300-710 SNCF Management And Troubleshooting — 10 Questions

Question 1

An administrator successfully restores an FMC backup onto a freshly deployed FMC virtual appliance of the exact same software version. However, after the restore completes, all managed FTD devices show a status of 'Offline' or 'Config Apply Failed'. What is the most likely root cause and correct resolution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The new FMC has a different system UUID and Internal Certificate Authority keys; the administrator must re-establish trust by re-registering the FTD devices using new registration keys.. When an FMC backup is restored onto a new FMC appliance, the new FMC generates its own system UUID and Internal Certificate Authority (CA) keys, which differ from the original FMC's. FTD devices trust the original FMC's CA and UUID, so after restore they cannot re-establish the sftunnel trust relationship and show as Offline or Config Apply Failed. The correct resolution is to re-register each FTD with the new FMC using fresh registration keys.

Answer

The FTD management interface IP addresses must be manually changed to match the old FMC management subnet.

Answer

The administrator must run 'configure manager add' on the FMC CLI to force an SNMP trap listener.

Answer

The FTD devices automatically wipe their configurations when an FMC backup is restored; the administrator must factory reset every FTD.

Question 2

An administrator notices that the Firepower Management Center (FMC) health monitor shows a critical warning regarding high disk utilization on the /var partition. Which built-in utility or action should the administrator perform first to safely free up disk space without disrupting critical database integrity?

Accepted Answer

Use the FMC GUI to delete unneeded packet captures and older correlation event logs or prune event data via System > Health > Monitor.. The FMC health monitor flags /var disk pressure primarily because event data, correlation logs, and stored packet captures accumulate there. The supported, non-disruptive remediation is to use the FMC GUI to delete unneeded packet captures and prune older correlation/event data (System > Health > Monitor, plus Analysis > Correlation > Audit Log or the event pruning settings). This frees space while preserving the database schema and integrity, unlike manual filesystem surgery.

Answer

Reboot the FMC appliance into single-user mode and execute a complete filesystem format on the /var partition.

Answer

Navigate to System > Integration > Snort and delete all historical rule inspection data.

Answer

Run the 'rm -rf /var/sf/imagedb/*' command directly from the expert mode CLI to purge immediate image databases.

Question 3

An FTD device managed by FMC is experiencing high CPU utilization attributed to the Snort inspection engine. The administrator wants to identify which specific intrusion rules or access control rules are consuming the most resources. Which tool or report should the administrator use?

Accepted Answer

Access the FTD CLI and run 'system support diagnostic-cli' followed by 'show perfstats' or review the Intrusion Performance dashboard in FMC.. The Intrusion Performance dashboard in FMC provides detailed statistics on Snort inspection performance, including top rules by packet count, byte count, and CPU usage. Additionally, the FTD CLI command 'system support diagnostic-cli' followed by 'show perfstats' gives real-time performance data for the Snort engine. Together, these tools allow the administrator to identify which specific intrusion rules or access control rules are consuming the most resources.

Answer

Run a packet capture on the management interface (eth0) with a BPF filter for CPU interrupts.

Answer

Navigate to Analysis > Datastores > Packet Trace and export the raw CPU register dump.

Answer

Check the Interfaces > Counters page in the Cisco Integrated Management Controller (CIMC).

Question 4

An engineer needs to troubleshoot an intermittent connectivity issue between a secured zone and the internet through a Firepower Threat Defense (FTD) managed by FMC. The engineer wants to capture traffic hitting a specific Access Control rule without overwhelming the system. Which packet capture configuration is most appropriate?

Accepted Answer

Create an advanced capture in the FMC under Devices > Device Management > Packet Capture, specifying the ingress interface, matching IP filters, and enabling the 'Promiscuous Mode' option.. FMC's advanced packet capture feature (Devices > Device Management > Packet Capture) allows you to define a capture with specific ingress interfaces, IP/port filters, and buffer settings, which limits the capture to only the traffic of interest. This targeted approach avoids overwhelming the FTD's CPU and disk while still capturing packets that hit the specific Access Control rule being troubleshot. Promiscuous mode is not strictly required for FTD captures but the option is available; the key is the filtering and interface scoping.

Answer

Configure a global capture on all interfaces using the 'capture global interface any' command without any access lists or filters.

Answer

Enable 'Debug All Packets' in the FTD expert mode shell via system support diagnostic-cli.

Answer

Modify the Snort detection engine configuration to write every inspected packet directly to a text file in /var/log/snort.

Question 5

An administrator is preparing to upgrade a high-availability (HA) pair of Firepower Threat Defense devices managed by an FMC. Before initiating the upgrade task via the FMC upgrade tool, which preliminary action is mandatory to ensure a seamless process and prevent split-brain conditions?

