300-710 SNCF Timed Hard Questions — 25 Difficult Questions

Question 1

A security team is deploying Cisco Secure Firewall Threat Defense and wants to integrate it with Cisco Identity Services Engine (ISE) for user identity. The team wants to use the ISE pxGrid integration to enforce identity-based policies. After configuring the integration, the team notices that user identities are not being learned by the FMC. The team verifies that the pxGrid certificate is valid and the FMC can connect to ISE. What is the most likely reason?

15 minute time limit — choose an answer to begin.

Accepted Answer

The FMC is not configured to subscribe to the correct pxGrid topics, such as Session Directory and User Identity.. For pxGrid integration to populate user identity information, the FMC must subscribe to the appropriate pxGrid topics, such as Session Directory and User Identity. Without these subscriptions, the FMC will not receive the data even if the connection and certificates are valid. Verifying and enabling the correct subscriptions is essential for successful integration.

Answer

The Threat Defense devices are not configured to send user identity information to the FMC.

Answer

The FMC is using the wrong certificate for pxGrid, and the ISE rejects the connection.

Answer

The ISE pxGrid persona is not enabled on the ISE node, and the FMC cannot authenticate.

Question 2

When configuring ECMP (Equal-Cost Multi-Path) on FTD, what happens if one of the next-hop paths fails?

Accepted Answer

Traffic is automatically load-balanced across the remaining active paths.. FTD monitors the routes; if a path fails, the FTD removes that specific route from the routing table, and traffic is automatically redistributed across the remaining paths.

Answer

Traffic is dropped until manual intervention.

Answer

The entire cluster enters a maintenance mode.

Answer

All traffic is rerouted to the primary management interface.

Question 3

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO fields or parameters can be included in the syslog output to facilitate incident investigation and event parsing by the SIEM? (Choose two)

Accepted Answer

Precise timestamp formatting (UTC or local time) configured in Platform Settings. Option B is correct because the syslog timestamp format (UTC or local time) is configurable under Platform Settings > Syslog in FTD, and consistent, precise timestamps are essential for correlating events across the SIEM and establishing accurate incident timelines. Option D is correct because including the firewall device name or identifier in the syslog header lets the SIEM attribute each event to its originating sensor, which is critical in multi-device deployments for parsing, filtering, and investigation. The remaining options are not valid syslog fields: a full memory core dump (A) is a diagnostic binary artifact, not syslog content; FMC administrator SSH private keys (C) are credentials that must never be transmitted in logs; and raw PCAP data (E) is captured separately via packet capture tools and cannot be embedded as text in syslog messages.

Answer

Full memory core dump binary attachments

Answer

FMC administrator SSH private keys

Answer

Raw packet captures (PCAP) of dropped connections embedded in syslog text

Question 4

An administrator configures pxGrid integration between Cisco ISE and Cisco Secure Firewall Threat Defense. During the certificate enrollment process, the firewall fails to trust the ISE pxGrid node. What is the most likely root cause of this failure in a standalone FMC deployment?

Accepted Answer

The ISE pxGrid root CA certificate is not imported into the FMC trusted certificates store.. For pxGrid communication to establish successfully, the ISE pxGrid node certificate and FMC/Firewall pxGrid certificate must be signed by a mutually trusted Certificate Authority (CA), and the CA root certificate must be imported into the FMC trusted certificates store.

Answer

The SXP secret password does not match between ISE and the firewall.

Answer

The pxGrid subscriber profile on ISE was not approved within 24 hours.

Answer

RADIUS shared secrets are mismatched on the Policy Service Nodes.

Question 5

An administrator is troubleshooting a Prefilter Policy configured on an FMC. Which THREE actions are available when creating a rule in a Prefilter Policy? (Choose three)

Accepted Answer

Slow Path (send traffic through normal inspection pipeline). In an FMC Prefilter Policy, each rule can take one of three actions: Block, which drops matching traffic immediately without further inspection (option D); Fast Path, which bypasses the inspection pipeline and fast-forwards traffic (option E); and Slow Path, which sends traffic through the normal inspection pipeline for further analysis (option C). These three actions are the only ones available at the prefilter stage, which exists to reduce the load on the Snort inspection engine by handling traffic before it reaches the access control policy. Option A (Decrypt - Resign) is an SSL policy action, not a prefilter rule action, and option B (Inspect with Snort 3 Intrusion Prevention) is an access control rule action, so neither belongs in a Prefilter Policy rule.

