300-710 SNCF Configuration — Timed 15 Questions

Question 1

An administrator is configuring a network object in the FMC to represent a range of IP addresses from 192.168.1.100 to 192.168.1.200. Which object type should be created?

Accepted Answer

Range. The Range object type allows defining a contiguous sequence of IP addresses from a start IP to an end IP.

Answer

FQDN

Answer

Network

Answer

Host

Question 2

An administrator needs to configure manual NAT on an FTD device to translate both the source IP and source port of outbound packets originating from 192.168.2.50 to a specific public IP 198.51.100.10 and port 50000. Which manual NAT rule element achieves this?

Accepted Answer

Manual NAT rule with Translated Source set to an IP object and dynamic port translation enabled. Manual NAT allows full control over both source and destination translation, including port-level translation. Setting the Translated Source to an IP object and enabling dynamic port translation (PAT) rewrites the source IP to 198.51.100.10 and the source port to 50000, satisfying the requirement. This is the only option that supports translating both IP and port simultaneously in a manual NAT rule.

Answer

Static NAT with Bi-directional enabled

Answer

Auto NAT rule configured with Dynamic PAT

Answer

Identity NAT with Port Forwarding enabled

Question 3

An engineer needs to prioritize voice traffic (DSCP EF) over a constrained WAN interface on an FTD device. Where must the QoS policy be configured and applied?

Accepted Answer

Policies > Access Control > Advanced > QoS, assigned to specific interfaces. QoS policies are created under Objects > QoS > QoS and then applied to an Access Control Policy, specifically assigned to desired egress or ingress interfaces.

Answer

Objects > QoS Policy > Applied globally via Platform Settings

Answer

Policies > Prefilter > QoS Rate Limiting

Answer

Devices > NAT > Advanced QoS tab

Question 4

An administrator wants to decrypt inbound HTTPS traffic destined for a public web server behind a Firepower Threat Defense device. Which type of SSL/TLS decryption policy must be configured on the FMC?

Accepted Answer

Decrypt - Inbound. To decrypt inbound HTTPS traffic destined for a public web server behind an FTD, the administrator must configure a Decrypt - Inbound policy. This policy type is specifically designed to handle traffic entering the network from external sources and destined for internal servers. It allows the FTD to act as a reverse proxy, decrypting the traffic for inspection before re-encrypting and forwarding it to the server.

Answer

SSL Decryption - Do Not Decrypt

Answer

Decrypt - Resign

Answer

SSL Inspection Policy - Outbound

Question 5

An administrator is configuring manual NAT and needs to ensure that the original source port is preserved during translation without port overloading. Which feature should be selected in the manual NAT rule?

Accepted Answer

Check 'Original Port' in the Translated Port settings. Port translation settings in manual NAT include 'Round Robin' or preserving source ports when doing source NAT translations.

Answer

Check 'Pat Pool' with 'Round Robin'

Answer

Disable 'No Proxy ARP'

Answer

Enable 'DNS Server' translation mode

Question 6

An administrator needs to configure an identity policy to authenticate users using an external RADIUS server via Passive Authentication. Which mechanism accomplishes passive user identification?

Accepted Answer

Cisco ISE pxGrid / Firepower User Agent. Passive authentication in FTD relies on external sources like Cisco ISE pxGrid or the Firepower User Agent to provide user-to-IP mappings without prompting the user. These mechanisms passively collect user identity information from Active Directory or other directory services and feed it to FTD, allowing identity policies to enforce user-based rules transparently.

Answer

Captive Portal

Answer

RADIUS Challenge-Response prompt

Answer

HTTP Basic Authentication challenge

Question 7

An administrator needs to create a Geolocation object in the FMC to block traffic originating from a specific country. Where is this object used?

Accepted Answer

In Access Control rules under the Networks tab as Country objects. Geolocation objects are used directly within Access Control rules under the Source/Destination Country criteria.

Answer

In manual NAT rules under Original Source

Answer

In Identity policies to restrict user login locations

Answer

In Prefilter policies under Geo-FastPath

Question 8

An administrator is troubleshooting an Access Control Policy where multiple rules could potentially match a specific packet. In what order does the FMC evaluate rules within an Access Control Policy?

Accepted Answer

Top-down within the configured sections: first Prefilter, then Security Intelligence, then Mandatory Access Rules, then Default Access Rules, then Default Action.. FMC evaluates Access Control Policy rules top-down within defined sections. The evaluation order is: Prefilter policy first (for fast-path/analysis decisions), then Security Intelligence (blocklists/allowlists), then Mandatory Access Control rules, then Default Access Control rules, and finally the Default Action if no rule matches. This deterministic order ensures predictable policy enforcement.

Answer

From bottom to top, with more specific rules evaluated last.

