300-710 SNCF Hard Questions — 25 Difficult Questions

Question 1

You are configuring SSL decryption. To ensure that traffic to a specific financial domain is NOT decrypted due to privacy regulations, what must you configure in the SSL Decryption Policy?

Accepted Answer

Configure an SSL rule with the 'Do Not Decrypt' action. The 'Do Not Decrypt' action is used in SSL policies to bypass inspection for specific URLs or categories.

Answer

Use a 'Monitor' action in the SSL policy

Answer

Create an Access Control Rule with a 'Decrypt' action

Answer

Add the domain to the Prefilter Policy

Question 2

Which THREE actions can be applied to traffic in a Prefilter rule?

Accepted Answer

Tunnel. Prefilter rules support Fastpath, Analyze, and Tunneling actions.

Answer

Block

Answer

Monitor

Question 3

An administrator is configuring a Manual NAT rule in the FMC for an internal server that needs to be accessed from the outside zone. The internal IP is 192.168.1.50, and it must be translated to a public IP 203.0.113.10. Which TWO configuration parameters must be specified when defining this Manual NAT rule? (Choose two)

Accepted Answer

Original Source. Manual NAT rules require defining the Source Interface (original source zone/interface), Destination Interface (translated destination zone/interface), Original Source IP, and Translated Source IP.

Answer

Interface PAT (PAT Pool)

Answer

ARP Inspection Profile

Answer

DNS Resolution Option

Question 4

How do you ensure that a specific host object is only used in a specific interface?

Accepted Answer

Use an Interface Object. By using the 'Interface Objects' feature in FMC, you can restrict where a network object is valid.

Answer

Use a VLAN group

Answer

Use a Security Zone

Answer

Use a Port object

Question 5

Which THREE settings can be configured within a Prefilter Policy on the FMC? (Choose three)

Accepted Answer

FastPath action to bypass Snort inspection. Prefilter policies support FastPath, Tunnel rules, and Default Actions (Analyze or FastPath).

Answer

Intrusion Policy signature tuning

Answer

Security Intelligence block lists

Question 6

Which THREE components of an Access Control rule can be used to identify traffic as 'Application' based?

Accepted Answer

Application Category. Applications are identified by the App-ID engine, which uses signatures, categories, and tags.

Answer

Device Type

Answer

OS Version

Question 7

An enterprise requires FTD to decrypt outbound SSL/TLS traffic so internal users visiting external websites can be inspected by Snort for malware. Which policy and action combination must be configured?

Accepted Answer

SSL/TLS Decryption Policy with Decrypt - Resign action. Outbound SSL decryption requires an SSL/TLS Decryption Policy with a 'Decrypt - Resign' action using an internal subordinate CA certificate.

Answer

Prefilter Policy configured with SSL Bypass

Answer

SSL/TLS Decryption Policy with Decrypt - Inbound action

Answer

Access Control Policy with Malware Inspection enabled and no SSL policy

Question 8

An engineer needs to prioritize voice traffic (DSCP EF) over a constrained WAN interface on an FTD device. Where must the QoS policy be configured and applied?

Accepted Answer

Policies > Access Control > Advanced > QoS, assigned to specific interfaces. QoS policies are created under Objects > QoS > QoS and then applied to an Access Control Policy, specifically assigned to desired egress or ingress interfaces.

Answer

Objects > QoS Policy > Applied globally via Platform Settings

Answer

Policies > Prefilter > QoS Rate Limiting

Answer

Devices > NAT > Advanced QoS tab

Question 9

An administrator wants to decrypt inbound HTTPS traffic destined for a public web server behind a Firepower Threat Defense device. Which type of SSL/TLS decryption policy must be configured on the FMC?

Accepted Answer

Decrypt - Inbound. Decrypt - Inbound is used when the FTD device holds the private key of the server to decrypt inbound traffic destined for internal protected servers.

Answer

SSL Decryption - Do Not Decrypt

Answer

Decrypt - Resign

Answer

SSL Inspection Policy - Outbound

Question 10

An engineer is configuring a QoS policy on an FMC-managed FTD and needs to police traffic to a maximum bandwidth limit on an interface. Which shaping/policing parameter must be configured?

Accepted Answer

Traffic Policing with specified Committed Information Rate (CIR). Interface-based QoS rate limiting uses police parameters to cap bandwidth for traffic matching the QoS policy.

