300-710 SNCF Integration Practice Test 2 — 15 Questions

Question 1

An administrator configures Cisco Secure Firewall Threat Defense to send syslog messages to a SIEM. The administrator wants to ensure that syslog messages include the unique firewall ID (device name) and structured metadata so the SIEM can distinguish logs coming from multiple firewalls in a cluster. Where is this configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In Platform Settings > Syslog > Syslog Settings, configure the device identifier option (device name or IP).. In Cisco Secure Firewall Threat Defense, the device identifier for syslog messages is configured in Platform Settings under Syslog > Syslog Settings. You can choose to include the device name or IP address, which helps the SIEM distinguish logs from multiple firewalls.

Answer

Via the FTD CLI command 'syslog device-name override'.

Answer

In Objects > Object Management > Syslog Headers.

Answer

In System > Configuration > Identification.

Question 2

Which Cisco security product integrates with Secure Firewall to provide threat intelligence sharing, automated response actions, and cross-product pivot investigations across email, endpoint, network, and cloud workloads?

Accepted Answer

Cisco SecureX. Cisco SecureX (evolving into Cisco Security Cloud Control / Cisco XDR) is Cisco's integrated security platform providing unified threat response and visibility across security vectors.

Answer

Cisco Email Security Appliance (ESA)

Answer

Cisco Prime Infrastructure

Answer

Cisco AnyConnect Secure Mobility Client

Question 3

An enterprise integrates Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. The security team wants to ensure that when an administrator quarantines a host in Cisco SecureX, the firewall immediately drops active connections from that host without waiting for the FMC policy deployment cycle. How does SecureX achieve immediate enforcement on FTD?

Accepted Answer

SecureX uses the FMC REST API to dynamically push runtime block instructions that take effect immediately without requiring a full policy deployment.. SecureX achieves immediate enforcement on FTD by using the FMC REST API to push dynamic runtime block instructions, which take effect without a full policy deployment cycle. This is the rapid threat containment path: the block is applied to the data plane immediately, dropping active connections from the quarantined host. It bypasses the slower workflow of editing an access control policy and deploying it to the device.

Answer

SecureX sends an SNMP set command directly to the FTD data interface kernel.

Answer

ISE forces the FTD to reboot into maintenance mode to clear active states.

Answer

The FTD polls the SecureX cloud API every 1 second, causing high CPU usage.

Question 4

An administrator is troubleshooting a Cisco Secure Firewall Threat Defense and Cisco ISE pxGrid integration where user-to-IP mappings are not being received by the FTD. Which TWO troubleshooting steps should the administrator perform on the FTD or FMC CLI to diagnose the issue? (Choose two)

Accepted Answer

Examine the identity daemon logs and run 'show idedb statistics' to check if user identity maps are being processed.. Option A is correct because the identity daemon (ided) on the FTD/FMC handles user-to-IP mappings received from pxGrid, so examining its logs and running 'show idedb statistics' verifies whether identity maps are actually being processed and populated into the identity database. Option E is correct because 'show pxgrid status' (available via the FTD CLI/expert mode) displays the pxGrid connection state, including session establishment and certificate handshake details, which directly diagnoses why mappings are not arriving. Option B is incorrect because 'estreamer.log' relates to the Event Streamer service used for eventing, not pxGrid heartbeat timers, and heartbeat verification is not the relevant diagnostic here. Option C is incorrect because 'debug radius packet' traces RADIUS authentication traffic, not pxGrid TLS communication, which uses its own pxGrid/EST streamer channels. Option D is incorrect because 'show ise-server session' is not a valid FTD command for inspecting pxGrid user-to-IP mapping sessions.

Answer

Inspect the 'estreamer.log' file on the FMC to verify pxGrid heartbeat timers.

Answer

Run 'debug radius packet' on the FMC CLI to trace pxGrid TLS packets.

Answer

Execute 'show ise-server session' on the FTD privileged EXEC mode.

Question 5

An administrator is configuring Cisco Secure Firewall Threat Defense to forward syslog messages. The security team requires that only critical intrusion events and high-severity security alerts are sent via syslog, filtering out routine connection permits. Where should the administrator configure severity filtering for syslog export?

