300-710 SNCF Management And Troubleshooting Practice Test 4 — 15 Questions

Question 1

An administrator needs to verify if an FTD is correctly receiving updates from the Cisco Support Cloud. Which menu path shows the status of rule updates and threat intelligence feeds?

Accepted Answer

System > Updates > Product Updates. In Cisco Firepower Management Center (FMC), the status of rule updates and threat intelligence feeds for managed FTD devices is found under System > Updates > Product Updates. This page displays the current versions of the Vulnerability Database (VDB), GeoDB, and other rule updates, and allows the administrator to verify if the FTD is receiving updates from the Cisco Support Cloud.

Answer

System > Configuration > Updates

Answer

Policies > Updates

Answer

Devices > Updates

Answer

Analysis > Updates

Question 2

Which file type is required for an FTD software upgrade via the FMC?

Accepted Answer

.sh or .tar file. FTD upgrades are performed using a .sh (shell script) or .tar file specifically packaged for the FTD platform.

Answer

.zip file

Answer

.bin file

Answer

.iso image

Answer

.pkg file

Question 3

Which THREE items are included in an FMC backup archive?

Accepted Answer

Device configuration policies. Option A (Device configuration policies) is correct because an FMC backup archive captures the policy configurations—access control, intrusion, and other policies—that FMC manages and deploys to its managed devices. Option B (Managed device health logs) is correct because the backup includes health and status monitoring data collected from managed devices, which is part of the FMC database. Option E (FMC system configuration settings) is correct because the backup preserves the FMC appliance's own system-level configuration, including settings needed to restore the management center. Option C (Historical connection event logs) is not included because connection/event data is stored separately and is not part of the standard FMC backup archive. Option D (Raw traffic payload data) is not included because FMC does not store raw packet payloads; that data resides on managed devices or external capture tools.

Answer

Historical connection event logs

Answer

Raw traffic payload data

Question 4

Which THREE commands are valid for gathering information about the FTD's current status and health from the CLI?

Accepted Answer

show interface ip brief. Option A (show interface ip brief) is correct because it is a valid FTD CLI command that displays the IP addresses, status, and protocol state of all interfaces, giving immediate insight into the device's interface-level health. Option C (show memory) is correct because it is a supported FTD CLI command that reports memory usage statistics, which is essential for assessing the device's current resource health. Option D (show cpu usage) is correct because it is a valid FTD CLI command that shows CPU utilization, a key indicator of the FTD's operational status and load. Option B (show network health) is not a valid FTD CLI command, as health monitoring is done through commands like show health or the FDM/FMC dashboards rather than 'show network health'. Option E (show snort traffic) is also not a valid FTD CLI command; Snort-related traffic statistics are viewed via other means such as the FMC or specific diagnostic commands, not this syntax.

Answer

show network health

Answer

show snort traffic

Question 5

When troubleshooting FTD policy deployment, which THREE of the following are common reasons for a deployment to fail?

Accepted Answer

Insufficient memory on the FTD. Option A is correct because FTD deployment requires sufficient RAM to compile and apply the unified policy; if the device is low on memory, the deployment process can fail or time out. Option C is correct because conflicting or invalid policy configurations (for example, overlapping NAT rules, unreachable objects, or incompatible access control entries) cause the FMC to reject or fail the deployment. Option E is correct because the FMC pushes policy over the management connection (typically TCP 8305 for the FMC-FTD communication channel); if that connectivity is lost, the deployment cannot be delivered and fails. Option B is not a standard FTD deployment failure cause, since third-party integration license keys are not part of the core policy deployment path. Option D is not relevant because the browser version on the client affects FMC GUI access, not the actual policy deployment to the FTD.

Answer

Invalid license keys for third-party integrations

Answer

Incorrect browser version on the client

Question 6

An administrator is troubleshooting why an FTD device managed by FMC is not applying the latest access control policy. The policy deployment status shows 'Out of Date'. The administrator wants to identify the exact configuration mismatch that is preventing deployment. Which FMC feature should be used to compare the running configuration on the FTD with the last deployed configuration in FMC?

Accepted Answer

Configuration Diff. Configuration Diff is the dedicated FMC tool for comparing the running configuration on an FTD with the last deployed configuration. It pinpoints discrepancies that cause the 'Out of Date' status, allowing the administrator to resolve them and successfully deploy the policy.

Answer

Audit Log

Answer

Health Monitor

Answer

Task Status

Question 7

An administrator is troubleshooting a problem where an FTD managed by FMC is not sending any events to the FMC. The administrator suspects that the connection between the FTD and FMC is down. Which FMC feature should be used to verify the status of the FTD-FMC communication channel?

Accepted Answer

FMC CLI command 'show managers'. The FTD CLI command 'show managers' provides detailed information about the management connection to FMC, including registration status and last communication time. This is the most direct way to verify if the FMC-FTD channel is operational. Other options like Health Monitoring or Device Management page give general status but not specific connectivity diagnostics.

Answer

Troubleshooting Tools

Answer

Device Management page

Answer

Health Monitoring

Question 8

An administrator is troubleshooting an FTD device that is not responding to pings on its management interface. The administrator suspects that the issue is with the management interface configuration. Which FMC feature should be used to verify the management interface settings?

Accepted Answer

Device Management page. The Device Management page in FMC provides access to the management interface configuration, including IP address, gateway, and other settings. This allows the administrator to verify if the management interface is correctly configured. Health Monitoring and Troubleshooting Tools do not show configuration details, and the CLI 'show interface' command only shows status, not configuration.

