inside Prefilter Policies

Answer

Assigned globally in Platform Settings

Question 2

An engineer is configuring an Identity Policy in FMC to enforce user-based access control. Active Directory integration has been established via User Agent, but the engineer notices that some users authenticated via remote access VPN are not being resolved to their IP addresses. Which feature must be integrated into the identity configuration to capture IP-to-user mappings for remote access VPN users?

Accepted Answer

Cisco Identity Services Engine (ISE) via pxGrid or RADIUS Accounting. Remote access VPN users are authenticated by the VPN headend (e.g., Cisco ASA/FTD or ISE), and their IP-to-user mappings are not learned by the User Agent, which relies on Active Directory security event log parsing on domain controllers. To capture these mappings, FMC must integrate with Cisco ISE via pxGrid or receive RADIUS Accounting records, which provide the user-to-IP binding at the time of VPN session establishment. This allows the Identity Policy to resolve VPN users to their assigned IP addresses.

Answer

FMC Captive Portal

Answer

Terminal Services Agent (TS Agent)

Answer

SNMP polling of the DHCP server

Question 3

An administrator is configuring a Prefilter Policy in FMC to optimize performance on a Cisco Firepower Threat Defense device. The requirement is to completely bypass inspection for a trusted high-speed data backup tunnel between two datacenters using GRE encapsulation. Which prefilter rule action should be selected?

Accepted Answer

Fast Path. The Fast Path action in a Prefilter Policy is specifically designed to bypass all further inspection (including Snort and other deep packet inspection engines) for traffic that matches the rule. This is ideal for trusted high-speed traffic like a GRE-encapsulated backup tunnel, where inspection would add latency and reduce throughput without security benefit. Fast Path effectively offloads the flow to the hardware or fast path, preserving performance. Thus, D is correct.

Answer

Monitor

Answer

Block

Answer

Analyze

Question 4

An administrator is setting up a new Cisco Firepower Threat Defense device and needs to configure platform-level parameters using FMC Platform Settings. Which TWO features can be configured via Platform Settings? (Choose two)

Accepted Answer

SNMP parameters. Options C and E are correct because FMC Platform Settings is specifically designed for platform-level (device-level) configuration rather than traffic inspection policies. SNMP parameters (option C) such as SNMPv2c/v3 community strings, users, hosts, and traps are configured under Platform Settings > SNMP, allowing the FTD to be monitored by an SNMP manager. Syslog Server configuration (option E) is also configured under Platform Settings > Syslog, where you define syslog servers, severity levels, and logging facilities for sending events off-box. Option A is incorrect because SSL decryption certificate assignment is configured within the SSL policy (part of the access control policy configuration), not Platform Settings. Option B is incorrect because NAT is configured as part of the FTD NAT policy, which is a separate policy in FMC. Option D is incorrect because Access Control Policy rules are configured in the ACP itself, not in Platform Settings.

Answer

SSL Decryption Certificate assignment

Answer

Network Address Translation (NAT)

Answer

Access Control Policy rules

Question 5

You are configuring an SSL Decryption policy. Which action is required to ensure that traffic to a specific financial website is excluded from inspection due to compliance reasons?

Accepted Answer

Do Not Decrypt. The 'Do Not Decrypt' action in an SSL Decryption policy explicitly excludes matching traffic from decryption, which is the correct choice for compliance reasons such as financial data that must not be inspected. This action ensures the traffic passes through without being decrypted or resigned, satisfying legal and privacy requirements.

Answer

Decrypt - Resign

Answer

Bypass

Answer

Block

Question 6

You are defining an Access Control Policy rule to allow traffic. If you want to log the connection at the end of the flow only if it matches the rule, which Logging setting is appropriate?

Accepted Answer

Log at End. In Cisco Secure Firewall (Firepower) Access Control Policy, the 'Log at End' setting logs the connection only when the connection is terminated, and only if the connection matched the rule. This is useful for logging allowed traffic without generating a log at the beginning of the connection, which reduces log volume and provides end-of-flow details such as bytes transferred and duration.

