300-710 SNCF Management And Troubleshooting — 20 Questions

Question 1

An engineer is troubleshooting a packet loss issue on an FTD interface. Which THREE CLI commands executed in the diagnostic CLI can help identify interface drops, errors, and buffer issues? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show interface detailed. To check interface errors, drops, and counters on FTD, administrators use 'show interface', 'show interface detailed', and 'cphw interface' or similar diagnostic commands.

Answer

show running-config interface-errors

Answer

show memory packet-buffers

Question 2

An engineer is troubleshooting high CPU usage on an FTD device managed by FMC. The engineer needs to capture packets containing specific HTTP traffic while bypassing the Snort inspection engine to isolate whether the high CPU is caused by Snort processing. Which action accomplishes this on the FTD CLI?

Accepted Answer

Configure a capture using the capture command with the 'no-snort' keyword.. When capturing packets on FTD CLI using the capture command, the 'no-snort' keyword allows capturing traffic that bypasses the Snort inspection engine, which is ideal for isolating performance issues.

Answer

Use the FMC Advanced Troubleshooting menu to disable Snort inspection globally during the capture.

Answer

Run a packet capture from the FMC platform settings and uncheck 'Inspection Engine Processing'.

Answer

Create an ACP rule with an IPS policy set to 'Disable' and run a packet trace.

Question 3

,An administrator needs to verify whether a specific security intelligence feed is successfully downloading and updating on the FMC. Where should the administrator navigate in the FMC GUI?

Accepted Answer

System > Updates > Security Intelligence. Security Intelligence feed status and updates can be monitored under System > Updates > Security Intelligence, or via the Health Monitor / Intelligence feeds dashboard. Specifically, System > Integration > Security Intelligence or Dashboards provide the status.

Answer

Analysis > Connections > Events

Answer

Devices > Device Management > Advanced

Answer

Policies > Access Control > Security Intelligence

Question 4

An engineer is troubleshooting a high availability (HA) configuration failure between two FTD devices managed by FMC. Which THREE prerequisites must be verified before pairing two FTD devices into an HA pair? (Choose three)

Accepted Answer

Both FTD devices must have identical interface configurations, counts, and security zone assignments.. FTD HA pairing requires identical hardware models or model families, identical interface configurations and naming, and identical software versions.

Answer

Both FTD devices must be configured with different management IP addresses on the same subnet.

Answer

Both FTD devices must have separate, independent Access Control Policies assigned.

Question 5

You are troubleshooting a packet drop issue. You initiate a capture on the FTD using the capture command. Which capture keyword must be used to ensure the capture includes the FTD's internal backplane traffic between interfaces?

Accepted Answer

capture trace. The 'trace' keyword in the FTD capture command allows the administrator to see the packet processing path through the inspection engine.

Answer

capture inspect

Answer

capture buffer

Answer

capture inline

Answer

capture detail

Question 6

Which file type is required for an FTD software upgrade via the FMC?

Accepted Answer

.sh or .tar file. FTD upgrades are performed using a .sh (shell script) or .tar file specifically packaged for the FTD platform.

Answer

.zip file

Answer

.bin file

Answer

.iso image

Answer

.pkg file

Question 7

An administrator successfully restores an FMC backup onto a freshly deployed FMC virtual appliance of the exact same software version. However, after the restore completes, all managed FTD devices show a status of 'Offline' or 'Config Apply Failed'. What is the most likely root cause and correct resolution?

Accepted Answer

The new FMC has a different system UUID and Internal Certificate Authority keys; the administrator must re-establish trust by re-registering the FTD devices using new registration keys.. When restoring an FMC backup to a new appliance, the Internal CA (Public/Private keys) changes unless it is a bare-metal restore using the exact same hardware UUID or proper registration re-establishment. Often, registration keys must be re-configured or mutual TLS certificates synchronized because the new FMC instance has a different registration identity.

Answer

The FTD management interface IP addresses must be manually changed to match the old FMC management subnet.

Answer

The administrator must run 'configure manager add' on the FMC CLI to force an SNMP trap listener.

Answer

The FTD devices automatically wipe their configurations when an FMC backup is restored; the administrator must factory reset every FTD.

Question 8

An administrator needs to troubleshoot a routing issue on an FTD device managed by FMC. Where in the FMC GUI should the administrator navigate to view and modify static and dynamic routing configurations for the device?

Accepted Answer

Devices > Device Management > Edit Device > Routing tab. Routing configurations for FTD are managed under Devices > Device Management, selecting the specific device, and clicking the Routing tab.

