300-710 SNCF Management And Troubleshooting Practice Test 2 — 15 Questions

Question 1

An administrator wants to ensure that packet captures taken on an FTD can be analyzed easily. Which TWO ways can packet capture files (.pcap) be retrieved from the FMC? (Choose two)

Accepted Answer

Download the .pcap file directly through the FMC GUI under Device Management > Packet Capture.. Option B is correct because the FMC GUI provides a Packet Capture page under Device Management where an administrator can select a capture on a managed FTD and download the resulting .pcap file directly to the workstation for offline analysis in tools such as Wireshark. Option E is correct because the same FMC packet capture workflow lets the administrator view captured packets in real time and inspect summary statistics (protocol, source/destination, counts) directly in the web interface, which supports quick analysis without downloading the file. Options A, C, and D are incorrect: SNMP traps are for event/alert notification and cannot stream binary pcap files to an NMS; FMC does not email raw captures to Cisco Smart Licensing servers, which are only used for license entitlement and reporting; and there is no feature that prints pcap hex output line-by-line to the serial console port.

Answer

Stream pcap files via SNMP traps to an NMS.

Answer

Email the raw binary capture automatically to Cisco Smart Licensing servers.

Answer

Automatically print the .pcap hex output to the connected serial console port line-by-line.

Question 2

An administrator is troubleshooting a policy deployment failure between an FMC and an FTD. Which THREE log files on the FTD contain relevant information regarding policy application and deployment tasks? (Choose three)

Accepted Answer

Configuration application logs (such as /var/sf/log/cc-daemon.log or related config logs). Option C is correct because configuration application logs such as /var/sf/log/cc-daemon.log record the FTD's processing of configuration and policy pushes from the FMC, making them directly relevant to policy application failures. Option D is correct because /var/log/cisco/deploy.log specifically captures deployment task activity on the FTD, including the results of policy deployment attempts initiated by the FMC. Option E is correct because /var/log/cisco/sftunnel.log records the status of the sftunnel connection between the FTD and FMC, and a broken or flapping tunnel is a common cause of policy deployment failures. Option A does not belong because /var/log/auth.log tracks authentication and authorization events such as logins and sudo usage, not policy deployment tasks. Option B does not belong because /var/log/kern.log contains kernel-level messages (drivers, interfaces, hardware events) rather than FMC policy application or deployment information.

Answer

/var/log/auth.log

Answer

/var/log/kern.log

Question 3

An administrator wants to view system status and resource metrics directly on an FTD CLI without logging into the FMC. Which TWO commands are commonly used in the FTD diagnostic CLI or expert shell for this purpose? (Choose two)

Accepted Answer

top (in expert mode). Option A, 'top (in expert mode)', is correct because the FTD expert shell is a Linux bash environment, and the standard Linux 'top' utility displays live process-level CPU and memory usage, which is exactly the kind of system status and resource metric an administrator needs without going through FMC. Option B, 'show resource usage', is correct because it is a native FTD CLI command that reports system resource statistics such as CPU, memory, and disk utilization directly from the FTD diagnostic CLI. Option C, 'show hardware firewall-stats', is not a valid FTD command for viewing general system resource metrics, and option D, 'display cpu-memory', is not an FTD CLI command (it resembles syntax from other platforms). Option E, 'print system-health', is also not a valid FTD command; system health output is typically generated through FMC or the 'show' command family, not 'print'.

Answer

show hardware firewall-stats

Answer

display cpu-memory

Answer

print system-health

Question 4

An administrator is troubleshooting a policy deployment failure from the Firepower Management Center (FMC) to a managed Firepower Threat Defense (FTD) device. The deployment hangs at 33 percent with an error related to snort synchronization. Which tool should the administrator use on the FTD CLI to examine the real-time Snort rule compilation and policy application process?

Accepted Answer

Expert mode and check /var/log/pm/pm.log and Snort startup logs. When a deployment hangs at 33 percent with a Snort synchronization error, the administrator should use Expert mode on the FTD CLI and examine /var/log/pm/pm.log and Snort startup logs. These logs provide real-time details of the policy deployment and Snort rule compilation process, which is where the failure occurs.