Answer

Log at Beginning

Answer

Disable Logging

Answer

Log Both

Question 7

You are configuring SSL decryption. To ensure that traffic to a specific financial domain is NOT decrypted due to privacy regulations, what must you configure in the SSL Decryption Policy?

Accepted Answer

Configure an SSL rule with the 'Do Not Decrypt' action. In Palo Alto Networks SSL decryption policy, the 'Do Not Decrypt' action is specifically designed to bypass decryption for traffic that must remain encrypted for legal, privacy, or compliance reasons. When a financial domain is matched by an SSL rule with this action, the firewall forwards the session without performing any SSL forward proxy or inbound inspection, preserving end-to-end encryption. This satisfies privacy regulations while still allowing the firewall to log the connection metadata.

Answer

Use a 'Monitor' action in the SSL policy

Answer

Create an Access Control Rule with a 'Decrypt' action

Answer

Add the domain to the Prefilter Policy

Question 8

A security requirement mandates that QoS be applied to limit bandwidth for guest users. Where is QoS configured on an FMC-managed FTD?

Accepted Answer

In a separate QoS Policy. QoS policies are defined as a separate policy type in the FMC and then applied to the Access Control Policy.

Answer

Within the Access Control Policy rules

Answer

Under the Platform Settings

Answer

In the Prefilter Policy

Question 9

You are troubleshooting a connectivity issue. The traffic is being dropped by a Prefilter rule. What is the characteristic of traffic handled by a Prefilter policy?

Accepted Answer

It bypasses the Snort engine. Prefilter policies provide a fast path to inspect traffic without the overhead of deep packet inspection.

Answer

It performs full IPS inspection

Answer

It operates at the L7 layer

Answer

It only applies to encrypted traffic

Question 10

You need to map internal users to specific security policies based on their AD group membership. What must be configured in FMC to support this?

Accepted Answer

Identity Policy. Identity policies require an Identity Realm and agent integration to map user IPs to group memberships.

Answer

Access Control Policy

Answer

Network Discovery Policy

Answer

SSL Decryption Policy

Question 11

Which option in the Access Control Policy rule allows you to define a specific application, such as 'Facebook', to be blocked?

Accepted Answer

Applications. The 'Applications' tab in an Access Control Rule allows selection of specific applications for blocking or monitoring.

Answer

URL

Answer

Zones

Answer

Ports

Question 12

Which TWO components must be configured in FMC to enable User Identity mapping for Access Control Rules?

Accepted Answer

Identity Policy. An identity realm (Active Directory connector) and the Identity Policy are both required to map users to their IP addresses.

Answer

QoS Policy

Answer

Network Discovery Policy

Answer

SSL Policy

Question 13

When editing an Access Control Rule, which action allows you to drop traffic while simultaneously sending a TCP RST to the client?

Accepted Answer

Block with Reset. The 'Block with Reset' action drops the connection and sends a reset packet to notify the sender.

Answer

Interactive Block

Answer

Block

Answer

Trust

Question 14

Which THREE criteria can be used to match traffic in an Access Control Policy rule?

Accepted Answer

Application. Access control rules can match based on Source/Destination Network, Applications, and URL categories.

Answer

SSL Certificate Name

Answer

QoS Priority

Question 15

Which TWO settings are available when configuring the 'Logging' tab in an Access Control Rule?

Accepted Answer

Log at End. In Cisco Firepower Management Center, an Access Control Rule's Logging tab lets you choose when to generate connection events for traffic matching the rule, and the two available timing settings are 'Log at Beginning' (option E) and 'Log at End' (option D). 'Log at Beginning' generates a connection event when the connection is first seen, which is useful for capturing attempted connections even if they are later blocked or never complete. 'Log at End' generates the event when the connection closes, providing full session details such as bytes sent/received and duration. 'Log to Cloud' (A) is not a logging-timing option in the Access Control Rule Logging tab, and 'Log every packet' (B) and 'Log at Middle' (C) are not valid settings for this tab.

Answer

Log to Cloud

Answer

Log every packet

Answer

Log at Middle