300-710 SNCF Integration Practice Test 3 — 15 Questions

Question 1

A network engineer is troubleshooting a Cisco ISE and Cisco Secure Firewall integration where users are failing to get assigned identity-based access control policies. The engineer notices that user-to-IP mappings are successfully retrieved via pxGrid, but Security Group Tags are missing. Where in Cisco FMC should the engineer verify the SXP connection settings?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Integration > Cisco ISE > SXP. In Cisco FMC, SXP (SGT Exchange Protocol) connections are configured under Integration > Cisco ISE > SXP. This is where the engineer can verify and configure the SXP connection settings to ensure Security Group Tags are propagated from Cisco ISE to FMC. The other locations do not contain SXP settings.

Answer

System > Integration > Threat Defense

Answer

Policies > Access Control > Identity

Answer

Devices > Device Management > Advanced > SXP

Question 2

A security analyst configures syslog integration on Cisco Secure Firewall Threat Defense to forward critical security events to a Splunk SIEM. Which configuration step must be performed within the Firepower Management Center (FMC) to ensure these logs include the user identity and SGT mapping?

Accepted Answer

Configure syslog alerts within the Access Control Policy rules and ensure user identity inclusion is enabled.. To include identity and user metadata in syslog messages generated by Threat Defense, the administrator must ensure that Extended Syslog formats or appropriate logging destinations containing user activity are enabled within the Platform Settings or Access Control Policy syslog settings.

Answer

Enable SNMP polling on the FMC for user IP mappings.

Answer

Deploy an eStreamer client directly on the Splunk indexer.

Answer

Configure NetFlow export templates to include SGT fields.

Question 3

An administrator is integrating Cisco Secure Firewall Threat Defense with Cisco Threat Response (now Cisco SecureX threat intelligence). Which mechanism does the firewall use to automatically receive dynamic indicators of compromise (IoCs) and perform retrospective security analysis?

Accepted Answer

Cisco SecureX cloud-native telemetry and integration settings configured in the FMC.. Secure Firewall integrates with Cisco SecureX threat intelligence / Threat Response via Cisco SecureX cloud services, which synchronize dynamic IoCs and trigger retrospective alerts.

Answer

Syslog forwarding over TLS to the Cisco Talos collector IP.

Answer

Periodic manual import of STIX/TAXII threat feeds via an automated script on port 443.

Answer

Direct eStreamer API polling from the Cisco Cloud proxy.

Question 4

Which Cisco SecureX component acts as the central pivot point for threat investigations across Cisco Secure Firewall, Cisco Secure Endpoint, and third-party security tools?

Accepted Answer

Cisco Threat Response. Cisco SecureX (or Cisco XDR) provides a cloud-native platform that unifies visibility and enables pivoting across security products.

Answer

Cisco eStreamer Client

Answer

Cisco ISE pxGrid Server

Answer

Firepower Device Manager (FDM)

Question 5

An engineer is troubleshooting a scenario where Cisco Secure Firewall is receiving SGT information from Cisco ISE via SXP, but access control rules referencing Security Group Tags are not matching traffic. What is the most effective command to run on the Threat Defense CLI to verify that the firewall has learned the IP-to-SGT mappings?

Accepted Answer

show sgt mapping. On Cisco Secure Firewall Threat Defense (CLI), the command 'show sgt mapping' or 'show ip sgt mapping' is used to verify learned SXP bindings. Specifically, 'show sgt map' or 'show epe sgt' depending on the exact build, but 'show ip sgt mapping' or 'show sgt' commands are standard. Wait, the exact command is 'show sgt mapping'.

Answer

show pxgrid clients

Answer

show trustsec sxp connections

Answer

show access-list

Question 6

An administrator needs to send Cisco Secure Firewall Threat Defense audit logs and security logs to an external syslog server. Which configuration object in the FMC Platform Settings must be modified to define the destination IP address, transport protocol, and port?

Accepted Answer

Devices > Platform Settings > Syslog > Syslog Servers. Syslog server destinations are configured under Platform Settings via the Syslog server object configuration within the FMC.

Answer

System > Integration > Syslog

Answer

Access Control Policy > Logging

Answer

Objects > Object Management > Syslog Destination

Question 7

An administrator sets up Cisco ISE and Secure Firewall integration. The firewall successfully learns user identities from ISE pxGrid, but when users roam to a new IP address, the firewall continues to apply the old IP-to-user mapping for several minutes. What is the best way to resolve this synchronization lag?

Accepted Answer

Ensure real-time pxGrid session notifications are enabled and check the Active Directory agent timeouts if applicable.. Tuning the pxGrid session refresh and timeout settings or verifying the pxGrid subscription status ensures prompt updates of session changes.

Answer

Reboot the FMC daily via a cron job.

Answer

Increase the NetFlow export interval to 1 minute.

Answer

Change the syslog facility to emergency.

Question 8

An administrator wishes to configure third-party SIEM integration with Cisco Secure Firewall Threat Defense by forwarding security events in a standard format. While eStreamer is available, the SIEM only accepts standard syslog. Which configuration options must be selected in FMC to ensure the SIEM receives parseable CEF (Common Event Format) or LEEF logs?

Accepted Answer

Configure syslog output format to include unified syslog or standard text formats compatible with SIEM parsers in Platform Settings.. FMC Platform Settings or Alert configurations allow formatting syslog output into industry-standard formats such as Cisco standard, or leveraging advanced logging integrations. Wait, FMC syslog settings support Cisco legacy format or standard syslog, but third-party SIEM parsing often relies on specific header mappings or third-party connectors. Let's look at standard FMC syslog capabilities: FMC allows configuring syslog alert formats under Platform Settings.

