300-710 SNCF Deployment Practice Test 6 — 15 Questions

Question 1

An administrator is configuring port channels (EtherChannels) on Cisco Secure Firewall Threat Defense interfaces. Which TWO requirements or guidelines must be followed? (Choose two)

Accepted Answer

LACP (Link Aggregation Control Protocol) can be used to dynamically negotiate and manage the port channel.. Port channels require matching channel-group configurations, identical speed/duplex/mode on member ports, and support LACP.

Answer

Port channel interfaces cannot be assigned to security zones.

Answer

Port channels are restricted to passive NGIPS monitoring interfaces only.

Answer

Active/Standby HA pairs must have completely different port channel ID numbers on the standby unit.

Question 2

An administrator is managing Cisco Secure Firewall Threat Defense devices using Cisco Defense Orchestrator (CDO). Which TWO capabilities does CDO provide for firewall deployment and management? (Choose two)

Accepted Answer

Cloud-based policy management, configuration deployment, and security rule cleanup across multiple FTD devices.. CDO is a cloud-based management platform that provides policy management, configuration drift analysis, and bulk management across FTD and other Cisco security devices.

Answer

Deep forensic packet capture analysis equivalent to a full packet broker collector.

Answer

Hardware RMA replacement and physical cabling verification.

Answer

Local hypervisor provisioning for ESXi and KVM virtual machine hypervisors.

Question 3

An engineer is troubleshooting a Cisco Secure Firewall Threat Defense virtual appliance deployed in Microsoft Azure. Connectivity tests show intermittent packet drops. Which THREE troubleshooting steps or configurations should be verified in Azure and FTDv? (Choose three)

Accepted Answer

Check Azure User Defined Routes (UDRs) to ensure packet steering to the correct firewall internal/external ENIs is accurate.. Azure deployments require checking User Defined Routes (UDRs), Source NAT (SNAT) configurations for load balancers, and Azure NSG (Network Security Group) rules.

Answer

Verify that physical fiber optic bypass modules are firmly clicked into the Azure hypervisor chassis.

Answer

Ensure the FTDv is running in transparent mode with BVI clustering enabled across multiple Azure regions.

Question 4

An administrator is managing high availability failover events for Cisco Secure Firewall Threat Defense devices using Cisco FMC. Which TWO actions or events will trigger a failover from the active unit to the standby unit? (Choose two)

Accepted Answer

Failure of a monitored data interface exceeding the configured interface failure criteria.. Option A is correct because when an interface is configured as monitored in a failover configuration, a failure of that data interface that exceeds the configured interface failure criteria (such as the number of failed interfaces or the failure threshold) causes the active unit to fail over to the standby unit. Option E is correct because the failover control link carries heartbeat communications between the active and standby units; loss of these heartbeat messages causes the standby unit to detect that the active unit is no longer healthy and to take over as the active unit. Option B is not correct because an administrator logging into FMC via HTTPS is a normal management action and does not affect the failover state of the Threat Defense devices. Option C is not correct because failover is not triggered by CPU utilization crossing a low threshold like 10%; failover is based on interface monitoring, heartbeat loss, and unit health, not routine CPU load. Option D is not correct because a scheduled backup job on the secondary unit is an administrative task and does not trigger a failover event.

Answer

An administrator logging into the FMC user interface via HTTPS.

Answer

An increase in CPU utilization above 10% on the active unit.

Answer

A scheduled backup job running on the secondary unit.

Question 5

An enterprise is deploying Cisco Secure Firewall Threat Defense virtual appliances on-premises using VMware ESXi. Which THREE prerequisites or hypervisor configurations are required for proper operation? (Choose three)

Accepted Answer

Allocate sufficient vCPU, RAM, and disk storage in accordance with Cisco FTDv sizing guidelines for the targeted throughput.. VMware ESXi deployments require correct vSwitch/vDS port group configurations (promiscuous mode where needed, or specific VLAN policies), appropriate vCPU/RAM allocation according to sizing guides, and correct dedicated vNIC mapping.

Answer

Configure the ESXi management kernel port to run Cisco ASA clustering over a WAN circuit.

Answer

Install physical line cards directly into the ESXi server motherboard PCIe slots for FTDv interface expansion.

