300-710 SNCF Deployment Practice Test 5 — 15 Questions

Question 1

An administrator is configuring a new Cisco Secure Firewall Threat Defense in routed mode on Firepower Device Manager (FDM). During the initial setup, the administrator needs to define the routing behavior for a multi-zone deployment. Which configuration step is mandatory when setting up routed mode?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign a unique Layer 3 IP address to each data interface and associate it with a security zone.. When configuring a routed mode interface on FDM, each data interface must be assigned a unique Layer 3 IP address and associated with a security zone. This is mandatory because routed mode requires interfaces to act as Layer 3 gateways, and security zones are used to apply policies. Without an IP address and zone, the interface cannot route or be managed.

Answer

Disable the Snort inspection engine on all interfaces to allow bridging.

Answer

Assign a unique MAC address override to every physical interface.

Answer

Create a BVI (Bridge Virtual Interface) for each pair of physical interfaces.

Question 2

An administrator is configuring an inline interface pair on a Cisco Secure Firewall Threat Defense device using Cisco FMC. The business requires that if the firewall experiences a power failure or kernel panic, traffic must continue to flow uninterrupted through the network segment. Which action should the administrator take?

Accepted Answer

Configure the inline set with the 'Fail Open' setting and ensure hardware bypass is supported and enabled on the network module.. Hardware bypass capability (fail-open) on supported Network Interface Modules (NIMs/SMs) allows physical optical or copper paths to bridge automatically when power is lost or the Snort engine crashes.

Answer

Set up a redundant EtherChannel with LACP fast-rate timers.

Answer

Deploy the interfaces in a Bridge Virtual Interface (BVI) group with spanning tree disabled.

Answer

Configure the inline set with the 'Fail Close' setting and enable STP root guard.

Question 3

An engineer is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) instance in an Amazon Web Services (AWS) VPC. The deployment requires the FTDv to inspect traffic crossing between public and private subnets. Which AWS architectural construct is mandatory for routing traffic through the FTDv instance?

Accepted Answer

Custom AWS Route Tables associated with the subnets, pointing traffic destined outside the VPC to the FTDv data interface ENI.. In AWS, traffic is routed between subnets and to the internet based on Route Tables associated with each subnet. To force traffic through an FTDv instance, you must create custom Route Tables whose default route (0.0.0.0/0) or specific destination prefixes point to the FTDv's data interface ENI, and associate those route tables with the public and private subnets. This is the standard AWS 'firewall appliance' architecture and is mandatory for inline inspection.

Answer

Cisco TrustSec Security Group Tags (SGTs) applied to AWS security groups.

Answer

AWS Transit Gateway with static BGP peering enabled to the FTDv management interface.

Answer

Physical bypass NICs installed in the AWS hypervisor layer.

Question 4

When registering a new Cisco Secure Firewall Threat Defense device to Cisco Defense Orchestrator (CDO) or Cisco FMC, what is the primary prerequisite protocol or connectivity requirement that must be established from the managed device toward the management platform?

Accepted Answer

Outbound TCP connection on port 8305 from the FTD to the manager's IP address or registration FQDN.. Managed devices initiate outbound secure communication (typically over TCP port 8305 / sftunnel) to the management platform (FMC or CDO).

Answer

An active SNMPv3 trap receiver configured on the manager pointing to the FTD.

Answer

Inbound SSH access from the management platform IP address to the firewall management interface.

Answer

An IPSec site-to-site VPN tunnel terminating on the data interfaces.

Question 5

An administrator is setting up a high availability pair of Cisco Secure Firewall devices. During the HA configuration wizard in FMC, the administrator is asked to provide a registration key. What is the purpose of this key?

Accepted Answer

It provides mutual authentication and establishes the secure trust relationship between the primary and secondary units.. The registration key (shared secret) is used to securely authenticate and encrypt the initial communication channel between the primary and secondary units during the HA pairing process.

Answer

It authorizes the FMC to push the initial bootstrap image to the standby unit.

Answer

It decrypts encrypted payloads passing across the stateful data links.

Answer

It unlocks the advanced clustering license on both firewalls.

