300-710 SNCF Deployment Practice Test 3 — 15 Questions

Question 1

You are deploying an FTD unit in transparent mode. Which requirement must be met for the management interface and data interfaces during the initial configuration?

Accepted Answer

The FTD must be configured with a bridge group, and the management interface must have an IP address for connectivity.. In transparent mode, the FTD acts as a Layer 2 firewall. The management interface must be configured to provide access to the device, but the data interfaces do not require IP addresses for traffic processing, although they must be bridged.

Answer

Transparent mode is only supported when using the FTD inside a virtual port channel (vPC).

Answer

Data interfaces must be configured with an IP address on the same subnet as the management interface.

Answer

The management interface must be on a separate physical switch from the data interfaces.

Question 2

When deploying an FTD cluster, which component is responsible for distributing traffic across the members of the cluster?

Accepted Answer

The external load balancer using EtherChannel hash algorithms.. In an FTD cluster, the control node (or a dedicated switch using EtherChannel) handles traffic distribution based on the configured load-balancing method.

Answer

The standby unit.

Answer

The primary management console.

Answer

The virtual MAC address shared by the cluster.

Question 3

An administrator is deploying an FTD in a virtual environment. What is the minimum recommended vCPU and RAM configuration for an FTDv instance?

Accepted Answer

4 vCPUs, 8GB RAM. FTDv instances have specific requirements (e.g., 4 vCPUs and 8GB RAM minimum for basic functionality) which must be met to ensure stability.

Answer

8 vCPUs, 16GB RAM

Answer

1 vCPU, 2GB RAM

Answer

2 vCPUs, 4GB RAM

Question 4

Which interface configuration is required to allow traffic to pass between two interfaces that belong to the same bridge group?

Accepted Answer

A bridge group interface (BVI) with an IP address.. In Cisco Secure Firewall (FTD/ASA) transparent mode, a Bridge Virtual Interface (BVI) is the routed/logical interface that represents the bridge group. The BVI must be assigned an IP address and be in the up state for the firewall to pass traffic between member interfaces in the same bridge group, because the BVI is the Layer 3 anchor for the bridged domain. Without an IP on the BVI, the bridge group has no logical interface to forward traffic through, and the member interfaces remain administratively down for transit.

Answer

A static route to the BVI.

Answer

A VLAN trunk configuration.

Answer

An IP address on both interfaces.

Question 5

An administrator is setting up FTD HA. Which of the following is true regarding the configuration synchronization between the primary and secondary units?

Accepted Answer

The FMC pushes configurations to both units in the HA pair.. The FMC manages the configuration of the HA pair and pushes the same configuration to both units, ensuring they remain synchronized.

Answer

Only the security policies are synchronized, not interface settings.

Answer

The standby unit must be configured manually to match the active unit.

Answer

The standby unit uses a different policy than the active unit.

Question 6

You are deploying an FTD in AWS. What is the correct way to handle the internal IP addresses of the FTD instances in an HA pair?

Accepted Answer

Use a virtual IP via API calls to the VPC route table.. In AWS, you assign virtual secondary IPs or use Elastic IPs to ensure that traffic is routed correctly even after a failover event.

Answer

Configure VRRP on the interfaces.

Answer

Use physical interface MAC pinning.

Answer

Configure a cluster control link.

Question 7

When configuring an FTD cluster, what is the maximum number of nodes supported in a single cluster?

Accepted Answer

16. The FTD clustering architecture supports up to 16 nodes in a single cluster.

Answer

4

Answer

8

Answer

2

Question 8

Which THREE of the following are supported methods for FTD failover mechanism?

Accepted Answer

Stateful failover.. Stateful failover (A) is correct because FTD supports active/standby high availability, where the standby unit synchronizes connection and state information so that established sessions survive a failover. Clustering (C) is correct because FTD supports clustering, in which multiple devices are grouped into a single logical unit to provide both redundancy and increased throughput/load sharing. Redundant interfaces (E) are correct because FTD allows two physical interfaces to be bundled as a redundant interface pair, so if one link fails the other takes over at the interface level. Transparent proxy failover (B) is not a failover mechanism FTD offers, and manual interface switching (D) is an administrative action rather than a supported automated failover method.

Answer

Transparent proxy failover.

Answer

Manual interface switching.

Question 9

Which TWO of the following are valid requirements for setting up an FTD high availability pair?

Accepted Answer

The units must be the same FTD model.. Option D is correct because an FTD high-availability pair requires both appliances to be the same hardware model, ensuring identical interface layout and failover capabilities. Option E is correct because both units must run identical FTD software versions to maintain stateful failover and configuration compatibility. Option A is not a documented requirement, as HA pairing is based on model and software version rather than memory size. Option B is incorrect because both FTD units in an HA pair are typically managed by the same FMC instance. Option C is incorrect because HA peers must be on the same subnet for failover communication and state sharing.

Answer

The units must have the same amount of memory.

Answer

The units must be managed by different FMC instances.