Question 6

An engineer is troubleshooting a Cisco Secure Firewall Threat Defense clustering deployment where configuration synchronization between the control node and a data node has failed. Which THREE diagnostic steps or log sources should the engineer check? (Choose three)

Accepted Answer

Execute the 'show cluster info' and 'show cluster state' commands on the firewall CLI to verify node membership and sync status.. Troubleshooting cluster sync issues involves examining cluster health status via CLI commands (e.g., 'show cluster info'), reviewing FMC deployment history logs, and verifying Cluster Control Link connectivity.

Answer

Check the BGP routing table on the core switch for missing Autonomous System path attributes.

Answer

Review the VMware vCenter datastore utilization for disk space errors.

Question 7

An administrator is configuring security zones on a Cisco Secure Firewall Threat Defense. Which TWO rules regarding security zones and interface assignments are correct? (Choose two)

Accepted Answer

Multiple interfaces (such as physical ports, subinterfaces, or EtherChannels) can be grouped into a single security zone.. Option D is correct because a security zone in Cisco Secure Firewall Threat Defense is a logical grouping that can contain multiple interfaces, including physical ports, subinterfaces, and EtherChannels, allowing consistent policy application across them. Option E is correct because an interface (physical or logical) can belong to only one security zone at a time, preventing conflicting zone-based policy assignments. Option A is incorrect because a security zone does not require a Bridge Virtual Interface (BVI); BVIs are used in transparent mode and are not mandatory for zone membership. Option B is incorrect because security zones are used in Access Control Policies to classify traffic, not to replace them. Option C is incorrect because security zones are supported in both routed and transparent modes, not only transparent mode.

Answer

Every security zone must contain at least one BVI interface.

Answer

Security zones replace the need for Access Control Policies entirely.

Answer

Security zones are only supported in transparent mode and cannot be used in routed mode deployments.

Question 8

An administrator is deploying a Cisco Secure Firewall Virtual (Fv) appliance in an Amazon Web Services (AWS) environment. Which licensing model is typically supported for traffic throughput and feature activation during this cloud deployment?

Accepted Answer

Smart Licensing (BYOL) and Pay-As-You-Go (PAYG) through the AWS Marketplace.. Cisco Secure Firewall Virtual (Fv) in AWS supports two licensing models: Bring Your Own License (BYOL) using Smart Licensing, and Pay-As-You-Go (PAYG) purchased directly through the AWS Marketplace. BYOL lets you apply existing Smart Licenses (via CSSM or a registration token), while PAYG bundles the license into the hourly AWS instance charge and activates features automatically. Both models govern throughput tier and feature activation (e.g., IPS, URL filtering, malware).

Answer

Activation via automatic license generation from the Amazon VPC DHCP options list.

Answer

Perpetual hardware-locked PAK files applied via the command line interface.

Answer

Activation exclusively through an on-premises Cisco Smart Software Manager (CSSM) satellite server without internet access.

Question 9

An enterprise is deploying a high-availability cluster of Cisco Secure Firewall Threat Defense devices to scale performance. Which requirement must be met regarding the physical switch infrastructure connecting the cluster nodes?

Accepted Answer

Connections between the switches and cluster nodes must use Port Channels (EtherChannels) to aggregate bandwidth and ensure proper traffic distribution.. Firewall clustering requires specific switch features such as EtherChannel (Port Channels) and often requires specific load-balancing algorithms to distribute traffic across cluster members evenly.

Answer

Switches must be configured with Spanning Tree Protocol (STP) disabled globally to prevent cluster split-brain.

Answer

The switches must run Cisco StackWise Virtual and be managed by the firewall cluster master node.

Answer

Routing protocols must be disabled on all switch interfaces connected to the cluster control link (CCL).

Question 10

An administrator is configuring static route tracking on a Cisco Secure Firewall Threat Defense deployment to handle link failure. If the tracked object goes down, the static route should be removed from the routing table. Where is this configuration managed when using Cisco FMC?

Accepted Answer

Under Devices > Device Management > Routing > Static Route, by editing the route and selecting a Monitor Track object.. In Cisco FMC, static route tracking is configured by editing the static route itself under Devices > Device Management > Routing > Static Route, then selecting a Monitor Track object (SLA monitor) in the route's Track field. When the tracked object goes down, the route is removed from the routing table, enabling failover to a backup route. This is the only supported workflow for route tracking in FTD managed by FMC.