Answer

System Support Diagnostic (system support diagnostic)

Answer

show deploy-status

Answer

system support firewall-engine-debug

Question 5

An engineer is troubleshooting high CPU usage on an FTD device managed by FMC. The engineer needs to capture packets containing specific HTTP traffic while bypassing the Snort inspection engine to isolate whether the high CPU is caused by Snort processing. Which action accomplishes this on the FTD CLI?

Accepted Answer

Configure a capture using the capture command with the 'no-snort' keyword.. When capturing packets on FTD CLI using the capture command, the 'no-snort' keyword allows capturing traffic that bypasses the Snort inspection engine, which is ideal for isolating performance issues.

Answer

Use the FMC Advanced Troubleshooting menu to disable Snort inspection globally during the capture.

Answer

Run a packet capture from the FMC platform settings and uncheck 'Inspection Engine Processing'.

Answer

Create an ACP rule with an IPS policy set to 'Disable' and run a packet trace.

Question 6

An FMC administrator needs to back up configuration data and event data for disaster recovery. Which backup type includes both system configurations and historical event data stored in the database?

Accepted Answer

Manual Backup with Event Data option selected. In FMC, a Manual Backup with the 'Event Data' option selected includes both system configurations and historical event data stored in the database. This type of backup is used for disaster recovery, as it captures the full state of the FMC, including configuration and event data.

Answer

Health Monitor Export

Answer

Datastore Archive

Answer

System Backup

Question 7

,An administrator needs to verify whether a specific security intelligence feed is successfully downloading and updating on the FMC. Where should the administrator navigate in the FMC GUI?

Accepted Answer

System > Updates > Security Intelligence. Security Intelligence feed status and updates can be monitored under System > Updates > Security Intelligence, or via the Health Monitor / Intelligence feeds dashboard. Specifically, System > Integration > Security Intelligence or Dashboards provide the status.

Answer

Analysis > Connections > Events

Answer

Devices > Device Management > Advanced

Answer

Policies > Access Control > Security Intelligence

Question 8

During an upgrade of an FTD device managed by FMC, the pre-checks fail because of insufficient disk space in the target upgrade partition. Which CLI command sequence should the administrator use to safely clean up previous upgrade installation files and temporary packages?

Accepted Answer

system support installer cleanup. The supported FTD CLI command to clean up previous upgrade installation files and temporary packages is 'system support installer cleanup'. This safely removes stale upgrade artifacts from the upgrade partition so pre-checks for disk space can pass.

Answer

system support upgrade-purge

Answer

expert mode followed by apt-get clean

Answer

rm -rf /var/sf/upgrade/*

Question 9

An administrator notices that health monitors on the FMC show a critical warning for high disk utilization on the /var partition of an FTD device. What is the safest and most standard method to resolve disk space exhaustion caused by accumulated core files and rotated logs on FTD?

Accepted Answer

Use the FTD CLI command 'system support clean-core' and delete old rotated log files.. The safest method to resolve disk space exhaustion on FTD due to core files and rotated logs is to use the 'system support clean-core' command to remove core files and manually delete old rotated log files. This avoids deleting critical system files.

Answer

Delete files directly in the /mnt/disk0/ directory using rm -rf without checking dependencies.

Answer

Re-image the FTD device using a bootable USB drive.

Answer

Run 'system support reset-all' from the FTD CLI.

Question 10

An engineer suspects that asymmetric routing is causing packets to be dropped by the FTD firewall. Which command should the engineer run on the FTD CLI to check for dropped packets and view drop reasons in real time?

Accepted Answer

system support firewall-engine-debug with tracing enabled. The command 'system support firewall-engine-debug' with tracing enabled provides real-time debugging of packets dropped by the firewall engine, including drop reasons such as asymmetric routing, and is the correct tool to diagnose such issues on FTD.

Answer

show snort statistics drops

Answer

debug crypto ipsec

Answer

show interface counters drops

Question 11

An administrator is preparing to upgrade an FMC and its managed FTD devices from version 6.6.x to 7.2.x. What is the mandatory prerequisite regarding upgrade paths and compatibility checks?