Answer

Simultaneously across all rules using hardware ASIC parallel processing.

Answer

Based on rule hit count optimization, putting frequently matched rules at the top automatically.

Question 9

An administrator needs to configure Active Authentication using a captive portal on an FTD device. Which firewall feature must be properly configured and running to present the authentication prompt to users?

Accepted Answer

HTTP/HTTPS Response Page and Authentication Certificate configuration. Captive portal active authentication requires an HTTP/HTTPS response server configuration on the FTD to intercept unauthenticated HTTP sessions and prompt for credentials.

Answer

Prefilter Bypass rule with SSL Resign

Answer

SNMPv3 trap notification server

Answer

Platform Settings AAA server group for SSH/Telnet

Question 10

Which THREE actions can be assigned to an individual rule within an Access Control Policy on the FMC? (Choose three)

Accepted Answer

Allow. Access Control rules support actions such as Allow, Block, Interactive Block, Trust, and Monitor.

Answer

Decrypt

Answer

FastPath

Question 11

An administrator is configuring an SSL/TLS Decryption Policy. Which TWO decryption actions are available in FMC SSL rules? (Choose two)

Accepted Answer

Do Not Decrypt. FMC SSL/TLS decryption policy rule actions include Do Not Decrypt, Decrypt - Resign, and Decrypt - Inbound.

Answer

Decrypt - Terminate and Drop

Answer

Decrypt - Bypass

Question 12

An administrator is configuring Identity Policies on the FMC. Which TWO identity sources are supported for user mapping and authentication? (Choose two)

Accepted Answer

Active Directory via Firepower User Agent. Option D is correct because the Firepower Management Center supports Active Directory as an identity source through the Firepower User Agent, which communicates with AD domain controllers to retrieve user-to-IP mappings for identity policies. Option E is correct because FMC integrates with Cisco Identity Services Engine (ISE) via pxGrid to obtain user identity and session information for user mapping and authentication in identity policies. Option A is incorrect because syslog parsing of DHCP leases is not a supported identity source on FMC for user mapping. Option B is incorrect because an SNMP trap listener is not used by FMC for identity-based user mapping or authentication. Option C is incorrect because the local FTD administrator database is used for device management access, not for user identity mapping in identity policies.

Answer

Syslog server parsing for DHCP leases

Answer

SNMP trap listener

Answer

Local FTD administrator database

Question 13

An administrator wants to configure QoS on an FMC-managed FTD device. Which TWO components are required to successfully implement a QoS policy? (Choose two)

Accepted Answer

Association of the QoS policy within an Access Control Policy targeting specific interfaces. QoS implementation requires creating a QoS policy under Objects and applying it to an Access Control policy assigned to specific interfaces.

Answer

Platform Settings QoS global service activation

Answer

A Prefilter FastPath rule defining the QoS bandwidth

Answer

Manual NAT port forwarding rules

Question 14

An administrator is managing object configurations on the FMC. Which TWO of the following are valid object types that can be created under Object Management? (Choose two)

Accepted Answer

Port. Option A (Port) is correct because the FMC Object Management section includes Port objects, which define TCP/UDP ports or ranges (e.g., TCP/443) that can be referenced in access control and NAT policies. Option C (Network) is correct because Network objects (hosts, ranges, subnets, and network groups) are core reusable objects created under Object Management for use throughout FMC policies. Option B (NAT Rule Set) is not a reusable object type; NAT rules are configured within NAT policies, not under Object Management. Option D (Platform Setting) is not an object type; platform settings are configured under the System > Configuration area for device-level settings. Option E (Access Control Rule) is a policy rule within an access control policy, not a reusable object created under Object Management.

Answer

NAT Rule Set

Answer

Platform Setting

Answer

Access Control Rule

Question 15

An administrator is configuring Security Intelligence in FMC. Which TWO types of objects can be added to Security Intelligence blacklists or whitelists? (Choose two)

Accepted Answer

URL objects. Security Intelligence in FMC supports two object types for blacklists and whitelists: Network/IP objects (Option C) and URL objects (Option A). Network/IP objects let you block or allow traffic based on source/destination IP addresses, CIDR blocks, or geolocation data, which is the core of IP-based Security Intelligence. URL objects let you block or allow traffic based on domain names or URLs, which is the core of DNS/URL-based Security Intelligence. Intrusion policy objects (Option B) are used to inspect traffic for exploits and are not valid Security Intelligence list entries. Security Zone objects (Option D) are used to group interfaces for policy application, not for IP/URL reputation filtering. Application filter objects (Option E) are used in access control rules to match applications, not in Security Intelligence blacklists or whitelists.

Answer

Intrusion policy objects

Answer

Security Zone objects

Answer

Application filter objects