Answer

Decrypt - Resign (intercept and re-sign SSL certificate)

Answer

Inspect with Snort 3 Intrusion Prevention

Question 6

An engineer is configuring a QoS policy on an FMC-managed FTD and needs to police traffic to a maximum bandwidth limit on an interface. Which shaping/policing parameter must be configured?

Accepted Answer

Traffic Policing with specified Committed Information Rate (CIR). Traffic policing on FTD is configured via a QoS policy that enforces a maximum bandwidth limit using a Committed Information Rate (CIR). The CIR defines the average rate allowed, and traffic exceeding it is dropped or marked down, directly capping bandwidth. This is the standard mechanism for rate limiting on an interface in Cisco Secure Firewall, and it must be applied through the FMC QoS policy.

Answer

Prefilter FastPath Rate Cap

Answer

Access Control Rate Limiting action

Answer

Random Early Detection (RED) drop threshold

Question 7

An administrator wants to ensure that all security event logs from Cisco Secure Firewall Threat Defense are exported reliably and in real time to external security analytics tools. Which TWO deployment and configuration practices should be implemented? (Choose two)

Accepted Answer

Configure Reliable Syslog (TCP with TLS) in FTD Platform Settings to ensure encrypted and guaranteed log delivery.. Option B is correct because configuring Reliable Syslog in FTD Platform Settings uses TCP with TLS (port 6514 by default) to provide encrypted, connection-oriented, acknowledged delivery of syslog events, which prevents log loss and satisfies the requirement for reliable, real-time export to external analytics tools. Option D is correct because eStreamer on the FMC streams intrusion, connection, malware, and other security events in near real time to a SIEM collector over a persistent TLS connection, which is the Cisco-recommended method for feeding external security analytics platforms. Option A is wrong because local disk storage with weekly manual SCP exports is neither real-time nor reliable, and risks losing events if the disk fills or the device fails. Option C is wrong because disabling the Snort engine would stop intrusion event generation entirely and does not address log transport. Option E is wrong because SNMPv1 traps only carry event counters and are unencrypted, unacknowledged, and not designed for streaming detailed security event logs.

Answer

Rely solely on local FTD disk storage and export logs via manual SCP once a week.

Answer

Disable the Snort engine to prevent log buffer congestion.

Answer

Configure SNMPv1 traps to poll event counters every 60 seconds.

Question 8

An FMC high availability (HA) pair has split-brain symptoms due to a management network failure. After restoring network connectivity, the standby unit remains in a 'Failed' state and does not automatically re-synchronize. What is the correct procedure to recover the HA sync?

Accepted Answer

Go to System > Integration > HA, break the HA pairing, and re-establish it using the active unit as the primary.. When an FMC HA pair experiences split-brain and the standby unit remains in a 'Failed' state after network restoration, the correct recovery is to break the HA pairing and re-establish it using the active unit as the primary. This forces a clean re-synchronization and resolves the failed state.

Answer

Run 'system support fmc-ha-sync' from the standby FMC CLI.

Answer

Reboot both FMC units simultaneously.

Answer

From the primary FMC CLI, run 'configure ha restore-sync'.

Question 9

An administrator is investigating an issue where connection events are failing to reach the FMC from a managed FTD. Which THREE daemons or logs on the FTD and FMC should be checked to troubleshoot event transport and communication issues? (Choose three)

Accepted Answer

FTD event streaming and SFIMS logs. Option A is correct because the FTD's event streaming process and SFIMS (the Firepower Management Center communication agent) are responsible for generating and forwarding connection events to the FMC, so their logs directly reveal whether events are being produced and transmitted. Option C is correct because /var/log/cisco/sftunnel.log records the status of the sftunnel (Secure Firewall Tunnel) connection between the FTD and FMC; if this tunnel is down or flapping, event transport will fail. Option E is correct because on the FMC, the event collection and correlator components receive and process events, and their logs (for example /var/log/messages or application logs under /var/sf/log) show whether events arrive and are ingested. Option B is not relevant because /var/log/dhcpd.log pertains to DHCP daemon activity, which has nothing to do with FTD-to-FMC event transport. Option D is not relevant because /var/log/samba/smb.log relates to SMB/CIFS file-sharing services, which are unrelated to Firepower event communication.

Answer

/var/log/dhcpd.log

Answer

/var/log/samba/smb.log

Question 10

Which of the following is a limitation when deploying an FTD in transparent mode?