Answer

Troubleshooting Tools

Answer

FMC CLI command 'show interface'

Answer

Health Monitoring

Question 9

An administrator is troubleshooting an FTD device that is not forwarding traffic. The administrator suspects that the issue is related to the Snort inspection engine. Which TWO actions can be taken to troubleshoot and resolve the issue? (Choose two.)

Accepted Answer

Review the Snort performance statistics to identify any drops.. Checking the Snort rule update status ensures that rules are current and not causing false positives. Reviewing Snort performance statistics helps identify if the engine is dropping packets due to resource constraints. These two actions directly address potential Snort-related issues. Disabling all rules, restarting Snort, or checking general resource usage are less targeted and not the best first steps.

Answer

Check the FTD's CPU and memory usage to see if resources are exhausted.

Answer

Restart the Snort process on the FTD.

Answer

Disable all Snort rules to see if traffic passes.

Question 10

An administrator is troubleshooting a performance issue on an FTD device managed by FMC. The administrator suspects that the issue is related to the Snort inspection engine and wants to gather detailed performance statistics. Which TWO actions can be taken to collect Snort performance data on the FTD? (Choose two.)

Accepted Answer

Run the 'show snort statistics' command from the FTD CLI.. The two correct methods for collecting Snort performance data are using the FMC Health Monitor and running the 'show snort statistics' command on the FTD CLI. The Health Monitor provides a centralized, graphical view of Snort performance metrics, while the CLI command offers real-time detailed counters. These two approaches complement each other and are the standard ways to gather such data.

Answer

Enable Snort debugging with 'system support firewall-engine-debug' to log performance data.

Answer

Run the 'system support snort-performance' command from the FTD CLI.

Answer

Configure an FMC correlation policy to trigger on Snort CPU thresholds.

Question 11

An administrator needs to troubleshoot a routing issue on an FTD device managed by FMC. Where in the FMC GUI should the administrator navigate to view and modify static and dynamic routing configurations for the device?

Accepted Answer

Devices > Device Management > Edit Device > Routing tab. To view and modify static and dynamic routing configurations for an FTD device in FMC, the administrator navigates to Devices > Device Management, edits the device, and selects the Routing tab. This tab provides access to static routes, dynamic routing protocols (OSPF, BGP, EIGRP), and related routing settings for that specific device.

Answer

Objects > Object Management > Network > Routes

Answer

System > Configuration > Network Settings

Answer

Policies > Access Control > Routing

Question 12

An FTD device is dropping packets unexpectedly. An engineer runs a packet tracer via the FTD diagnostic CLI using 'system support diagnostic-cli' and enters the command: 'packet-tracer input inside tcp 192.168.1.50 12345 10.0.0.5 80'. The output shows a drop at the 'Access-Rule' phase with the action 'DROP'. What does this indicate?

Accepted Answer

An Access Control Policy rule matched the connection parameters and was configured with an action of Block or Block with reset.. In FTD packet-tracer output, the 'Access-Rule' phase evaluates the connection against the Access Control Policy. A DROP action at this phase means an ACP rule matched the 5-tuple and was configured with Block or Block with Reset, so the packet is denied before further inspection. This is the definitive indicator that policy, not routing or NAT, caused the drop.

Answer

The NAT translation table lacks a dynamic PAT port allocation for the source IP.

Answer

The FTD routing table does not have a valid route back to the source IP 192.168.1.50.

Answer

The SSL decryption policy failed to validate the server certificate for 10.0.0.5.

Question 13

During a routine backup of the FMC, the administrator wants to ensure that the generated backup file contains critical historical events, configurations, and intrusion event data so that it can be fully restored to a replacement appliance if necessary. Which backup type should be selected in the FMC?

Accepted Answer

Manual Backup with both System Settings and Historical Event Data checkboxes enabled. In FMC, a Manual Backup allows you to select both 'System Settings' and 'Historical Event Data' checkboxes. Enabling both ensures that the backup includes configurations, intrusion events, and other historical data, which is necessary for a full restore to a replacement appliance. This is the only backup type that captures both system configuration and event data.

Answer

RAID Controller Configuration Export

Answer

System Configuration Backup only

Answer

Snort Rule Update (SRU) Snapshot Backup

Question 14

An engineer needs to analyze the connection history and security events from an FTD device that occurred three weeks ago. However, when querying the FMC event viewer, the events are missing. What is the most likely cause of this behavior?

Accepted Answer

The events were overwritten because the event database retention period or disk space limit was reached.. FMC event databases have configurable retention policies and disk space thresholds. If event retention settings are low or disk space fills up, older events are automatically purged to prevent disk exhaustion.

Answer

The administrator must run 'database-cli optimize' on the FTD CLI to unhide historical events.

Answer

The FTD automatically flushes its local event buffer every 48 hours regardless of FMC configuration.

Answer

Security events older than 7 days are automatically archived to the Cisco Cloud Analytics platform by default.

Question 15

An administrator wants to configure automated email notifications from the FMC whenever a critical health monitor alert occurs on any managed device. Where should this be configured in the FMC GUI?

Accepted Answer

System > Health > Monitor > Alert Responses. FMC health alert email notifications are configured under System > Health > Monitor > Alert Responses. There you define alert response objects that specify the email recipients and the health events (critical/warning) that trigger them, then apply them to health policies. This is the only location in the FMC GUI that natively sends email on health monitor alerts.

Answer

Objects > Object Management > Alerting

Answer

Policies > Access Control > Logging

Answer

Devices > Device Management > Alerts