300-710 SNCF Integration Practice Test 6 — 15 Questions

Question 1

Which protocol is utilized by Cisco Secure Firewall Management Center and FTD devices to communicate with Cisco SecureX for cloud-delivered threat intelligence?

Accepted Answer

HTTPS (REST API over port 443). Cisco SecureX and cloud services communicate with Cisco Secure Firewall Management Center using REST APIs over HTTPS (port 443).

Answer

SNMPv2c

Answer

TFTP

Answer

Syslog over UDP 514

Question 2

An engineer is troubleshooting a Cisco ISE and Secure Firewall pxGrid integration. The administrator notices that user group memberships are not populating correctly on the FTD, even though IP-to-user mappings are visible. What is the most likely reason user group information is missing?

Accepted Answer

ISE is not configured to include user group attributes in pxGrid publication feeds, or the FMC requires direct LDAP/AD integration to resolve user group hierarchies.. While pxGrid shares IP-to-user mappings, user group attribute resolution often relies on Active Directory integration or LDAP directory configurations mapped within ISE or synchronized via Active Directory Agent / ISE Active Directory attribute retrieval. If ISE is not configured to publish user group attributes over pxGrid or if the FMC lacks AD LDAP integration to resolve the groups, group-based rules will fail.

Answer

The FMC eStreamer service is blocking group attribute propagation.

Answer

User groups can only be resolved via RADIUS accounting attributes, making pxGrid fundamentally incompatible with user group filtering.

Answer

The FTD Snort engine must be configured with a local flat file containing all user group names.

Question 3

An administrator is troubleshooting an eStreamer integration where custom Python client scripts fail to receive events from the FMC. The administrator verifies that network connectivity, certificates, and user permissions are correct. Upon running the client script in verbose mode, the error indicates an 'Incompatible Protocol Version' between the client SDK and the FMC. How is this resolved?

Accepted Answer

Update the eStreamer client SDK on the third-party SIEM to a version compatible with the current FMC software release.. Cisco FMC updates frequently include eStreamer protocol version upgrades. If an older third-party SIEM client SDK is used with a newly upgraded FMC, the client SDK must be updated to match or support the eStreamer protocol version running on the FMC.

Answer

Downgrade the FMC software to match the legacy eStreamer client library.

Answer

Switch from eStreamer to legacy SNMP traps.

Answer

Modify the eStreamer version registry key in the FMC expert shell configuration file.

Question 4

An administrator is integrating Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. The connection fails during the certificate validation phase because the FMC rejects the ISE pxGrid certificate. Upon inspection, the FMC certificate store lacks the intermediate CA certificate of the PKI hierarchy used by ISE. How should the administrator resolve this?

Accepted Answer

Upload the complete certificate authority chain (Root and Intermediate CA certificates) into the FMC Trusted CAs object repository.. Mutual TLS for pxGrid requires the FMC to trust the entire certificate chain presented by ISE. The administrator must upload both the Root CA and Intermediate CA certificates of the ISE PKI to the FMC's trusted certificate store under Object Management > PKI > Trusted CAs.

Answer

Configure an SNMPv3 community string to bridge the certificate trust gap.

Answer

Generate a self-signed certificate on the FTD CLI and assign it as the pxGrid trust anchor.

Answer

Disable certificate validation in the FMC pxGrid advanced configuration menu.

Question 5

Which protocol is natively used by Cisco Secure Firewall Management Center to stream connection and intrusion events to external SIEM systems in real time?

Accepted Answer

eStreamer. eStreamer is Cisco's proprietary protocol and API used for streaming security events from FMC to SIEMs.

Answer

HTTP SOAP

Answer

TFTP

Answer

NetFlow v9

Question 6

An administrator configures an eStreamer client script on a remote server to receive events from FMC. The script connects successfully and starts receiving events, but after a few hours, the connection drops and throws a timeout error. What is the most likely cause of this behavior?

Accepted Answer

An intermediate firewall or stateful device closed the TCP port 8302 session due to inactivity timeout.. Firewalls or intermediate network devices along the path between the external eStreamer client and the FMC often have idle session timeouts (e.g., 30 minutes or 1 hour). If eStreamer traffic is quiet, the session times out. eStreamer keepalive configurations or firewall idle timeouts must be adjusted.