Answer

Objects > Object Management > Network > Routes

Answer

System > Configuration > Network Settings

Answer

Policies > Access Control > Routing

Question 9

An FTD device is dropping packets unexpectedly. An engineer runs a packet tracer via the FTD diagnostic CLI using 'system support diagnostic-cli' and enters the command: 'packet-tracer input inside tcp 192.168.1.50 12345 10.0.0.5 80'. The output shows a drop at the 'Access-Rule' phase with the action 'DROP'. What does this indicate?

Accepted Answer

An Access Control Policy rule matched the connection parameters and was configured with an action of Block or Block with reset.. A packet tracer drop at the Access-Rule phase with a drop action indicates that an Access Control Policy rule matched the traffic and explicitly dropped or rejected it.

Answer

The NAT translation table lacks a dynamic PAT port allocation for the source IP.

Answer

The FTD routing table does not have a valid route back to the source IP 192.168.1.50.

Answer

The SSL decryption policy failed to validate the server certificate for 10.0.0.5.

Question 10

An administrator notices that the Firepower Management Center (FMC) health monitor shows a critical warning regarding high disk utilization on the /var partition. Which built-in utility or action should the administrator perform first to safely free up disk space without disrupting critical database integrity?

Accepted Answer

Use the FMC GUI to delete unneeded packet captures and older correlation event logs or prune event data via System > Health > Monitor.. Clearing out rotated and old core dumps or troubleshooting via the system CLI using specialized scripts or purging old event data through the FMC GUI is standard. The df -h and du commands help locate space, but FMC provides specific maintenance tools to prune old events safely.

Answer

Reboot the FMC appliance into single-user mode and execute a complete filesystem format on the /var partition.

Answer

Navigate to System > Integration > Snort and delete all historical rule inspection data.

Answer

Run the 'rm -rf /var/sf/imagedb/*' command directly from the expert mode CLI to purge immediate image databases.

Question 11

During a routine backup of the FMC, the administrator wants to ensure that the generated backup file contains critical historical events, configurations, and intrusion event data so that it can be fully restored to a replacement appliance if necessary. Which backup type should be selected in the FMC?

Accepted Answer

Manual Backup with both System Settings and Historical Event Data checkboxes enabled. FMC provides 'Manual Backup' configurations where administrators can select components. To include configuration and event data, a manual backup profile must be created with both System Configuration and Event data selected.

Answer

RAID Controller Configuration Export

Answer

System Configuration Backup only

Answer

Snort Rule Update (SRU) Snapshot Backup

Question 12

An FTD device managed by FMC is experiencing high CPU utilization attributed to the Snort inspection engine. The administrator wants to identify which specific intrusion rules or access control rules are consuming the most resources. Which tool or report should the administrator use?

Accepted Answer

Access the FTD CLI and run 'system support diagnostic-cli' followed by 'show perfstats' or review the Intrusion Performance dashboard in FMC.. The Performance Statistics feature and Intrusion Event analysis in FMC help identify resource-heavy traffic and rules. Additionally, the 'Show Snort Statistics' or 'Perfstats' command via the FTD diagnostic CLI provides real-time rule processing metrics.

Answer

Run a packet capture on the management interface (eth0) with a BPF filter for CPU interrupts.

Answer

Navigate to Analysis > Datastores > Packet Trace and export the raw CPU register dump.

Answer

Check the Interfaces > Counters page in the Cisco Integrated Management Controller (CIMC).

Question 13

An engineer needs to troubleshoot an intermittent connectivity issue between a secured zone and the internet through a Firepower Threat Defense (FTD) managed by FMC. The engineer wants to capture traffic hitting a specific Access Control rule without overwhelming the system. Which packet capture configuration is most appropriate?

Accepted Answer

Create an advanced capture in the FMC under Devices > Device Management > Packet Capture, specifying the ingress interface, matching IP filters, and enabling the 'Promiscuous Mode' option.. To target specific traffic hitting a rule, the engineer should create an advanced capture on the FTD CLI or FMC utilizing filters that match the source/destination IPs and interfaces, or use the FMC capture feature tied to the specific interface and access control rule logging.

Answer

Configure a global capture on all interfaces using the 'capture global interface any' command without any access lists or filters.

Answer

Enable 'Debug All Packets' in the FTD expert mode shell via system support diagnostic-cli.

Answer

Modify the Snort detection engine configuration to write every inspected packet directly to a text file in /var/log/snort.

Question 14

An administrator is preparing to upgrade a high-availability (HA) pair of Firepower Threat Defense devices managed by an FMC. Before initiating the upgrade task via the FMC upgrade tool, which preliminary action is mandatory to ensure a seamless process and prevent split-brain conditions?