Question 6

An engineer has deployed an active/standby High Availability pair of Cisco Secure Firewall Threat Defense devices. A failure occurs on the active unit, and a failover successfully takes place. However, upon recovery of the original active unit, it immediately resumes its role as the active unit, causing a brief secondary interruption. Which failover setting governs this behavior?

Accepted Answer

Failover Preempt Configuration. Failover Preempt Configuration controls whether a recovered higher-priority unit automatically reclaims the active role. When preempt is enabled, the recovered unit immediately takes back active status, causing the brief secondary interruption described. When preempt is disabled (the default in many deployments), the recovered unit stays in standby and the current active unit retains the role, avoiding the extra failover.

Answer

MAC Address Persistence Timer

Answer

HEMS Poll Frequency

Answer

Stateful Failover Sync Interval

Question 7

You are deploying a Cisco Secure Firewall Threat Defense in transparent mode. How are frames forwarded between the internal and external interfaces of the firewall?

Accepted Answer

By bridging frames at Layer 2 based on destination MAC addresses within a configured Bridge Group.. In transparent mode, the FTD forwards frames at Layer 2 by bridging based on destination MAC addresses within a configured Bridge Group. The firewall does not perform IP route lookups or decrement TTL; it acts like a Layer 2 switch with security inspection. This allows the firewall to be inserted into an existing network without changing IP addressing.

Answer

By encapsulating all packets inside GRE tunnels between the ingress and egress ports.

Answer

By translating all private IP addresses to public IP addresses using NAT overload.

Answer

By performing IP route lookups and decrementing the TTL on every packet.

Question 8

An engineer is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) in Google Cloud Platform (GCP). The architecture requires multiple network interfaces. How does GCP map these interfaces during deployment?

Accepted Answer

GCP allows multiple discrete NICs per instance, with nic0 assigned to management and subsequent NICs mapped to data subnets.. GCP allows multiple Network Interface Cards (NICs) on a single compute instance, where nic0 is typically assigned for management and subsequent nic1, nic2, etc., are assigned for data traffic.

Answer

GCP requires all data traffic to pass through an external HTTP(S) load balancer before reaching nic0.

Answer

GCP supports only a single interface per VM; all VLAN subinterfaces must be trunked through nic0.

Answer

GCP virtual machines cannot be managed by Cisco FMC; they require deployment via Google Deployment Manager only.

Question 9

An administrator is configuring a secure firewall deployment in an environment where dynamic routing via OSPF is required across multiple security zones. Which configuration requirement must be met on the Cisco Secure Firewall Threat Defense?

Accepted Answer

OSPF must be enabled globally, associated with specific areas, and enabled on the specific routed interfaces belonging to security zones.. To run OSPF on Cisco Secure Firewall Threat Defense, you must enable OSPF globally, define it for specific areas, and then enable it on the individual routed interfaces that belong to security zones. This three-step process ensures that OSPF adjacencies form only on intended interfaces and that routing information is exchanged within the correct security context.

Answer

OSPF neighbor adjacencies must terminate on the firewall management interface.

Answer

OSPF requires all participating interfaces to be assigned to the exact same security zone.

Answer

OSPF can only be enabled on transparent bridge virtual interfaces (BVIs).

Question 10

An engineer is configuring a Cisco Secure Firewall Threat Defense cluster in a data center. To ensure high availability and prevent split-brain scenarios, what is the specific function of the cluster control link (CCL)?

Accepted Answer

It synchronizes configuration, connection state tables, and heartbeat health checks between cluster members.. The cluster control link (CCL) is a dedicated network used by FTD cluster members to synchronize configuration, replicate connection state tables, and exchange heartbeat health checks. It ensures that all nodes have consistent state and can detect failures, preventing split-brain by allowing the master unit to be elected and maintained. It is not a data forwarding path for normal traffic.

Answer

It serves as the dedicated data forwarding path for all east-west traffic between different subnets.

Answer

It offloads all Snort inspection processing from data nodes to the control node.

Answer

It connects the cluster directly to the Cisco FMC management cloud over an encrypted TLS tunnel.

Question 11

You are configuring a static route on a Cisco Secure Firewall Threat Defense using FDM. Which parameters are strictly required to create a valid IPv4 static route?

Accepted Answer

Destination IP network, subnet mask, and next-hop IP address or egress interface.. A valid static route requires a destination network (prefix/mask), and either a next-hop IP address or an egress outgoing interface.

