300-710 SNCF Deployment Practice Test 9 — 15 Questions

Question 1

What is the consequence of configuring an FTD interface with 'Non-Promiscuous' mode in a virtualized deployment?

Accepted Answer

The FTD may fail to inspect traffic that is not destined for its interface MAC address.. In virtualized environments (like ESXi), 'Promiscuous mode' is often required on the vSwitch to allow the FTD to see traffic not destined for its own MAC address, which is essential for transparent or passive modes.

Answer

The FTD performance will increase.

Answer

The FTD will only process broadcast traffic.

Answer

It forces the FTD into routed mode.

Question 2

Which component in an FTD cluster handles the 'Health Check' process to determine if a node is still active?

Accepted Answer

Cluster control link.. The cluster control link is used to exchange heartbeats and health information between cluster members to verify node status.

Answer

Primary management IP.

Answer

The standby unit's data interface.

Answer

FMC communication channel.

Question 3

In routed mode, what is the purpose of the 'Name' assigned to an interface?

Accepted Answer

To define the interface for use in security policies and NAT.. The name assigned to an interface (e.g., 'outside') is used in policy rules and NAT definitions to identify the zone or security level.

Answer

To define the failover priority.

Answer

To change the speed of the physical interface.

Answer

To set the MAC address.

Question 4

When utilizing static route tracking, what value represents the frequency of the tracking probe?

Accepted Answer

Frequency interval.. The SLA Monitor configuration allows you to define the frequency (in seconds) at which the probe is sent to the target.

Answer

Threshold value.

Answer

Timeout interval.

Answer

TTL value.

Question 5

Which type of FTD interface should be configured to connect to a trunk port on a switch?

Accepted Answer

Sub-interface with a VLAN tag.. A sub-interface, when assigned a specific VLAN ID, is used to process traffic on a trunked link.

Answer

Physical interface without a VLAN ID.

Answer

Management interface.

Answer

Port channel interface.

Question 6

Which protocol is used by the FTD to communicate with the FMC for management traffic?

Accepted Answer

HTTPS/TLS (sftunnel).. The FTD communicates with the FMC using a secure, proprietary channel over HTTPS/TLS.

Answer

SSH

Answer

SNMPv3

Answer

ICMP

Question 7

Which interface configuration mode allows the FTD to handle traffic across multiple physical links as a single logical interface?

Accepted Answer

Port Channel. A Port Channel (EtherChannel) aggregates multiple physical interfaces into a single logical interface, providing increased bandwidth, load balancing, and link redundancy. On Cisco Secure Firewall Threat Defense, port channels are configured in routed or transparent mode and use LACP or static mode to bundle links. This is the only interface mode listed that combines multiple physical links into one logical interface for traffic handling.

Answer

Redundant Interface

Answer

Bridge Group

Answer

Sub-interface

Question 8

Which of the following is a limitation when deploying an FTD in transparent mode?

Accepted Answer

It does not support dynamic routing protocols.. Transparent mode does not support dynamic routing protocols (like OSPF or BGP) because it acts as an L2 bridge.

Answer

It does not support NAT.

Answer

It cannot handle VLAN tags.

Answer

It requires manual ARP entries for all hosts.

Question 9

In an FTD cluster, what happens if the cluster control link fails?

Accepted Answer

The cluster nodes may disable themselves to avoid split-brain.. If the control link fails, the cluster members cannot synchronize state or status, typically leading to a split-brain scenario or the standby nodes disabling themselves to prevent inconsistency.

Answer

The FMC takes over the cluster.

Answer

The cluster continues to operate normally.

Answer

The entire cluster reboots.

Question 10

When deploying an FTD in a virtual environment, what is the primary role of the 'GigabitEthernet0/0' interface by default?

Accepted Answer

Management interface.. In most virtual FTD deployments, the first interface is typically reserved for the management or diagnostic connectivity.

Answer

Failover link.

Answer

Data transit.

Answer

State link.

Question 11

When using a Redundant Interface, what is the primary behavior during a link failure?

Accepted Answer

The standby link becomes active.. In a redundant interface pair, one link is active and the other is standby. If the active link fails, the FTD automatically switches to the standby link.

Answer

Both links remain active and load balance.

Answer

The FTD triggers a device-level failover.

Answer

Traffic is dropped until manual reset.

Question 12

Which FTD command-line tool is primarily used to check interface status and physical link state?

Accepted Answer

show interface. The 'show interface' command provides detailed status on physical link state, speed, and duplex.

Answer

show run

Answer

show service-policy

Answer

show version

Question 13

Which component is responsible for processing traffic in an FTD cluster when 'Distributed' mode is used?

Accepted Answer

All cluster members.. In distributed mode, traffic is load-balanced across all members of the cluster, and each node processes its own traffic flows.

Answer

The management node.

Answer

A separate load-balancing virtual machine.

Answer

Only the primary node.

Question 14

Which THREE features are critical for maintaining a stable FTD cluster?

Accepted Answer

Synchronized FMC management.. Option B is correct because all members of an FTD cluster must be managed by the same FMC (or FDM in a single-device-manager scenario) so that configuration, policies, and cluster state remain synchronized across the cluster. Option C is correct because the data interfaces of clustered FTDs must be bundled into an EtherChannel (port channel) so that traffic can be load-balanced and redistributed across members while presenting a single logical interface to the network. Option E is correct because a dedicated cluster control link is required for members to exchange heartbeat, state, and control messages; without it, the cluster cannot form or maintain quorum and failover. Option A is not required because cluster members share a single logical IP address per data interface (with individual physical/IPs only on the control link), and Option D is not a cluster requirement since FTD clustering performs its own load distribution without an external load balancer.

Answer

Individual IP addresses for every member on every network.

Answer

External load balancer for traffic scrubbing.

Question 15

Which TWO of the following are required for FTD transparent mode deployment?

Accepted Answer

BVI with an IP address.. In FTD transparent mode, the firewall acts as a Layer 2 bridge, so you must configure a Bridge Virtual Interface (BVI) with an IP address (option D) to provide a management and routing endpoint for the bridged traffic, and you must assign the physical interfaces to bridge groups (option E) so they forward traffic between segments without IP addressing. These two elements are the defining requirements of transparent mode: the bridge group binds the interfaces together at Layer 2, and the BVI supplies the single Layer 3 address used for management and for any traffic terminating on the firewall. Public IP addresses on all interfaces (option A) are not required because transparent-mode data interfaces do not carry IP addresses, only the BVI does. A static routing protocol (option B) is unnecessary since transparent mode does not route between interfaces. VLAN tagging on all ports (option C) is optional and only needed when trunking multiple VLANs through the bridge group, not as a baseline requirement.

Answer

Public IP addresses on all interfaces.

Answer

Static routing protocol.

Answer

VLAN tagging on all ports.