Accepted Answer

It does not support dynamic routing protocols.. Transparent mode does not support dynamic routing protocols (like OSPF or BGP) because it acts as an L2 bridge.

Answer

It does not support NAT.

Answer

It cannot handle VLAN tags.

Answer

It requires manual ARP entries for all hosts.

Question 11

An administrator integrates Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. After successful registration, the administrator wants to create an Access Control policy rule that blocks traffic from users in the 'Contractors' Security Group Tag. Where in the FMC rule creation wizard should the administrator configure this condition?

Accepted Answer

In the Access Control Rule, navigate to the Users tab and select the desired Security Group Tag.. In FMC Access Control policies, user and tag-based criteria are added under the 'Users' tab of the rule configuration, where Security Group Tags learned via pxGrid can be selected.

Answer

In Objects > Object Management > Access Control > SGT Objects.

Answer

In the Platform Settings policy under Identity Sources.

Answer

In the Access Control Rule, navigate to the Networks tab and select Security Groups.

Question 12

An administrator is preparing an upgrade plan for an FMC and its managed FTD devices. Which THREE best practices should be followed during the upgrade process to minimize downtime and avoid failure? (Choose three)

Accepted Answer

Take a complete backup of the FMC and export device configurations prior to starting the upgrade.. Option A is correct because taking a full FMC backup and exporting FTD configurations before any upgrade provides a rollback point if the upgrade fails or corrupts data, which is essential for minimizing downtime. Option B is correct because Cisco's upgrade best practice requires the FMC to be upgraded to the target version first, since a newer FMC can manage older FTD versions but an older FMC cannot manage newer FTD devices, avoiding management incompatibility. Option C is correct because running the pre-upgrade checker (e.g., via the FTD CLI or the FMC upgrade readiness check) identifies blockers such as unsupported configurations, insufficient disk space, or deprecated features before the upgrade begins. Option D is incorrect because factory resetting FTD devices after pushing an upgrade would erase the configuration and cause an outage, not minimize downtime. Option E is incorrect because the sftunnel is the management tunnel between FMC and FTD; disabling it permanently would break management and prevent the FMC from pushing the upgrade or policies, and it is not a valid upgrade practice.

Answer

Factory reset all FTD devices immediately after pushing the upgrade package.

Answer

Disable the sftunnel service permanently during the upgrade to prevent packet inspection.

Question 13

Which THREE steps are part of a standard FTD upgrade workflow managed via the FMC?

Accepted Answer

Upload the upgrade package to the FMC. Option C is correct because the standard FTD upgrade workflow managed through the FMC begins by uploading the FTD software upgrade package (image) to the FMC, which then stages it for deployment to managed devices. Option E is correct because after the package is available, the administrator selects the target device(s) in the FMC's Upgrade management page to initiate and schedule the upgrade. Option D is correct because the workflow includes running a readiness/health check on the device and reviewing and approving the resulting health check report before proceeding with the actual upgrade. Options A and B are incorrect: manually deleting all existing access rules is not a step in the upgrade workflow and would disrupt policy, and running a factory reset on the FTD is not part of a standard upgrade—it would wipe the configuration rather than upgrade the software.

Answer

Manually delete all existing access rules

Answer

Run a factory reset on the FTD

Question 14

When you have multiple overlapping NAT rules, which rule is applied?

Accepted Answer

The first matching rule. The FTD matches NAT rules using a top-down approach, similar to Access Control rules.

Answer

The rule that matches the interface

Answer

The rule with the lowest priority

Answer

The most specific rule

Question 15

An administrator is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) in Microsoft Azure. The architecture calls for a 3-NIC deployment (Management, Inside, and Outside). After deployment, asymmetric routing issues are observed because Azure Load Balancer is forwarding return traffic directly back to a different backend instance. What configuration must be applied to prevent asymmetric drops?

Accepted Answer

Configure Source NAT (SNAT) on the FTDv so that traffic appears to originate from the firewall interface IP, ensuring symmetrical return paths.. In Azure, the Load Balancer can distribute flows such that the return path traverses a different backend instance, causing asymmetric routing. Configuring Source NAT (SNAT) on the FTDv makes outbound traffic appear to originate from the firewall's interface IP, so return traffic is directed back to the same firewall instance that processed the original flow. This ensures symmetric flow handling and prevents the firewall from dropping packets due to asymmetric routing.