Accepted Answer

In FTD Platform Settings > Syslog > Event Logging, configure severity thresholds for specific event categories.. In FTD Platform Settings > Syslog, administrators can select specific event classes (such as Intrusion, Security Intelligence, or Access Control) and assign severity filters so that only desired severity levels are exported.

Answer

Via the FTD CLI command 'logging severity-filter critical'.

Answer

In the Access Control Policy advanced tab by disabling connection logging.

Answer

In Objects > Object Management > Syslog Severity.

Question 6

An engineer is configuring Cisco eStreamer to stream security events from FMC to a third-party SIEM. Which THREE components or prerequisites must be properly established for the eStreamer client to successfully connect and receive events? (Choose three)

Accepted Answer

Generate a valid eStreamer client certificate bundle (PKCS#12) and configure the client IP address on the FMC.. Option B is correct because eStreamer authentication requires a client certificate bundle in PKCS#12 format generated on the FMC, and the SIEM client's IP address must be added to the eStreamer configuration so the FMC permits that host to connect. Option C is correct because the eStreamer service on the FMC listens on TCP port 8302, so any firewall between the SIEM client and the FMC management interface must allow that port for the TLS connection to succeed. Option E is correct because the eStreamer client validates the FMC's server certificate during the TLS handshake, which requires the FMC CA certificate (or its chain) to be installed as trusted on the SIEM host. Option A is incorrect because SNMPv2c traps are a separate monitoring mechanism and are not used by eStreamer to deliver events. Option D is incorrect because UDP 514 syslog forwarding on FTD data interfaces is unrelated to the eStreamer client-server protocol, which uses TCP 8302 to the FMC.

Answer

Enable SNMPv2c traps on all managed FTD devices.

Answer

Configure UDP port 514 forwarding on the FTD data interfaces.

Question 7

An organization integrates Cisco Secure Firewall with Cisco SecureX. Which THREE actions or capabilities can be executed as part of this integration? (Choose three)

Accepted Answer

Automated blocking of malicious file hashes or IP indicators across managed FTD devices via FMC API orchestration.. Option A is correct because SecureX threat response integrates with Cisco Secure Firewall Management Center (FMC) through its API, allowing analysts to push indicators (file hashes, IPs, domains) as block actions to managed FTD devices via the FMC's Security Intelligence or access control policy orchestration. Option C is correct because the SecureX ribbon and threat response dashboard correlate events from multiple sources, including FMC, and let analysts pivot from a SecureX investigation directly into the corresponding FMC event logs for deeper inspection. Option E is correct because the integration synchronizes threat intelligence — including global feeds and security intelligence blacklists — between SecureX and FMC, enriching FMC policies with up-to-date indicators. Option B is incorrect because SecureX cloud agents do not manage Layer 2 switchport VLAN assignments; that is a switching function handled by Cisco Catalyst Center or switch CLI, not by SecureX. Option D is incorrect because FMC remains the primary management and policy deployment GUI for FTD; SecureX provides orchestration, correlation, and investigation capabilities but does not replace FMC.

Answer

Configuring Layer 2 switchport access VLAN assignments via SecureX cloud agents.

Answer

Replacing the FMC as the primary device management and policy deployment GUI for FTD.

Question 8

An administrator is troubleshooting Cisco ISE pxGrid integration with Secure Firewall Management Center. Which TWO issues commonly prevent successful pxGrid registration and trust establishment? (Choose two)

Accepted Answer

The FMC client certificate is pending manual approval in the Cisco ISE pxGrid Services client management console.. Option A is correct because pxGrid uses certificate-based authentication, and when the FMC registers as a pxGrid client, its client certificate must be manually approved in the ISE pxGrid Services client management console before trust is established; a pending approval blocks registration. Option C is correct because the FMC must trust the CA that issued the ISE pxGrid server certificate, so if the Root or Intermediate CA certificate of the ISE PKI is missing from the FMC trusted certificate store, the TLS handshake fails and registration cannot complete. Option B is not relevant because Active Directory domain join is not required for pxGrid registration between FMC and ISE. Option D is incorrect because eStreamer uses port 8302 for event streaming to external clients, not for pxGrid registration, which uses TCP 8910 (and related pxGrid ports). Option E is incorrect because the Snort engine on the FTD is unrelated to FMC-to-ISE pxGrid trust establishment.

