300-710 SNCF Integration Practice Test 5 — 15 Questions

Question 1

An enterprise integrates Cisco Secure Firewall Management Center with Cisco ISE using pxGrid for identity-based access control. The security team notices that user identity mapping works for domain users authenticating via 802.1X, but guest users connecting through a WebAuth portal do not have their user-to-IP mappings populated on the FTD. What is the root cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The pxGrid connection on ISE is not subscribed to the guest session topic, or guest session publishing is disabled in ISE deployment settings.. Guest users authenticated via WebAuth on ISE may not have active pxGrid session directory notifications if the guest profile or ISE profiler service is not configured to publish guest sessions, or if the pxGrid node is not subscribed to guest session topics (such as 'Session Directory' guest events).

Answer

FMC requires an active eStreamer connection to ingest guest identities because pxGrid only supports Active Directory domain accounts.

Answer

Guest users must manually log into a captive portal hosted on the FTD data plane before ISE can share their identity.

Answer

The FTD identity policy must be configured with a RADIUS server group instead of pxGrid to support guest VLANs.

Question 2

An administrator is configuring third-party SIEM integration using eStreamer. The external client application encounters a TLS handshake failure when attempting to connect to the FMC eStreamer port. What is the standard troubleshooting step to resolve certificate validation issues between an external eStreamer client and the FMC?

Accepted Answer

Generate a new pkcs12 client certificate bundle from the FMC eStreamer configuration menu and import it into the client application store.. When setting up an external eStreamer client, the administrator must generate a PKCS#12 (.pfx or .pem) client certificate bundle and copy the corresponding CA certificate to the client host so that mutual TLS authentication succeeds.

Answer

Disable SSL/TLS verification in the FMC Platform Settings under the eStreamer daemon parameters.

Answer

Restart the Snort inspection engine on all managed FTD devices.

Answer

Change the eStreamer listening port from 8302 to 443 in the FMC System Preferences.

Question 3

When configuring Cisco Secure Firewall Threat Defense to forward syslog messages to a remote SIEM receiver, which transport layer protocols are natively supported for syslog export?

Accepted Answer

UDP and TCP. Cisco Secure Firewall Threat Defense supports both UDP and TCP (including reliable syslog over TCP) for transmitting syslog messages to external SIEMs.

Answer

HTTP and HTTPS only

Answer

UDP only

Answer

TCP and SCTP

Question 4

An organization uses Cisco Secure Firewall Threat Defense and integrates with Cisco ISE for identity policies. The security team notices that identity rules are intermittently failing because the FTD cache of IP-to-user mappings is being flushed unexpectedly. Upon investigation, what condition on FTD or ISE typically causes the purging of active user identity maps?

Accepted Answer

Receipt of an accounting stop message from the authenticator or an explicit session termination event from ISE pxGrid.. User identity mappings on FTD can be purged or invalidated due to RADIUS accounting stop messages, explicit pxGrid session termination notices from ISE (such as logoff or re-authentication timeouts), or when the maximum session idle timer expires on the firewall identity policy configuration.

Answer

A mismatch in the NTP time synchronization greater than 5 minutes between the FTD and the FMC.

Answer

Exceeding the FMC database storage limit for event logging.

Answer

Automatic daily rotation of the FMC administrator password.

Question 5

An administrator is setting up Cisco SecureX threat intelligence integration with Cisco Secure Firewall Management Center. The test connection fails with a 'Token Expired or Invalid' error. What is the correct procedure to re-establish trust and authentication between the FMC and SecureX?

Accepted Answer

Generate a new client ID and API key from the Cisco SecureX (Security Cloud Control) console and update the integration credentials in FMC System > Integration > SecureX.. To resolve API token or cloud registration expirations for SecureX, the administrator must re-register the FMC with SecureX by generating a new API key / integration credential from the SecureX/Security Cloud Control portal and pasting it into the FMC System > Integration > SecureX settings.

Answer

Log into the FTD CLI and execute the 'clear securex-token' command.

Answer

Reinstall the Snort rule updates package on the FMC.

Answer

Reboot the FMC appliance to regenerate the internal device certificate.

Question 6

Which protocol does Cisco Secure Firewall Threat Defense use to exchange SGT (Security Group Tag) metadata across intermediate routers that do not support inline tagging?

Accepted Answer

SXP (Scalable Group Tag Exchange Protocol). SXP (Scalable Group Tag Exchange Protocol) is a protocol used to propagate SGT-to-IP mappings across network devices and firewalls that do not support inline MACsec or IPsec SGT propagation.

Answer

RADIUS

Answer

TACACS+

Answer

SNMPv3

Question 7

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslogs to a third-party SIEM. To ensure confidentiality of sensitive log data traversing untrusted network segments, how should the syslog export be configured?

Accepted Answer

Configure Reliable Syslog utilizing TCP with TLS encryption under Platform Settings > Syslog.. To secure syslog transmission, administrators configure Reliable Syslog, which uses TLS encryption over TCP (typically on TCP port 6514) between the FTD and the SIEM syslog collector.

Answer

Configure HTTPS POST requests in the eStreamer client configuration.

Answer

Enable Secure Shell (SSH) port forwarding for UDP port 514.

Answer

Tunnel all UDP syslog packets inside an IPsec VPN tunnel terminated on the FMC management interface.

Question 8

An administrator integrates Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. After successful registration, the administrator wants to create an Access Control policy rule that blocks traffic from users in the 'Contractors' Security Group Tag. Where in the FMC rule creation wizard should the administrator configure this condition?