Answer

Enable Strict Asymmetric Routing Bypass mode in the FTDv Advanced Firewall Settings.

Answer

Disable the Azure UDR (User Defined Route) on the inside subnet.

Answer

Convert the FTDv deployment from routed mode to transparent mode.

Question 16

In an FTD cluster, what happens if the cluster control link fails?

Accepted Answer

The cluster nodes may disable themselves to avoid split-brain.. If the control link fails, the cluster members cannot synchronize state or status, typically leading to a split-brain scenario or the standby nodes disabling themselves to prevent inconsistency.

Answer

The FMC takes over the cluster.

Answer

The cluster continues to operate normally.

Answer

The entire cluster reboots.

Question 17

An administrator is troubleshooting an FTD device that is failing to register with FMC. The FTD has been configured with the correct FMC IP address, registration key, and NAT ID. Which additional setting must be verified on the FTD to allow successful registration?

Accepted Answer

The FTD must have a default route to reach the FMC.. The FTD requires a route to reach FMC. If FMC is on a different network, a default gateway or static route must be configured on the management interface. Without it, registration packets cannot reach FMC. DNS, time zone, and NAT ID are either already addressed or not blocking registration in this scenario.

Answer

The FTD must be able to resolve the FMC's hostname via DNS.

Answer

The FTD must be configured with the same NAT ID as the FMC.

Answer

The FTD must have the same time zone as the FMC.

Question 18

An administrator is implementing an SSL Decryption Policy on a Cisco Firepower Threat Defense device managed by FMC. The policy must decrypt outbound HTTPS traffic to inspect for malware, but certain financial domains must be excluded from decryption to comply with privacy regulations. Which rule action should be configured for these specific financial domains in the SSL Decryption Policy?

Accepted Answer

Do Not Decrypt. To prevent inspection and decryption of sensitive traffic while allowing it to pass through the firewall, the Do Not Decrypt action is used in the SSL Decryption Policy.

Answer

Decrypt - Known Key

Answer

Block

Answer

Decrypt - Resign

Question 19

Which THREE components are necessary to implement passive identity monitoring in an FMC-managed Firepower system?

Accepted Answer

Realm configuration in FMC. Passive identity monitoring in an FMC-managed Firepower system requires a Realm configuration in FMC (C), which defines the connection to the identity source (LDAP/AD or ISE) and enables the system to retrieve user-to-IP mappings; without a realm, FMC has no identity source to query. It also requires Cisco Identity Services Engine (ISE) or Identity Agent (D), because these are the actual sources that supply user identity data via pxGrid, RADIUS accounting, or the ISE Identity Agent, which FMC consumes for passive user discovery. Finally, an Identity Policy (E) must be configured and applied to the managed devices, since this policy enables identity-based rules and specifies the realm(s) and identity services used for passive authentication on the Firepower system. An SSL Decryption policy (A) is not required for passive identity monitoring, as it is used to decrypt and inspect encrypted traffic, not to learn user identities. A Prefilter policy (B) is also not required, since prefiltering is used for tunnel/SSL rule handling and fastpathing decisions, not for identity source integration.

Answer

SSL Decryption policy

Answer

Prefilter policy

Question 20

An administrator is planning an upgrade of an FMC managing multiple FTD devices across various software versions. Which THREE factors must be validated according to Cisco compatibility guidelines before proceeding? (Choose three)

Accepted Answer

Supported upgrade paths (e.g., whether a direct jump from v6.4 to v7.4 is supported or requires an intermediate upgrade).. Option A is correct because Cisco upgrade planning requires verifying supported upgrade paths; for example, a direct jump from v6.4 to v7.4 may not be supported and may require an intermediate release such as v7.0 or v7.2 before reaching v7.4. Option B is correct because the upgrade process must have sufficient free space on FMC and FTD partitions, including /var and /root, so that downloaded packages and temporary files can be unpacked and staged without filling the filesystem. Option E is correct because the Cisco Firepower Compatibility Guide must be consulted to confirm that the target FMC software version interoperates with and supports the FTD versions currently managed by that FMC. Option C is not required because NTP stratum 1 is not a Cisco Firepower upgrade prerequisite; time synchronization matters, but the local NTP server does not have to be stratum 1. Option D is not required because the serial numbers of external power supplies are irrelevant to software compatibility and upgrade validation.

Answer

The local NTP server stratum level must be exactly stratum 1.

Answer

The serial number of the external power supplies attached to the rack mount chassis.