Answer

The FTD device is missing an Active Directory domain join account.

Answer

The eStreamer service port 8302 is blocked on the ISE server.

Answer

The Snort engine on the FTD is disabled.

Question 9

An administrator is reviewing the health of the Cisco Secure Firewall Management Center integration with Cisco SecureX. Which TWO methods can be used to verify that the integration is functioning properly? (Choose two)

Accepted Answer

Examine cloud services and API log files in the FMC expert shell under /var/log/cisco/.. Option E is correct because the FMC GUI provides a dedicated SecureX integration page under System > Integration > SecureX, where the connection and registration status indicator directly shows whether the FMC is successfully registered and communicating with Cisco SecureX. Option D is correct because the FMC expert shell stores cloud services and API-related log files under /var/log/cisco/, and examining these logs reveals authentication, token, and API communication errors that indicate whether the SecureX integration is working. Option A is incorrect because 'show securex status' is not a valid FTD CLI command for verifying SecureX integration. Option B is incorrect because pxgrid.log relates to Cisco Identity Services Engine pxGrid, not the FMC-to-SecureX integration. Option C is incorrect because 'show estreamer status' verifies the Event Streamer service used for event export, not the SecureX cloud integration.

Answer

Run 'show securex status' on the FTD CLI.

Answer

Inspect the 'pxgrid.log' file on the FMC.

Answer

Run 'show estreamer status' on the FTD CLI.

Question 10

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a SIEM. Which TWO settings in Platform Settings determine how syslog messages are formatted and transmitted? (Choose two)

Accepted Answer

Syslog server transport protocol (UDP or TCP/Reliable Syslog). Option A is correct because the Syslog Server configuration in Platform Settings lets you choose the transport protocol — UDP or TCP (Reliable Syslog) — which directly determines how syslog messages are transmitted to the SIEM. Option C is correct because the logging filters in Platform Settings define which severity levels and event categories are logged, which governs the content and formatting of the syslog messages that are sent. Option B is incorrect because the SecureX API integration client ID is used for SecureX/cloud threat-defense integration, not syslog formatting or transport. Option D is incorrect because the eStreamer client certificate bundle password relates to the eStreamer event streaming service, not syslog. Option E is incorrect because the ISE pxGrid node IP address is used for identity-based integration with Cisco ISE, not syslog delivery.

Answer

The SecureX API integration client ID

Answer

The eStreamer client certificate bundle password

Answer

The ISE pxGrid node IP address

Question 11

An engineer is troubleshooting Cisco Secure Firewall integration with Cisco SecureX. The integration is active, but a custom threat indicator block action initiated in SecureX fails to reach the managed FTD devices. Which TWO troubleshooting steps should the engineer perform? (Choose two)

Accepted Answer

Check FMC cloud services log files to verify that API requests from SecureX completed successfully without authorization errors.. Option C is correct because SecureX pushes threat indicator block actions to the on-prem FMC via the cloud-delivered REST API, so the FMC cloud services logs (e.g., /var/log/cloud-services/ or the Cisco Cloud Services logs) are the authoritative place to confirm the API request arrived and was authorized with a valid Smart Licensing/registration token rather than rejected with a 401/403. Option D is correct because once FMC accepts the SecureX API call it must translate the indicator into an access control or threat policy change and create a pending deployment; if no pending deployment exists for the managed FTD, the block action will never be enforced, so verifying the webhook receipt and the pending deploy is the key end-to-end check. Option A is wrong because 'show pxgrid status' is not a valid FTD CLI command and pxGrid is used for ISE/TrustSec identity integration, not for SecureX threat indicator delivery. Option B is wrong because estreamer.log relates to the Event Streamer service used for sending FTD events to the cloud (e.g., SecureX/Smart Licensing telemetry), not to receiving block actions from SecureX. Option E is wrong because rebooting the FTD is not a supported troubleshooting step for SecureX integration and would not force any cloud synchronization of threat indicators.