Answer

The units must be in different subnets.

Question 10

Which TWO of the following are required when configuring a static route with tracking?

Accepted Answer

Track ID association in the static route.. Option D is correct because a tracked static route must reference the tracking object by its track ID (for example, 'ip route 10.1.1.0 255.255.255.0 192.168.1.1 track 1'), which binds the route's presence to the state of that tracked object. Option E is correct because the track object itself is typically driven by an SLA Monitor (IP SLA) operation, such as 'ip sla 1' with an ICMP-echo probe, whose reachability result the track object monitors to decide whether the static route stays installed. Options A, B, and C are not required: interface tracking groups, BGP weight, and OSPF cost are unrelated to static route tracking, since static routes do not use BGP attributes or OSPF metrics, and tracking is accomplished through the track/SLA mechanism rather than an interface tracking group.

Answer

Interface tracking group.

Answer

BGP weight.

Answer

OSPF cost value.

Question 11

Which THREE of the following are necessary to configure an FTD in passive mode?

Accepted Answer

Disable the interface IP address.. In FTD passive mode, the sensing interface must not participate in routing or have an IP address, so option B (Disable the interface IP address) is required to keep the interface in a promiscuous, non-addressed state. Option D (Connect to a SPAN or TAP source) is necessary because passive mode relies on receiving a copy of traffic from a switch SPAN port or a network TAP rather than inline traffic. Option E (Configure the interface as 'Passive') is correct because the FTD interface mode must explicitly be set to Passive in the FMC interface configuration for the device to operate in passive mode. Option A is not required because a passive interface does not route traffic, so no static route is needed. Option C is not required because hardware bypass applies to inline fail-to-wire deployments, not passive monitoring.

Answer

Assign a static route to the passive interface.

Answer

Enable hardware bypass.

Question 12

Which THREE interface types are supported on FTD appliances?

Accepted Answer

Port channel interfaces.. On Cisco Firepower Threat Defense (FTD) appliances, the supported interface types include physical interfaces (D), which are the actual hardware ports on the appliance and serve as the foundation for all other interface configurations. Sub-interfaces (E) are also supported, allowing multiple logical VLAN-tagged interfaces to be created on a single physical interface for 802.1Q trunking. Port channel interfaces (A) are supported as well, enabling link aggregation (EtherChannel/LACP) across multiple physical interfaces for redundancy and increased throughput. Bridge-only interfaces (B) are not a valid FTD interface type; bridging is achieved via Bridge Group Virtual Interfaces (BVI), not a standalone 'bridge-only' type. Virtual-router interfaces (C) are not an FTD interface type either — virtual routers are a concept in Cisco IOS-XE routing, whereas FTD uses a single routed mode with static or dynamic routing protocols, not per-interface virtual routers.

Answer

Bridge-only interfaces.

Answer

Virtual-router interfaces.

Question 13

When deploying FTD in a virtual environment on AWS, which feature allows the firewall to handle high-bandwidth traffic by distributing it across multiple interfaces using ECMP?

Accepted Answer

ECMP Routing. ECMP (Equal-Cost Multi-Path) allows routing traffic across multiple equal-cost paths, which is essential for scaling performance in virtual deployments.

Answer

Static Route Tracking

Answer

Port Channels

Answer

Clustering

Question 14

You have an FTD device and need to perform deep packet inspection without changing the network topology or IP addressing. Which deployment mode should you choose?

Accepted Answer

Transparent mode. Transparent mode allows the FTD to act as a Layer 2 bridge, inspecting traffic without changing IP addressing or network topology. The firewall is inserted inline but does not participate in routing, so existing IP schemes remain intact. This is ideal when you need deep packet inspection but cannot re-address the network.

Answer

Routed mode

Answer

Virtual wire mode

Answer

Inline set mode with routing

Question 15

When planning an FTD high availability deployment, which TWO requirements are critical for the link between the two firewalls?

Accepted Answer

The link must have low latency for heartbeat messages.. Option D is correct because the failover link carries heartbeat/keepalive messages between the FTD peers, and low latency is essential so that hello and heartbeat packets are exchanged promptly; excessive delay can cause missed heartbeats and trigger unnecessary or failed failover events. Option E is correct because Cisco recommends a dedicated physical connection (direct cable or dedicated switch port) for the failover link so that user traffic, routing updates, or congestion on shared interfaces cannot interfere with stateful failover and heartbeat communication. Option A is incorrect because OSPF is a routing protocol and is not required on the failover link; the failover link is a Layer 2 link used for failover messaging and state replication, not dynamic routing. Option B is incorrect because the failover link must be on its own dedicated subnet, separate from the management interface, to isolate failover traffic. Option C is incorrect because while Cisco recommends at least 1 Gbps for the failover link in many deployments, it is a recommendation rather than a strict critical requirement, and the question asks for critical requirements.

Answer

The link must be configured with OSPF.

Answer

The link must be on the same subnet as the management interface.

Answer

The link must be at least 1Gbps.