300-710 SNCF Integration Practice Test 8 — 15 Questions

Question 1

When configuring Cisco ISE pxGrid integration within the Firepower Management Center, which TCP port must be open across the intermediate firewall for secure pxGrid communication?

Accepted Answer

TCP 8910. Cisco ISE pxGrid typically operates over TCP port 8910 for client-server communications.

Answer

TCP 389

Answer

TCP 80

Answer

UDP 514

Question 2

An administrator is configuring third-party SIEM integration using eStreamer on the FMC. A custom client application is written to connect to the FMC eStreamer server, but the connection is immediately reset. What is the most likely cause of this issue?

Accepted Answer

The eStreamer client certificate and pkcs12 password have not been generated and configured on the FMC.. Before an eStreamer client can connect to FMC, an eStreamer certificate and password must be generated on the FMC and imported into the client application.

Answer

The SIEM is using TCP port 443 instead of eStreamer default port 8305.

Answer

Syslog facility levels are set to local0 instead of daemon.

Answer

pxGrid service is disabled on the FMC.

Question 3

A security engineer is integrating Cisco Secure Firewall with a third-party SIEM using eStreamer. The SIEM vendor's connector documentation requires the eStreamer event types to be parsed correctly. Which file format or protocol encoding does eStreamer use to transmit event records over TCP port 8305?

Accepted Answer

Compressed binary-encoded records over a custom TCP session. eStreamer transmits serialized binary event records over a secured TCP connection.

Answer

JSON over HTTPS REST API

Answer

XML-formatted SOAP messages

Answer

Syslog-formatted plain text over TLS

Question 4

When configuring the integration between Cisco Secure Firewall and Cisco ISE via pxGrid, what is the primary role of Cisco ISE in this architecture?

Accepted Answer

To provide user identity, IP address mapping, and group context to the firewall.. Cisco ISE acts as the source of truth for user identity, endpoint posture, and contextual metadata, sharing it with the firewall via pxGrid.

Answer

To act as the primary syslog collector for firewall intrusion alerts.

Answer

To act as an inline packet inspection engine for Layer 7 threats.

Answer

To store and analyze raw eStreamer event streams from the firewall.

Question 5

An organization mandates that all integration traffic between Cisco Firepower Management Center and Cisco SecureX must be inspected. Which cloud connection mechanism does FMC use to communicate with SecureX threat intelligence and telemetry?

Accepted Answer

Outbound HTTPS REST API communication to Cisco SecureX cloud endpoints.. FMC connects outbound to Cisco SecureX using HTTPS (TCP port 443) via public cloud APIs and messaging fabric.

Answer

Direct syslog forwarding over TCP 6514 to the SecureX collector.

Answer

Inbound SSH tunneling initiated by the SecureX cloud connector.

Answer

Bidirectional IPSec VPN tunnel established automatically between FMC and SecureX cloud cluster.

Question 6

Which TWO protocols or mechanisms are used to integrate Cisco Identity Services Engine (ISE) with Cisco Secure Firewall Threat Defense? (Choose two)

Accepted Answer

SXP. Cisco ISE integrates with Secure Firewall using pxGrid (for identity/context sharing) and SXP (for SGT tag and IP mapping propagation).

Answer

NetFlow v5

Answer

LDAP direct bind

Answer

SNMPv1

Question 7

An engineer is troubleshooting a mutual TLS connection failure between Cisco ISE pxGrid and the FMC. The openssl command on the FMC reveals a 'certificate verify failed' error. What is the underlying reason for this error?

Accepted Answer

The peer certificate has been signed by a Certificate Authority whose root certificate is missing from the local trust store.. A 'certificate verify failed' error indicates that the client or server certificate was signed by a CA that is not present in the truststore of the peer verifying it.

Answer

The NTP clock skew between FMC and ISE exceeds 60 seconds, causing token expiration.

Answer

The pxGrid shared secret key contains unsupported special characters.

Answer

TCP port 8910 is blocked by an intermediate stateful firewall.