Answer

The eStreamer service on the FMC has a hard-coded 2-hour session limit for security reasons.

Answer

The FMC automatically rotates the eStreamer client certificate every 4 hours.

Answer

The Snort inspection engine on the FTD restarts hourly to clear cache.

Question 7

An administrator is configuring Cisco Secure Firewall Threat Defense to export syslog messages to a remote SIEM. Which TWO parameters can be customized under the FTD Platform Settings syslog configuration? (Choose two)

Accepted Answer

Syslog facility levels (e.g., local0 through local7) and severity filters. Under FTD Platform Settings > Syslog, the administrator can define the logging destination and customize how messages are sent, including the syslog facility (local0 through local7) and severity level filters that determine which messages are forwarded to the SIEM, making option D correct. The same configuration section also lets you select the transport used to reach the syslog server—UDP or TCP with Reliable Syslog (TLS encryption)—so option E is correct. Option A is wrong because IPsec tunnel encryption algorithms are configured in the VPN/IPsec settings, not in Platform Settings syslog. Option B is wrong because the OSPF router ID is set under routing protocol configuration, not syslog. Option C is wrong because Snort inspection memory allocation is tuned in the inspection engine/advanced settings, not in the syslog configuration.

Answer

The encryption algorithm used for IPsec VPN tunnels terminating on the FTD

Answer

The OSPF routing protocol router ID

Answer

The Snort inspection engine memory allocation size

Question 8

An administrator wants to configure Access Control rules on Cisco Secure Firewall Threat Defense using identity context received from Cisco ISE via pxGrid. Which TWO criteria can be utilized in the Access Control policy rule configuration once pxGrid is fully integrated? (Choose two)

Accepted Answer

User names and User Groups. Option A is correct because once Cisco ISE is integrated with Cisco Secure Firewall Threat Defense via pxGrid, the firewall receives user identity mappings (user-to-IP and user-to-group) that can be referenced directly in Access Control policy rules as User and User Group conditions. Option B is correct because pxGrid also propagates Security Group Tags (SGTs) from ISE, and the Access Control policy can match traffic based on source/destination SGT values (TrustSec/SGT conditions) when the integration is fully established. Options C, D, and E are incorrect because DHCP lease pool exhaustion percentages, OSPF neighbor adjacency states, and MACsec encryption key lifetimes are not identity context delivered by pxGrid and are not selectable criteria in Access Control rule configuration; they relate to DHCP monitoring, routing protocol state, and link-layer encryption key management, respectively.

Answer

DHCP lease pool exhaustion percentages

Answer

OSPF neighbor adjacency states

Answer

MACsec encryption key lifetimes

Question 9

An administrator is planning a third-party SIEM integration with Cisco Secure Firewall Management Center. Which TWO methods or protocols are officially supported for exporting event data from the FMC to the SIEM? (Choose two)

Accepted Answer

eStreamer API / protocol over TCP port 8302. Option A is correct because the eStreamer (Event Streamer) API is Cisco's officially supported client-server protocol for sending FMC event data to third-party SIEMs; the eStreamer server on the FMC listens on TCP port 8302 and streams events to a client installed on the SIEM host. Option C is correct because FMC supports syslog export of events, configured through FTD Platform Settings (Syslog settings), and can send syslog over UDP or TCP, including TCP with TLS encryption, to an external SIEM. Option B is not correct because exporting raw PCAP files via FTP is not an event-export integration method for SIEMs and is not an officially supported SIEM data feed. Option D is not correct because direct SQL replication from the FMC's internal PostgreSQL database over SSH is unsupported and would violate Cisco's database access model. Option E is not correct because NetFlow export is a traffic-flow telemetry feature, not an FMC event-export method to a SIEM, and the FMC management interface does not provide NetFlow v5 export for this purpose.