Accepted Answer

Run the software pre-upgrade checker package on the FTD units via the FMC System > Updates interface to identify blocking dependencies or insufficient disk space.. Before upgrading an FTD HA pair via FMC, the mandatory preliminary step is to run the software pre-upgrade checker package on the FTD units through the FMC System > Updates interface. This checker validates readiness by identifying blocking dependencies, insufficient disk space, and other conditions that could cause the upgrade to fail or cause HA split-brain. It is a required step in the FMC upgrade workflow.

Answer

Manually break the High Availability pair, upgrade the Secondary unit first, and promote it to Primary before upgrading the old Primary unit.

Answer

Execute 'ha-manager failover-disable' from the expert CLI on both units to permanently disable heartbeat signaling.

Answer

Export the entire database, reinstall the operating system from a USB thumb drive on both devices, and restore the configuration.

Question 6

An administrator is troubleshooting a scenario where Snort inspection threads on an FTD are crashing intermittently, producing core dumps. To assist Cisco TAC in root cause analysis, what is the correct sequence of tools or CLI commands to collect the necessary diagnostic data?

Accepted Answer

Access the FTD CLI and execute the 'system support tech-support' command to generate a comprehensive diagnostic tarball containing core files and system logs.. The correct approach is to access the FTD CLI and run 'system support tech-support', which generates a comprehensive diagnostic tarball that includes core files, system logs, and configuration data needed by Cisco TAC for root cause analysis. This is the standard Cisco-recommended method for collecting troubleshooting data from FTD devices.

Answer

Log into the FMC GUI, go to System > Health > Diagnostics, and click 'Purge Cores'.

Answer

Run 'snort-engine restart --debug' in the expert mode shell and capture live stderr streams using tcpdump.

Answer

Export the running-config via TFTP and open the core dump files using a standard text editor.

Question 7

An administrator is troubleshooting an issue where an FMC cannot communicate with a managed FTD device. The health monitor shows registration is down. The administrator checks the FTD CLI and verifies the registration key and NAT ID. Which log file on the FTD should the administrator examine to troubleshoot registration and communication daemon errors (such as sftunnel)?

Accepted Answer

/var/log/cisco/sftunnel.log. The sftunnel daemon manages secure communication between FTD and FMC. Its logs are located in /var/log/cisco/sftunnel.log on the FTD filesystem.

Answer

/var/sf/nl/nl_manager.log

Answer

/var/log/messages

Answer

/opt/cisco/wsm/logs/startup.log

Question 8

An administrator wants to verify the NTP synchronization status and time offset on a managed FTD device from the FMC GUI. Where can this health and system information be viewed?

Accepted Answer

Devices > Device Management > Edit Device > General / Platform Settings. In FMC, per-device health and system information — including NTP synchronization status, time offset, and clock source — is viewed by navigating to Devices > Device Management, editing the specific FTD, and reviewing the General and Platform Settings sections. This is where the device's time synchronization state and related health details are surfaced for that managed device.

Answer

Policies > Platform Settings > Time Synchronization

Answer

System > Health > NTP Status

Answer

Analysis > Dashboards > Time Sync

Question 9

An FMC managed deployment is experiencing slow GUI performance and delayed event reporting. The administrator suspects database table bloat in the FMC PostgreSQL database. Which utility or command can the administrator run from the FMC expert shell to analyze and vacuum/optimize the database safely?

Accepted Answer

Execute the FMC database optimization script or use 'system support database-optimizer' if available, or consult Cisco documentation for running vacuum scripts via the sf bin directory.. To address database table bloat in the FMC PostgreSQL database, the administrator can run the FMC database optimization script or use 'system support database-optimizer' if available, or consult Cisco documentation for running vacuum scripts via the sf bin directory. This safely analyzes and vacuums the database to reclaim space and improve performance.

Answer

Use the FMC GUI under System > Database > Purge and click 'Format Storage'.

Answer

Run 'pg_ctlcluster 12 main restart' in the root shell.

Answer

Execute 'drop database sf_db; recreate database;' from the PostgreSQL prompt.

Question 10

An administrator is troubleshooting a VPN tunnel termination issue on an FTD device. To check IPsec Phase 1 and Phase 2 security associations (SAs) and real-time crypto debugging messages, which command should be executed on the FTD diagnostic CLI?

Accepted Answer

Access the diagnostic CLI via 'system support diagnostic-cli' and run 'show crypto ipsec sa' and 'show crypto isa sa'.. To check IPsec Phase 1 and Phase 2 SAs and real-time crypto debugging on FTD, you must access the diagnostic CLI via 'system support diagnostic-cli' and then run 'show crypto ipsec sa' and 'show crypto isa sa'. These commands display the security associations and can be used with debug commands for real-time troubleshooting.

Answer

Run 'system support VPN-debug enable' from the FTD expert shell.

Answer

Run 'vpn session print' in the expert mode root shell.

Answer

Execute 'show vpn-status' from the FMC CLI.