Question 8

Which THREE types of events can be streamed natively from Cisco Secure Firewall using the eStreamer API to a third-party SIEM or custom application? (Choose three)

Accepted Answer

Connection events. The eStreamer API is Cisco Secure Firewall's native event-streaming interface that pushes specific event categories to external SIEMs or custom applications. Option A (Connection events) is correct because connection/flow records are one of the core event types eStreamer exports, providing session details such as source/destination IP, ports, and bytes. Option C (File events) is correct because file and malware events generated by file policy (including file disposition and trajectory data) are streamed via eStreamer. Option E (Intrusion events) is correct because IPS/intrusion events from Snort-based inspection are a primary eStreamer event class. Option B is not correct because hardware temperature sensor telemetry is not an eStreamer event type; it is health monitoring data surfaced in FMC, not streamed through eStreamer. Option D is not correct because CLI administrator command audit logs are not part of the eStreamer event stream; administrative audit records are handled through FMC audit logging rather than eStreamer.

Answer

FMC hardware temperature sensor telemetry logs

Answer

CLI administrator command audit logs

Question 9

An administrator is configuring Cisco SecureX threat intelligence integration with Cisco Secure Firewall Threat Defense via the FMC. Which TWO actions can be performed directly through the SecureX integration? (Choose two)

Accepted Answer

Automatic synchronization of dynamic Indicators of Compromise (IoCs) to block malicious traffic.. SecureX integration allows sharing indicators of compromise (IoCs) for automated blocking/alerting and pivoting to Threat Response for investigation.

Answer

Real-time firmware updates pushed from the SecureX cloud console to the managed firewalls.

Answer

Replacement of local FMC policy administration with cloud-only RBAC management.

Answer

Direct deployment of Snort 3 custom intrusion rules compiled locally on the SecureX cloud platform.

Question 10

Which THREE configuration settings must be verified on the FMC when troubleshooting syslog export issues to a third-party SIEM receiver? (Choose three)

Accepted Answer

Syslog server IP address and port configuration in Platform Settings. Option A is correct because the syslog server IP address and port must be configured under Platform Settings > Syslog on the FMC; if the destination host or port is wrong or missing, no events will reach the third-party SIEM receiver. Option C is correct because the transport protocol selected on the FMC (UDP, TCP, or TLS) must match what the SIEM collector is listening for and can decode; a mismatch such as sending UDP to a TCP/TLS-only collector silently drops the events. Option E is correct because Access Control rule logging must be enabled with the appropriate log action (log at beginning and/or end of connection) for connection events to be generated and forwarded to syslog; without logging enabled on the relevant rules, there is nothing to export. Option B does not belong because pxGrid client approval in Cisco ISE relates to pxGrid-based identity and context sharing, not to FMC syslog export to a SIEM. Option D does not belong because eStreamer uses its own client certificate and is a separate event-streaming mechanism from syslog export, so its certificate validity is irrelevant to troubleshooting syslog delivery.

Answer

pxGrid client approval status in Cisco ISE

Answer

eStreamer client certificate validity

Question 11

An enterprise security architect is designing an architecture where Cisco Secure Firewall Threat Defense integrates with a third-party SIEM. Which THREE methods or protocols are officially supported for exporting security events and logs from the FMC/Firewall to the third-party SIEM? (Choose three)

Accepted Answer

Cisco SecureX / REST APIs for programmatic event retrieval. Option B is correct because the FMC exposes documented REST APIs (and Cisco SecureX/Threat Response integrations) that allow programmatic retrieval of events, alerts, and metadata for third-party SIEM consumption. Option C is correct because syslog forwarding is configured under Platform Settings on the FMC/Firewall, supporting UDP, TCP, and TLS transports to send connection, intrusion, and audit events to external collectors. Option E is correct because eStreamer is Cisco's officially supported event-streaming API that lets custom clients receive real-time event data from the FMC for SIEM integration. Option A is not supported: direct SQL replication against the FMC's internal PostgreSQL database is neither documented nor permitted, and would break support. Option D is not supported: SNMPv1 traps are used for health/status alerting, not for forwarding full packet payloads or complete security event logs.