Accepted Answer

Run the software pre-upgrade checker package on the FTD units via the FMC System > Updates interface to identify blocking dependencies or insufficient disk space.. Before upgrading an HA pair, the administrator must verify that health monitors show green, check available disk space, and often it is recommended to ensure both units are synchronized, but specifically, running the pre-upgrade checker script via the FMC system update page is mandatory to flag blocking issues.

Answer

Manually break the High Availability pair, upgrade the Secondary unit first, and promote it to Primary before upgrading the old Primary unit.

Answer

Execute 'ha-manager failover-disable' from the expert CLI on both units to permanently disable heartbeat signaling.

Answer

Export the entire database, reinstall the operating system from a USB thumb drive on both devices, and restore the configuration.

Question 15

An administrator is troubleshooting a scenario where Snort inspection threads on an FTD are crashing intermittently, producing core dumps. To assist Cisco TAC in root cause analysis, what is the correct sequence of tools or CLI commands to collect the necessary diagnostic data?

Accepted Answer

Access the FTD CLI and execute the 'system support tech-support' command to generate a comprehensive diagnostic tarball containing core files and system logs.. Cisco provides a dedicated troubleshooting bundle generation tool on both FMC and FTD. On the FTD CLI, running 'system support diagnostic-cli' or generating a tech-support file via 'system support tech-support' collects core dumps, logs, and system metrics.

Answer

Log into the FMC GUI, go to System > Health > Diagnostics, and click 'Purge Cores'.

Answer

Run 'snort-engine restart --debug' in the expert mode shell and capture live stderr streams using tcpdump.

Answer

Export the running-config via TFTP and open the core dump files using a standard text editor.

Question 16

An engineer needs to analyze the connection history and security events from an FTD device that occurred three weeks ago. However, when querying the FMC event viewer, the events are missing. What is the most likely cause of this behavior?

Accepted Answer

The events were overwritten because the event database retention period or disk space limit was reached.. FMC event databases have configurable retention policies and disk space thresholds. If event retention settings are low or disk space fills up, older events are automatically purged to prevent disk exhaustion.

Answer

The administrator must run 'database-cli optimize' on the FTD CLI to unhide historical events.

Answer

The FTD automatically flushes its local event buffer every 48 hours regardless of FMC configuration.

Answer

Security events older than 7 days are automatically archived to the Cisco Cloud Analytics platform by default.

Question 17

An administrator wants to configure automated email notifications from the FMC whenever a critical health monitor alert occurs on any managed device. Where should this be configured in the FMC GUI?

Accepted Answer

System > Health > Monitor > Alert Responses. Alert responses, SNMP traps, and email notifications for health monitoring are configured under System > Health > Monitor > Alert Responses.

Answer

Objects > Object Management > Alerting

Answer

Policies > Access Control > Logging

Answer

Devices > Device Management > Alerts

Question 18

An administrator is troubleshooting an issue where an FMC cannot communicate with a managed FTD device. The health monitor shows registration is down. The administrator checks the FTD CLI and verifies the registration key and NAT ID. Which log file on the FTD should the administrator examine to troubleshoot registration and communication daemon errors (such as sftunnel)?

Accepted Answer

/var/log/cisco/sftunnel.log. The sftunnel daemon manages secure communication between FTD and FMC. Its logs are located in /var/log/cisco/sftunnel.log on the FTD filesystem.

Answer

/var/sf/nl/nl_manager.log

Answer

/var/log/messages

Answer

/opt/cisco/wsm/logs/startup.log

Question 19

An administrator needs to verify the license status and active feature subscriptions (such as URL Filtering, Malware, and IPS) on an FMC. Where should the administrator check this information in the FMC GUI?

Accepted Answer

System > Licenses > Smart Licenses. License management and feature activations on the FMC are located under System > Licenses > Smart Licenses.

Answer

Policies > Access Control > Subscriptions

Answer

Objects > Object Management > Licensing

Answer

Devices > Device Management > Licenses

Question 20

An engineer deploys an Access Control Policy change from the FMC to a managed FTD device. The task hangs in the Deployment History with a status of 'Applying' for an extended period. Upon checking the FTD CLI, the engineer notices a locked deployment file or stuck process. What action should be taken to clear or restart the deployment process safely?

Accepted Answer

Cancel the task in the FMC Task Manager (System > Task Monitor), verify deployment locks, and re-attempt the deployment after clearing pending changes.. If a deployment hangs, administrators can check deployment status, cancel or restart the deployment daemon (sfims) or use the task manager in FMC to cancel the task. On the FTD, checking the deployment status or restarting management services may be required.

Answer

Power cycle the physical FTD chassis immediately using the hardware power switch.

Answer

Delete the Access Control Policy and recreate it with a new name.

Answer

Run 'reload factory-default' from the FTD CLI to reset the management plane.