Answer

Under Policies > Access Control > Routing Policies, by enabling SLA tracking hooks.

Answer

Under System > Configuration > High Availability > Route Tracking.

Answer

Under Objects > Object Management > SIEM > Route Track.

Question 11

An engineer deploys an NGIPS in passive mode using a SPAN (Switched Port Analyzer) port on a core switch. During traffic analysis, the engineer notices that the firewall is not seeing TCP reset packets generated by internal servers. What is the primary operational limitation of deploying an NGIPS in passive mode that explains this behavior?

Accepted Answer

Passive sensors operate out-of-band and cannot block traffic inline or guarantee packet delivery state synchronization.. A passive NGIPS deployed via SPAN receives a copy of traffic out-of-band, so it is not in the forwarding path and cannot guarantee that it sees every packet, including TCP resets generated by internal servers. Because it does not participate in the TCP session, it also cannot enforce inline blocking or maintain perfect state synchronization, which explains why reset packets may be missing from its view.

Answer

Passive mode forces the Snort engine to disable all custom intrusion rules.

Answer

Passive sensors cannot inspect encrypted TLS traffic due to missing cryptographic keys.

Answer

SPAN ports automatically drop TCP reset flags for security reasons.

Question 12

An administrator is configuring Equal-Cost Multi-Path (ECMP) routing on a Cisco Secure Firewall Threat Defense deployment to balance traffic across two upstream next-hop routers. How does the firewall select the specific path for a given TCP flow?

Accepted Answer

A hashing algorithm based on the flow's 5-tuple to maintain session consistency.. ECMP on Cisco Secure Firewall uses a hashing algorithm based on the 5-tuple (source IP, destination IP, source port, destination port, and protocol) to ensure packets belonging to the same flow take the same path.

Answer

Strict priority-based path selection where the primary route is exhausted before secondary routing begins.

Answer

Dynamic bandwidth utilization monitoring where packets are instantly dynamically switched to the lowest latency link.

Answer

Round-robin packet scheduling across all available paths for every individual packet.

Question 13

When deploying a Cisco Secure Firewall Threat Defense in transparent mode, how are the firewall interfaces configured to pass traffic between segments without routing?

Accepted Answer

Interfaces are grouped into a Bridge Virtual Interface (BVI) bridge group that acts as a Layer 2 bridge.. In transparent mode, the firewall bridges traffic between interfaces using a Bridge Virtual Interface (BVI). The BVI is assigned an IP address for management and Layer 3 functions, while the physical interfaces belong to the bridge group.

Answer

Interfaces are configured with dynamic NAT overload to translate Layer 2 MAC addresses into Layer 3 IPs.

Answer

The firewall acts as an 802.1Q trunk port where all VLANs are terminated on a single subinterface.

Answer

Each physical interface is assigned a distinct IP address in the same subnet.

Question 14

An engineer is troubleshooting a stateful failover issue in a Cisco Secure Firewall Threat Defense Active/Standby high availability pair. The firewall units are passing data traffic, but failover state synchronization fails. Which dedicated interface must be verified for correct physical connectivity and configuration?

Accepted Answer

The Failover and State Link. In a Cisco Secure Firewall Threat Defense Active/Standby high availability pair, stateful failover requires a dedicated Failover and State Link to synchronize state information (such as connection tables and VPN state) between the units. If data traffic passes but failover state synchronization fails, this dedicated link must be verified for physical connectivity and correct configuration.

Answer

The Cluster Control Link (CCL)

Answer

The Management Interface (eth0)

Answer

The Diagnostic Interface

Question 15

An engineer is deploying an NGIPS inline set across two physical interfaces. To prevent network disruption during maintenance, the engineer needs to ensure that if the firewall loses power or experiences a kernel panic, traffic can still traverse the physical link. Which hardware feature must the interfaces support?

Accepted Answer

Hardware bypass capability (fail-open). Optical or copper bypass capability (hardware fail-open/fail-close bypass caps) allows traffic to pass physically through the ports when power is lost or the system crashes.

Answer

Unidirectional Link Detection (UDLD)

Answer

Spanning Tree PortFast BPDU filtering

Answer

Dynamic ARP Inspection (DAI)