Answer

Enable the eStreamer-to-Syslog translator daemon inside Access Control policies.

Answer

Configure NetFlow v9 templates with custom CEF field type definitions.

Answer

Install a CEF/LEEF plugin on the managed Threat Defense device via FlexConfig.

Question 9

Which TWO details are typically required when establishing a pxGrid connection between Cisco ISE and the Firepower Management Center? (Choose two)

Accepted Answer

Cisco ISE node IP address or hostname. Option A is correct because the Firepower Management Center must be told the Cisco ISE node's IP address or hostname so it can reach the pxGrid controller service (typically on TCP 8910) and register as a pxGrid client. Option C is correct because pxGrid uses certificate-based authentication, so the FMC must present a client certificate issued by a CA trusted by ISE, along with the corresponding password/shared secret used during the client registration/enablement process. Option B is wrong because RADIUS shared secrets are used for 802.1X/MAC authentication to ISE, not for pxGrid, which is a separate REST/WebSocket-based service. Option D is wrong because the AD Global Catalog port 3268 is only relevant to ISE's Active Directory identity source configuration, not to pxGrid peering. Option E is wrong because SNMP community strings are for monitoring/polling and play no role in establishing a pxGrid connection.

Answer

RADIUS client shared secret for firewall authentication

Answer

Active Directory Global Catalog server port (3268)

Answer

SNMP community string for the ISE Policy Service Node

Question 10

You are integrating Cisco Secure Firewall Management Center (FMC) with Cisco Identity Services Engine (ISE) via pxGrid. After successfully establishing the pxGrid connection, user identity data is not populating on the FMC. Where in the FMC GUI should you verify that the SGTs and user-to-IP mappings are being received?

Accepted Answer

Analysis > Users > Active Sessions. User-to-IP mappings and Security Group Tags (SGTs) received via pxGrid can be verified under Analysis > Users > User Activity or by checking the Connection Status within the ISE configuration pane under System > Integration > ISE.

Answer

Devices > Device Management > Advanced > pxGrid

Answer

Objects > Object Management > Access Control List

Answer

System > Integration > Cisco ISE > Runtime Status

Question 11

An administrator is troubleshooting a Cisco Secure Firewall Threat Defense deployment integrated with Cisco ISE using pxGrid for TrustSec. The firewall is failing to enforce Security Group Tag (SGT) filtering on incoming traffic. What is the most likely cause of this issue?

Accepted Answer

Inline tagging is disabled in the access control policy Advanced settings.. For SGT enforcement to work properly on Secure Firewall Threat Defense, inline tagging must be enabled on the access control policy or the SGT/ISE integration must be explicitly mapped and enabled in the platform settings and access control rules, ensuring SGT metadata is preserved across security zones.

Answer

Syslog event generation for identity events is disabled in the platform settings.

Answer

The pxGrid certificate on ISE has expired, but the node trust is still active.

Answer

The eStreamer service on the FMC is stopped.

Question 12

An enterprise environment uses Cisco SecureX (now Cisco Security Cloud Control / Cisco XDR) integrated with Cisco Secure Firewall. An incident responder wants to use SecureX threat intelligence to automatically quarantine a compromised host whose IP address was identified by the firewall. Which component acts as the secure relay for API requests between SecureX and an on-premises FMC?

Accepted Answer

SecureX Device Connector. The SecureX Threat Response (or Cisco XDR) on-premises deployment relies on the SecureX Device Connector (or Secure Client/Cloud Connector framework embedded in FMC) to proxy API requests securely without requiring inbound firewall holes.

Answer

Cisco ISE pxGrid Node

Answer

Cisco Secure Network Analytics Manager

Answer

eStreamer Event Relay Service

Question 13

You are configuring identity-based access control rules on Cisco Secure Firewall Threat Defense using user groups imported from Cisco ISE via pxGrid. Users report that they are not matching the identity rule, although their IP address is correctly mapped to their username in the FMC Active Sessions table. What is the root cause?

Accepted Answer

The Realm configuration on the FMC has failed to synchronize user group DNs from the Active Directory source.. If user-to-IP mapping exists in the Active Sessions table but identity rules fail, it is often because the Realm configuration on the FMC has not successfully synchronized user group memberships from the Active Directory domain controller integrated behind ISE, or the group distinguished names do not match.

Answer

Advanced Malware Protection (AMP) cloud connection is offline.

Answer

SNMP traps are disabled on the Cisco ISE policy service node.

Answer

The eStreamer client certificate is untrusted by the FMC.

Question 14

An administrator needs to forward Cisco Secure Firewall Threat Defense intrusion events to a third-party SIEM in real-time. Which menu path in the Firepower Management Center is used to configure syslog alerts for intrusion rules?

Accepted Answer

Policies > Access Control > Intrusion. Intrusion event alerting via syslog in FMC is configured by navigating to Policies > Access Control > Intrusion, editing the intrusion policy, and configuring the alert destination settings or global alert responses.

Answer

Analysis > Intrusion > Events > Configuration

Answer

Devices > Device Management > Syslog

Answer

System > Integration > Syslog

Question 15

When configuring Cisco Secure Firewall Threat Defense integration with Cisco Threat Response (SecureX Threat Response) for automated threat hunting and mitigation, which THREE components or steps are required? (Choose three.)

Accepted Answer

Register the Firepower Management Center with the SecureX cloud portal using a generated registration token.. Integrating Secure Firewall with SecureX Threat Response requires registering the FMC with SecureX, configuring API access, and ensuring outbound HTTPS connectivity to the SecureX cloud infrastructure.

Answer

Configure an eStreamer client certificate specifically for SecureX cloud relay.

Answer

Deploy an external Syslog collector virtual appliance inside the SecureX cloud tenant.