Accepted Answer

In the Access Control Rule, navigate to the Users tab and select the desired Security Group Tag.. In FMC Access Control policies, user and tag-based criteria are added under the 'Users' tab of the rule configuration, where Security Group Tags learned via pxGrid can be selected.

Answer

In Objects > Object Management > Access Control > SGT Objects.

Answer

In the Platform Settings policy under Identity Sources.

Answer

In the Access Control Rule, navigate to the Networks tab and select Security Groups.

Question 9

An engineer is configuring Cisco eStreamer to stream events from FMC to a third-party SIEM. The firewall security policy blocks incoming connections on port 8302 from the SIEM server to the FMC. Which device and interface are involved in listening for the eStreamer client connection?

Accepted Answer

The FMC management interface listening on TCP port 8302.. The eStreamer server process runs on the Cisco Secure Firewall Management Center (FMC), listening on TCP port 8302 on its management interface.

Answer

The FTD data interface listening on TCP port 8302.

Answer

The FTD management interface listening on UDP port 514.

Answer

The ISE pxGrid node listening on TCP port 8910.

Question 10

When integrating Cisco Secure Firewall with Cisco SecureX, which component acts as the local orchestrator and liaison that relays threat intelligence and response actions between the managed FTD devices and the SecureX cloud?

Accepted Answer

Cisco Secure Firewall Management Center (FMC). The Cisco Secure Firewall Management Center (FMC) acts as the central management point and cloud connector for SecureX integrations across all managed FTD sensors.

Answer

The Snort inspection engine running on each FTD

Answer

The Cisco Defense Orchestrator (CDO) local proxy

Answer

Cisco Identity Services Engine (ISE)

Question 11

Which type of events can be exported from Cisco Secure Firewall Management Center to a SIEM using the eStreamer protocol?

Accepted Answer

Connection, intrusion, and malware/file events. eStreamer supports exporting connection events, intrusion events, malware events, and host/identity data from the FMC database.

Answer

FMC administrator login CLI keystrokes only

Answer

Raw packet captures (PCAP) of every inspected flow

Answer

Routing table updates from OSPF and BGP protocols

Question 12

An administrator configures pxGrid integration between Cisco ISE and Secure Firewall Management Center. During the pxGrid certificate generation on ISE, the administrator must export the client certificate and keystore. What format must the client keystore be in when importing it into the FMC to establish the pxGrid trust relationship?

Accepted Answer

PKCS#12 (.pfx/.p12) bundle containing the client certificate, private key, and CA certificate.. The pxGrid client keystore must be a PKCS#12 (.pfx/.p12) bundle because FMC needs the client certificate, its matching private key, and the CA certificate together in one password-protected container to authenticate to the ISE pxGrid controller. ISE's pxGrid certificate generation workflow explicitly produces a .p12 file for download, and FMC's pxGrid client import expects exactly that bundle. Without the private key and CA chain in the same file, the TLS mutual-authentication handshake with ISE cannot complete.

Answer

Plaintext DER binary format without private keys.

Answer

Microsoft Exchange Web Services (EWS) XML format.

Answer

Java KeyStore (.jks) format exclusively.

Question 13

An enterprise integrates Cisco Secure Firewall Management Center with Cisco ISE using pxGrid for identity-based access control. The security team notices that user identity mapping works for domain users authenticating via 802.1X, but guest users connecting through a WebAuth portal do not have their user-to-IP mappings populated on the FTD. What is the root cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SecureX instructs Cisco ISE via API/pxGrid to apply an Adaptive Network Control (ANC) quarantine policy to the endpoint, while FMC blocks associated traffic flows.. SecureX orchestrates threat response by triggering an API call to ISE (via pxGrid/ANC) to dynamically apply an Adaptive Network Control (ANC) quarantine policy or to FMC to block the IP, isolating the compromised endpoint.

Answer

SecureX directly accesses the FTD data plane via SSH to shut down the physical switchport.

Answer

The FTD continuously polls SecureX and reconfigures its VLAN database using VTP.

Answer

ISE sends a DHCP release packet to the endpoint through the FTD inspection engine.

Question 14

Which command is used on the Cisco Secure Firewall Threat Defense CLI to verify that the device is successfully communicating with the Cisco Secure Firewall Management Center?

Accepted Answer

show managers. To check the registration and management connection status between FTD and FMC, the administrator uses the CLI command 'show managers'.

Answer

show fmc status

Answer

show isc status

Answer

show controller connection

Question 15

An organization integrates Cisco Secure Firewall Threat Defense with Cisco ISE via pxGrid. The security team notices that identity rules are matching incorrect users for traffic originating from shared Citrix terminal servers or Virtual Desktop Infrastructure (VDI) multi-user hosts. What mechanism must be enabled and configured to properly handle multi-user IP identity attribution on Secure Firewall?

Accepted Answer

Port-Based Identity mapping (or Terminal Services Agent integration) to correlate user sessions by source port in addition to IP address.. On multi-user hosts like Citrix or VDI, many users share a single IP address, so IP-to-user mapping alone cannot distinguish sessions. Port-Based Identity mapping (or Terminal Services Agent integration) correlates the source port of each connection with the user session on the host, allowing FTD to attribute traffic to the correct user even when the IP is shared.

Answer

Configuring SXP peers between the VDI hypervisor and the FMC.

Answer

Configuring static NAT overloading on the FTD egress interface.

Answer

Enabling SNMP polling on the VDI host so FMC can query active user sessions every 10 seconds.