Answer

MAC address of the next-hop router and security zone name.

Answer

IP SLA tracking object ID and weighted cost metric.

Answer

Source IP address, destination IP address, and BGP Autonomous System number.

Question 12

When deploying a Cisco Secure Firewall Threat Defense device, what is the purpose of configuring Security Zones?

Accepted Answer

To logically group one or more interfaces together for simplified Access Control Policy application.. Security Zones on FTD are used to logically group one or more interfaces together so that Access Control Policies can be applied to the zone rather than individual interfaces. This simplifies policy management and allows consistent enforcement across multiple interfaces that share the same security posture.

Answer

To establish High Availability stateful synchronization between primary and secondary nodes.

Answer

To assign VLAN IDs to physical switch ports connected to the firewall.

Answer

To encrypt traffic passing between interfaces belonging to different zones using IPsec.

Question 13

An administrator configures a Cisco Secure Firewall Threat Defense cluster. During normal operations, a data node experiences a critical hardware failure. What happens to the active connections currently processed by that specific failed data node?

Accepted Answer

Active connections are migrated or maintained by surviving cluster nodes because connection state is distributed across the cluster.. In a Cisco Secure Firewall Threat Defense cluster, connection state is synchronised across data nodes so that if one data node fails, surviving nodes can maintain or take over the active connections. This state sharing is what allows the cluster to provide high availability without forcing clients to re-establish sessions. The control node handles cluster management, but data plane continuity is preserved by the distributed state.

Answer

Traffic destined for the failed node is permanently blackholed until the physical module is replaced.

Answer

All active connections are immediately dropped, forcing clients to re-establish TCP handshakes from scratch.

Answer

The entire cluster reboots to elect a new control node and rebuild the data plane.

Question 14

An engineer is troubleshooting a passive NGIPS deployment where the Cisco Secure Firewall is connected to a switch SPAN port. Security analysts report that certain VLAN-tagged packets are not appearing in the event logs. What is the most likely cause?

Accepted Answer

The passive interface or subinterfaces on the firewall are not configured to recognize or decode the specific 802.1Q VLAN tags present in the SPAN stream.. In a passive NGIPS deployment fed by a switch SPAN port, the firewall's passive interface must be able to parse the frames it receives. If the SPAN source is a trunk carrying 802.1Q-tagged frames, the passive interface (or its subinterfaces) must be configured to recognize those VLAN tags; otherwise the Snort engine cannot correctly decode the packets and they never generate events. This is a classic SPAN/trunk mismatch issue in Firepower troubleshooting.

Answer

The firewall management IP address is misconfigured, causing packet loss on the monitoring port.

Answer

The Snort inspection engine drops all SPAN traffic by default unless inline bypass mode is active.

Answer

Passive interfaces do not support VLAN tagging; all trunk traffic must be untagged at the switch SPAN source.

Question 15

An administrator is configuring inline interface pairs on a Cisco Secure Firewall Threat Defense device. Which THREE characteristics apply to inline deployment mode? (Choose three)

Accepted Answer

Asymmetric routing must be carefully managed or avoided because inline inspection expects to see both directions of a TCP flow.. Inline deployment places the Cisco Secure Firewall Threat Defense device directly in the traffic path, so option D is correct: because packets physically traverse the firewall, it can inspect and drop malicious traffic before it reaches destination hosts. Option B is correct because inline inspection is stateful and expects to see both directions of a TCP flow; asymmetric routing can cause the firewall to miss one direction, breaking inspection or dropping legitimate sessions. Option C is correct because inline sets support hardware bypass (Fail Open) on supported interfaces, which preserves network connectivity if the device loses power or fails. Option A is not correct because SPAN or TAP configurations are used for passive, promiscuous monitoring, not inline mode, where traffic is actively forwarded through the firewall. Option E is not correct because inline mode does not prevent routed mode; an inline set can be deployed as part of a routed (or transparent) configuration, and inline refers to the traffic-path placement rather than disabling routing.

Answer

Inline interfaces require SPAN or TAP configurations on upstream core switches to receive mirrored traffic copies.

Answer

Inline mode prevents the firewall from operating in routed mode.