Answer

Prefilter FastPath Rate Cap

Answer

Access Control Rate Limiting action

Answer

Random Early Detection (RED) drop threshold

Question 11

An administrator configures an SSL Decryption Policy with a rule to 'Do Not Decrypt' financial traffic. However, the administrator also wants to ensure that the encrypted session still undergoes basic certificate validation and categorization. How does FTD handle 'Do Not Decrypt' traffic?

Accepted Answer

The FTD extracts SNI and performs URL categorization using the unencrypted Client Hello handshake.. Even when traffic is set to Do Not Decrypt, FTD can inspect the TLS handshake (Client Hello) to extract SNI, categorize the URL, and validate basic certificate attributes without decrypting the payload.

Answer

All inspection, including URL categorization and SNI extraction, is completely bypassed.

Answer

The FTD converts the traffic to plaintext using a self-signed proxy certificate.

Answer

The FTD drops the connection because decryption is mandatory for any inspection.

Question 12

Which THREE criteria can be used to match traffic within an Access Control rule on the FMC? (Choose three)

Accepted Answer

URL Categories. Access Control rules support matching based on Networks, Ports, Applications, URL categories, Users, and Zones.

Answer

Intrusion Policy Signatures

Answer

Device Platform Settings

Question 13

An organization requires that Quality of Service (QoS) be enforced on an FTD interface to limit outbound traffic for a specific guest network object to 2 Mbps. Where within the FMC interface is this QoS policy applied?

Accepted Answer

Under Devices > Device Management > QoS tab applied to interfaces. QoS policies must be applied to specific security zones or interfaces via the Platform Settings or device interface configuration, linked to the Access Control Policy.

Answer

Inside the Access Control Policy rules directly on individual rule actions

Answer

Within the Prefilter Policy configuration tab

Answer

Inside the Intrusion Policy advanced settings

Question 14

Which THREE actions can be assigned to an individual rule within an Access Control Policy on the FMC? (Choose three)

Accepted Answer

Allow. Access Control rules support actions such as Allow, Block, Interactive Block, Trust, and Monitor.

Answer

Decrypt

Answer

FastPath

Question 15

You have a large number of NAT rules. How does the FTD process them?

Accepted Answer

Top-down. NAT rules are processed in a top-down order until the first match is found.

Answer

Bottom-up

Answer

Specific to General

Answer

Alphabetical

Question 16

An administrator is planning an Active/Standby High Availability deployment for two Cisco Secure Firewall Threat Defense devices managed by FMC. Which THREE prerequisites must be satisfied before configuring the HA pair? (Choose three)

Accepted Answer

A dedicated link must be available to serve as the stateful failover control and health monitoring link.. HA deployment requires identical hardware models, matching major/minor FTD software versions, and dedicated physical or logical links for stateful failover control.

Answer

The secondary unit must have a higher management IP address than the primary unit.

Answer

Both firewalls must be configured in transparent mode; routed mode is unsupported in HA.

Question 17

An engineer is designing a high-availability architecture utilizing Equal-Cost Multi-Path (ECMP) routing with Cisco Secure Firewall Threat Defense units. Which THREE characteristics or limitations apply to ECMP on FTD? (Choose three)

Accepted Answer

ECMP distributes traffic across multiple equal-cost next-hop routes to optimize bandwidth utilization and path redundancy.. ECMP on FTD balances traffic across multiple paths, requires dynamic routing protocols like OSPF/BGP or static routes, and hashes flows based on packet headers.

Answer

ECMP is restricted exclusively to transparent firewall deployments and cannot be used in routed mode.

Answer

ECMP automatically synchronizes state tables between independent firewall appliances without requiring an HA control link.

Question 18

When defining a NAT rule for an internal server, what happens if the 'DNS Rewrite' option is enabled?

Accepted Answer

The FTD modifies DNS responses. DNS Rewrite modifies the payload of DNS responses to ensure clients reach the correct internal server IP instead of the NAT public IP.

Answer

The FTD forces a DNS query to an external server

Answer

The FTD creates a new NAT object

Answer

The FTD blocks all DNS traffic

Question 19

If you need to block a specific file type (e.g., .exe) from being downloaded, which feature must you enable in the Access Control Rule?

Accepted Answer

File Policy. File policies are associated with Access Control rules to inspect and block files.

Answer

SSL Policy

Answer

IPS Policy

Answer

QoS Policy

Question 20

What occurs when an 'Interactive Block' action is used in an Access Control rule?

Accepted Answer

The user receives a notification page. The user is shown a page explaining why the traffic was blocked and given an option to proceed.

Answer

The traffic is dropped

Answer

The traffic is automatically allowed

Answer

The rule is ignored