Answer

Run 'show pxgrid status' on the FTD CLI.

Answer

Inspect the 'estreamer.log' on the FTD CLI.

Answer

Restart the physical FTD appliance to force cloud synchronization.

Question 12

An enterprise integrates Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. Which TWO conditions or events can cause an active user-to-IP mapping to be purged from the FTD identity table? (Choose two)

Accepted Answer

Receipt of a RADIUS accounting stop message or session timeout expiration.. Active identity mappings are purged when ISE sends session termination notices (logoff) or when accounting stop messages are received from the network access device.

Answer

A scheduled weekly restart of the eStreamer service on the FMC.

Answer

Automatic daily rotation of the FMC administrator password.

Answer

An update to the Snort intrusion signature package.

Question 13

An administrator is troubleshooting a Cisco ISE and Secure Firewall pxGrid integration where identity policies are failing to match traffic. Which TWO tools or diagnostic methods should the administrator use to verify that IP-to-user mappings are present on the FTD? (Choose two)

Accepted Answer

Run 'show user-identity user' on the FTD CLI to verify active user mappings.. Option B is correct because 'show user-identity user' on the FTD CLI displays the active IP-to-user mappings that the firewall has learned from pxGrid, directly confirming whether identity data is present for policy matching. Option C is correct because entering expert mode and running 'show idedb statistics' inspects the identity database (idedb) counters and entries, verifying that user-to-IP bindings are actually populated on the FTD. Option A is incorrect because 'estreamer.log' relates to the Event Streamer (eStreamer) client used for sending events to external collectors, not to pxGrid identity mapping. Option D is incorrect because 'show ise-server status' is not a valid FMC command for verifying FTD identity mappings and does not reflect pxGrid user data. Option E is incorrect because 'debug pxgrid packet' is not a supported FTD privileged EXEC command for validating IP-to-user mappings.

Answer

Inspect the 'estreamer.log' file on the FTD CLI.

Answer

Run 'show ise-server status' on the FMC CLI.

Answer

Run 'debug pxgrid packet' on the FTD privileged EXEC mode.

Question 14

An administrator is configuring third-party SIEM integration using eStreamer. Which TWO actions must be completed on the FMC to generate the necessary client integration files? (Choose two)

Accepted Answer

Generate the PKCS#12 certificate bundle and download the CA certificate for the client.. Option C is correct because the FMC's eStreamer configuration requires generating a PKCS#12 (.p12) certificate bundle for the eStreamer client along with downloading the CA certificate, which the third-party SIEM client uses to authenticate to the FMC's eStreamer service over TLS. Option D is correct because the administrator must enter the IP address of the external eStreamer client host in the FMC eStreamer configuration page, which authorizes that specific client to connect and receive event data. Options A, B, and E are incorrect: pxGrid persona is a Cisco ISE/pxGrid function not configured on the FMC for eStreamer, SecureX API tokens are unrelated to eStreamer client authentication, and syslog server configuration under FTD Platform Settings is for syslog forwarding rather than eStreamer integration.

Answer

Enable the pxGrid service persona on the FMC management interface.

Answer

Generate a SecureX API token from FMC System Preferences.

Answer

Configure a syslog server IP address under FTD Platform Settings.

Question 15

An administrator is configuring Cisco Identity Services Engine (ISE) integration with Cisco Secure Firewall Threat Defense using TrustSec. Which protocol is primarily utilized to exchange Security Group Tags (SGTs) and SGs to IP mappings directly between the ISE policy service node and the firewall?

Accepted Answer

SXP. TrustSec SGTs and IP-to-SGT mappings are exchanged between ISE and the firewall utilizing the SGT Exchange Protocol (SXP).

Answer

RADIUS

Answer

pxGrid

Answer

TACACS+ dACLs