Accepted Answer

Run the FMC Upgrade Readiness Tool (URT) to check for configuration and database incompatibilities.. The mandatory prerequisite for upgrading from 6.6.x to 7.2.x is to run the FMC Upgrade Readiness Tool (URT) to check for configuration and database incompatibilities. This tool identifies potential issues that could block the upgrade.

Answer

Upgrade all FTD devices to 7.2.x before upgrading the FMC.

Answer

Export the security policy, wipe the FMC, and re-import the policy on version 7.2.

Answer

Delete all historical event data to ensure the database fits within the 7.2 schema limits.

Question 12

An administrator notices that health alerts from managed FTD devices are not appearing in the FMC health monitor, although traffic logs are updating normally. Which service or daemon on the FMC is primarily responsible for collecting and processing health and performance metrics from managed devices?

Accepted Answer

healthd. The 'healthd' daemon on the FMC is responsible for collecting and processing health and performance metrics from managed FTD devices. It aggregates health alerts and status information, which are then displayed in the FMC health monitor.

Answer

mgmtd

Answer

snort

Answer

dbus

Question 13

An administrator needs to restore an FMC configuration from a previously saved backup file. Where in the FMC GUI is the Backup/Restore utility located?

Accepted Answer

System > Tools > Backup/Restore. The FMC Backup/Restore utility is located under System > Tools > Backup/Restore in the FMC GUI, where administrators can create, schedule, and restore configuration backups. This is the authoritative location for FMC-level backup operations.

Answer

Devices > Device Management > Maintenance > Backup

Answer

Administration > Configuration > Backup

Answer

Policies > Integration > Backup and Recovery

Question 14

An engineer is troubleshooting a packet capture configuration on an FTD device managed by FMC. Which THREE statements regarding FTD packet capture behavior and limitations are correct? (Choose three)

Accepted Answer

Packet captures on FTD capture decrypted payload content for IPsec traffic terminated on the firewall if specified with crypto options.. Option C is correct because FTD packet capture supports crypto options that allow the trace to include decrypted payload for IPsec traffic terminated on the firewall, which is essential for inspecting tunneled traffic after decryption. Option D is correct because FTD packet capture can be configured with multiple interfaces in a single capture, enabling simultaneous capture across interfaces such as inside and outside for end-to-end analysis. Option E is correct because FTD packet captures use a circular buffer with a maximum size limit; once the buffer is full, the oldest packets are overwritten unless the capture is exported to an external file. Option A is incorrect because captures are written to the FTD's volatile memory buffer or exported to an external server, not stored as 10 GB in NVRAM. Option B is incorrect because packet capture operates at the data plane and does not require a matching Access Control Rule permit to capture packets, though the traffic may still be dropped by policy.

Answer

Packet captures can record up to 10 gigabytes of data directly into NVRAM.

Answer

Packet captures require a mandatory Access Control Rule permit entry for the captured traffic to be processed.

Question 15

An administrator is preparing to perform a system backup on the FMC. Which TWO data categories can be optionally included or excluded when generating the backup? (Choose two)

Accepted Answer

Cisco Smart Licensing registration tokens and certificates. When generating a backup on the Cisco Firepower Management Center (FMC), the administrator can selectively include or exclude certain data categories. Option B is correct because Cisco Smart Licensing registration tokens and certificates are an optional category that can be included or excluded during backup creation, allowing the administrator to avoid re-registering the FMC after a restore if desired. Option D is correct because historical event data (connection, intrusion, and malware events) is also an optional category that can be excluded to significantly reduce backup size and duration, since event data is often voluminous and may not be needed for disaster recovery. Option A is incorrect because the underlying Linux kernel source code is not a user-selectable backup category on the FMC. Option C is incorrect because hardware BIOS firmware images are not part of FMC backup options. Option E is incorrect because raw packet capture (.pcap) files stored in temporary directories are not a configurable backup data category on the FMC.

Answer

The underlying Linux kernel source code

Answer

Hardware BIOS firmware images

Answer

Raw packet capture (.pcap) files stored in temporary directories