Answer

Exporting raw packet captures (PCAP) via FTP every 5 minutes

Answer

Direct SQL database replication from the FMC internal PostgreSQL database over SSH

Answer

NetFlow v5 export from the FMC management interface

Question 10

An administrator configures Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO features help ensure that syslog messages are transmitted securely and reliably across untrusted networks? (Choose two)

Accepted Answer

Enabling TLS encryption for syslog transmission to protect sensitive log contents in transit.. Option B is correct because enabling TLS encryption for syslog transmission (often implemented as syslog over TLS, typically on TCP port 6514) protects the confidentiality and integrity of log contents as they traverse untrusted networks, preventing eavesdropping or tampering. Option C is correct because Reliable Syslog over TCP uses TCP's acknowledgments, retransmissions, and flow control to ensure messages are delivered reliably, unlike fire-and-forget UDP syslog. Option A is incorrect because SNMPv3 privacy and authentication secure SNMP polling/traps, not syslog transport, and configuring it on the syslog server does not secure syslog messages. Option D is incorrect because designating the syslog server IP as a secondary management gateway is not a valid or relevant mechanism for securing or ensuring reliable syslog delivery. Option E is incorrect because SSH tunneling does not run over UDP port 514, and standard syslog over UDP 514 is neither encrypted nor reliable.

Answer

Configuring SNMPv3 privacy and authentication parameters on the syslog server.

Answer

Configuring the syslog server IP as a secondary management gateway.

Answer

Enabling SSH tunneling on UDP port 514.

Question 11

An engineer is troubleshooting a scenario where Security Group Tags (SGTs) are not being enforced by FTD access control rules despite an active pxGrid connection between ISE and FMC. Which TWO potential causes should the engineer investigate? (Choose two)

Accepted Answer

SXP peering or inline TrustSec header propagation is missing along the data path between the endpoint and the FTD interface.. Option C is correct because SGT enforcement on FTD requires that the tag actually reaches the device: either via inline TrustSec (Cisco Metadata) header propagation from the upstream switch, or via SXP peering that carries IP-to-SGT mappings to the FTD. If neither the inline tag nor an SXP-learned mapping is present on the data path, the FTD has no SGT to match even though pxGrid is up. Option E is correct because FTD access control rules must explicitly reference the SGT in the rule's source/destination (Users/SGT) condition; if no SGT object is selected in the rule, the rule cannot match tagged traffic regardless of pxGrid status. Option A is incorrect because Active Directory registration of the FTD management IP is irrelevant to SGT propagation and enforcement. Option B is incorrect because eStreamer is a separate FMC event-streaming service for external consumers and is not the mechanism that delivers SGT mappings to FTD. Option D is incorrect because syslog facility local0 on a switch has no bearing on TrustSec tag propagation or FTD rule matching.

Answer

The FTD management interface IP address is not registered in Active Directory.

Answer

The FMC eStreamer service is disabled, blocking SGT updates.

Answer

Syslog facility local0 is not configured on the switch.

Question 12

An enterprise integrates Cisco Secure Firewall Threat Defense with Cisco ISE via pxGrid. The security team notices that user identity mapping is intermittent for wireless clients roaming across different access points. Which TWO factors should be verified to ensure robust identity continuity during wireless roaming? (Choose two)

Accepted Answer

Ensure that ISE session updates and RADIUS accounting interim updates are properly configured on the wireless controllers.. Option B is correct because robust identity continuity during wireless roaming depends on ISE receiving timely session updates; RADIUS accounting interim updates (RFC 2869 Acct-Interim-Interval) from the wireless controllers keep ISE's session directory current as clients move between access points, so pxGrid can publish accurate user-to-IP mappings. Option C is correct because the FTD consumes identity data from ISE over pxGrid, so the pxGrid session directory must be actively publishing sessions and the FTD's subscriptions must remain established without disconnects; if the pxGrid connection drops or subscriptions lapse, identity mappings become intermittent. Option A is wrong because disabling the Snort engine would impair threat inspection and has no bearing on identity mapping. Option D is wrong because SXP is a separate IP-to-user mapping propagation protocol and is not required for pxGrid-based ISE-to-FTD identity integration. Option E is wrong because static ARP entries do not provide user identity information and would not resolve intermittent identity mapping.

Answer

Disable the Snort engine during wireless handover events.