Answer

Direct SQL database replication from the FMC internal PostgreSQL database to the SIEM

Answer

SNMPv1 trap forwarding of full packet payloads

Question 12

Which TWO benefits are gained by integrating Cisco Secure Firewall with Cisco Identity Services Engine (ISE) using TrustSec SGTs? (Choose two)

Accepted Answer

Propagation of security tags across network boundaries via SXP for consistent enforcement. Option A is correct because integrating Cisco Secure Firewall with ISE via TrustSec uses SXP (SGT Exchange Protocol) to propagate Security Group Tags (SGTs) across network boundaries, allowing consistent policy enforcement even where inline tagging is not supported. Option B is correct because ISE supplies identity and group information (user roles, AD group membership) that maps to SGTs, so firewall rules can be written against security group tags instead of volatile IP addresses. Option C is incorrect because the firewall does not send quarantine commands directly to Active Directory; remediation is typically handled by ISE/pxGrid and endpoint tools, not AD. Option D is incorrect because TrustSec is a segmentation/policy framework and does not replace routing protocols such as OSPF or BGP. Option E is incorrect because access control rules are still required on the firewall; SGTs enrich and simplify them rather than eliminating them.

Answer

Automatic remediation of endpoint malware infections via direct quarantine commands sent from the firewall to Active Directory

Answer

Replacement of traditional routing protocols with TrustSec matrix routing

Answer

Elimination of the need for access control rules on the firewall

Question 13

An administrator is configuring Cisco Secure Firewall Threat Defense to send connection and intrusion events to a third-party SIEM. Which protocol and port are natively supported by the eStreamer client integration for streaming events from the firewall?

Accepted Answer

TCP port 8302 using the eStreamer API. The Cisco eStreamer (Event Streamer) daemon on Secure Firewall Threat Defense communicates with external clients over TCP port 8302, using a securely negotiated SSL/TLS connection.

Answer

TCP port 514 using standard Syslog

Answer

TCP port 9997 using Splunk Forwarder protocol

Answer

UDP port 443 using HTTPS

Question 14

When configuring syslog export from Cisco Secure Firewall Threat Defense using Firepower Management Center, which alert format should you choose to ensure standard SIEM ingestion parsers can easily read the event headers?

Accepted Answer

IETF (RFC 5424) format. Syslog messages exported from Secure Firewall Threat Defense can be formatted using BSD (RFC 3164) or IETF (RFC 5424) formats. RFC 5424 is the standard IETF structured format widely supported by modern SIEMs.

Answer

SNMP v2c Trap format

Answer

Legacy ASA native text format

Answer

NetFlow v9 structured records

Question 15

Which TWO actions must be performed on Cisco ISE when setting up pxGrid integration with Cisco Secure Firewall Management Center (FMC)? (Choose two.)

Accepted Answer

Approve the certificate for the FMC client within the Cisco ISE pxGrid services administration interface.. Option B is correct because pxGrid uses mutual certificate-based authentication, so after the FMC registers as a pxGrid client, its client certificate must be approved in the ISE pxGrid Services administration interface before the FMC can subscribe to or publish pxGrid topics. Option E is correct because the pxGrid persona/service must be explicitly enabled on the ISE nodes (Policy Service Nodes or the Administration node) that will participate in the integration; otherwise the pxGrid controller and pub/sub services are not active and FMC cannot connect. Options A, C, and D are not required: pxGrid does not rely on TrustSec SGT propagation via NetFlow v9, SNMPv3 traps are not used to forward user-IP mappings to FMC, and RADIUS shared secrets belong to RADIUS authentication (e.g., for user or device authentication) rather than to the pxGrid integration itself.

Answer

Enable TrustSec SGT propagation via NetFlow v9 on all ISE interfaces.

Answer

Configure SNMPv3 traps on ISE to forward user IP mappings to the FMC.

Answer

Configure a RADIUS shared secret on the FMC platform settings page.