Answer

Ensure the FTD is configured as an SXP speaker for wireless SSIDs.

Answer

Configure static ARP entries for all wireless client MAC addresses on the FTD.

Question 13

An administrator is troubleshooting an eStreamer connection between the FMC and a custom Python SIEM script. The connection is established, but no intrusion events appear in the SIEM. Which TWO potential reasons could explain why intrusion events are missing from the stream? (Choose two)

Accepted Answer

The Access Control policy applied to the FTD devices does not have an Intrusion Policy assigned to inspect and generate events.. Option C is correct because eStreamer only streams intrusion events that the FTD actually generates; if the Access Control policy has no Intrusion Policy assigned to the relevant rules, no intrusion inspection occurs and therefore no intrusion events exist to send to the SIEM. Option D is correct because eStreamer clients must explicitly request the event types they want during the initial handshake (the request message specifies flags for intrusion events, connection events, etc.); if the Python script omits the intrusion event record type in its subscription request, the FMC will not stream those events even though the connection is up. Option A is not correct because eStreamer uses a proprietary TCP-based protocol on port 8302, and a UDP mismatch would prevent the connection from establishing at all, not merely suppress intrusion events. Option B is not correct because changing the listening port would also break the connection unless the client is reconfigured to match, and the scenario states the connection is established. Option E is not correct because blocking the FTD management interface IP would disrupt management connectivity, not the FMC-to-SIEM eStreamer event stream, and Access Control rules do not govern eStreamer traffic.

Answer

The SIEM script is using UDP instead of TCP for eStreamer communication.

Answer

The FMC eStreamer listening port was changed from 8302 to 443.

Answer

The FTD management interface IP address is blocked by an Access Control rule.

Question 14

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages. Which TWO options can be included in the syslog message header or content to assist SIEM correlation and analysis? (Choose two)

Accepted Answer

Device name or firewall identifier in the syslog header. Option A is correct because the syslog header generated by Cisco Secure Firewall Threat Defense includes the device name or firewall identifier (the configured hostname), which lets a SIEM attribute each event to a specific sensor and correlate events across multiple firewalls. Option D is correct because Platform Settings on the FMC allow you to configure the syslog timestamp format (e.g., UTC or local time) and message severity, and a precise, consistent timestamp is essential for ordering and correlating events in a SIEM. Option B is not valid because exporting an FMC administrator password hash has no correlation value and would be a serious security exposure. Option C is not valid because syslog messages are lightweight event records and cannot carry a full Active Directory database file. Option E is not valid because syslog is a text-based protocol and does not append raw PCAP binary dumps to every message; packet capture is handled separately.

Answer

FMC administrator password hash for auditing

Answer

Full Active Directory database file attachments

Answer

Raw PCAP binary dumps appended to every syslog packet

Question 15

An administrator is setting up Cisco ISE pxGrid integration with Cisco Secure Firewall Management Center. Which TWO configuration steps must be performed on the Cisco ISE side to ensure successful integration? (Choose two)

Accepted Answer

Approve the FMC client registration request in the Cisco ISE pxGrid client management settings.. Option D is correct because pxGrid uses mutual certificate-based authentication, and when FMC first connects as a pxGrid client, its registration request must be approved by an ISE administrator under Administration > pxGrid Services > Client Management before the client can subscribe to or publish on the pxGrid bus. Option E is correct because the pxGrid persona is not enabled by default; the administrator must enable the pxGrid service on the appropriate ISE node (typically the PAN/MnT or a dedicated pxGrid node) under Administration > System > Deployment so the node can host the pxGrid controller and accept client connections. Option A is wrong because eStreamer is a Firepower/FSMC-side event-streaming service, not an ISE policy service node component. Option B is wrong because SNMPv2c traps are for monitoring/alerting and play no role in pxGrid integration. Option C is wrong because TACACS+ shared secrets are for device administration authentication, not for pxGrid, which relies on certificates rather than a shared secret.

Answer

Configure an eStreamer server instance on the ISE policy service node.

Answer

Enable SNMPv2c traps on the ISE administration node.

Answer

Export the ISE TACACS+ shared secret to the FTD CLI.