300-710 SNCF Management And Troubleshooting Practice Test 5 — 15 Questions

Question 1

An administrator needs to verify the license status and active feature subscriptions (such as URL Filtering, Malware, and IPS) on an FMC. Where should the administrator check this information in the FMC GUI?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

System > Licenses > Smart Licenses. In FMC, license status and active feature subscriptions are found under System > Licenses > Smart Licenses. This page displays the Smart Licensing status, including which features (URL Filtering, Malware, IPS, etc.) are enabled and their compliance.

Answer

Policies > Access Control > Subscriptions

Answer

Objects > Object Management > Licensing

Answer

Devices > Device Management > Licenses

Question 2

An engineer deploys an Access Control Policy change from the FMC to a managed FTD device. The task hangs in the Deployment History with a status of 'Applying' for an extended period. Upon checking the FTD CLI, the engineer notices a locked deployment file or stuck process. What action should be taken to clear or restart the deployment process safely?

Accepted Answer

Cancel the task in the FMC Task Manager (System > Task Monitor), verify deployment locks, and re-attempt the deployment after clearing pending changes.. When a deployment task hangs in 'Applying' state with a locked deployment file or stuck process on the FTD, the safe remediation is to cancel the task from the FMC Task Monitor (System > Task Monitor), verify no deployment locks remain, and then re-attempt the deployment after clearing pending changes. This avoids disrupting traffic or corrupting the configuration database. The FMC-to-FTD deployment is transactional; cancelling cleanly releases the lock so a fresh deployment can proceed.

Answer

Power cycle the physical FTD chassis immediately using the hardware power switch.

Answer

Delete the Access Control Policy and recreate it with a new name.

Answer

Run 'reload factory-default' from the FTD CLI to reset the management plane.

Question 3

An administrator is troubleshooting asymmetric routing issues across an FTD firewall using the FMC connection events and FTD CLI. The administrator wants to disable TCP state bypass or adjust TCP normalization settings to allow non-synchronized SYN packets through for a specific application. Where are TCP normalization and stateful inspection parameters configured for FTD?

Accepted Answer

Devices > Platform Settings > Edit Policy > Stateful Inspection / TCP Settings. TCP normalization and stateful inspection parameters for FTD are configured under Devices > Platform Settings > Edit Policy > Stateful Inspection / TCP Settings. This is where you adjust TCP state bypass, normalization, and related settings that affect how the FTD handles asymmetric flows and non-synchronized SYN packets.

Answer

Policies > Access Control > Advanced > Network Settings

Answer

Objects > Object Management > Advanced > TCP State

Answer

System > Configuration > Global Parameters > TCP

Question 4

An engineer has modified several access control rules and object groups on the FMC. Before deploying these changes to the FTD, the engineer wants to review all pending changes to ensure no unauthorized modifications are included. Where in the FMC GUI should the engineer go to view pending deployment changes?

Accepted Answer

Deploy > Deployment (or clicking the Deploy icon in the top header). To view pending deployment changes, the engineer should go to Deploy > Deployment (or click the Deploy icon in the top header). This shows a list of all pending changes across policies and objects, allowing review before deployment.

Answer

Objects > Object Management > Diff Viewer

Answer

Analysis > Audit > Pending

Answer

System > Updates > Pending Changes

Question 5

An administrator wants to check the status of all software processes running on an FMC appliance (such as the web server, database, and event handlers) to ensure everything is running smoothly. Which command should be run in the FMC CLI?

Accepted Answer

pmtool status. The 'pmtool status' command in the FMC CLI displays the status of all software processes managed by the Process Manager, including the web server, database, and event handlers. It is the correct command to verify that all FMC services are running properly.

Answer

firepower-status -v

Answer

systemctl status all

Answer

show process manager

Question 6

An administrator needs to schedule automated weekly backups of the FMC configuration and store them securely on a remote SCP server. Where is remote backup storage configured in the FMC GUI?

Accepted Answer

System > Tools > Backup / Restore > Remote Storage. Remote backup storage for FMC is configured under System > Tools > Backup / Restore > Remote Storage. This is where you specify the SCP server details for storing backups remotely.

Answer

Devices > Device Management > Backup

Answer

System > Integration > SCP Servers

Answer

Objects > Object Management > Servers > Backup

Question 7

An FTD device managed by FMC is failing to download latest Snort Rule Updates (SRUs) and GeoDB updates automatically. The FMC has internet access via an HTTPS proxy. Where must the HTTPS proxy settings be configured on the FMC so that it can successfully reach Cisco update servers?

Accepted Answer

System > Configuration > Proxy. For the FMC to download SRUs and GeoDB updates through an HTTPS proxy, the proxy settings must be configured under System > Configuration > Proxy. This is the global proxy configuration that the FMC uses for all outbound internet communications, including update downloads.

Answer

Objects > Object Management > Network Proxy

Answer

Devices > Device Management > Advanced > Proxy

Answer

Policies > Access Control > Updates > Proxy

Question 8

An administrator is performing health monitoring on an FMC appliance. Which TWO health monitors are available out-of-the-box in the FMC Health Monitor dashboard to track system resource utilization? (Choose two)

Accepted Answer

CPU Utilization. The FMC Health Monitor dashboard ships with a set of default, out-of-the-box monitors that focus on appliance-level system resources, and CPU Utilization (A) is one of them, tracking processor load on the FMC so administrators can detect performance degradation. Disk Utilization (B) is also a built-in monitor, reporting how full the FMC's disk partitions are, which is critical because a full disk can halt logging, event storage, and database operations. Both A and B are standard system-resource monitors present by default without any additional configuration. The other options do not belong: SSL Handshake Latency (C) is not a default FMC health monitor, SNMP Trap Queue Depth (D) is not an out-of-the-box FMC system-resource monitor, and BGP Peer Flap Counter (E) relates to routing protocol state rather than FMC appliance resource utilization.

Answer

SSL Handshake Latency

Answer

SNMP Trap Queue Depth

Answer

BGP Peer Flap Counter

Question 9

An administrator is preparing an upgrade plan for an FMC and its managed FTD devices. Which THREE best practices should be followed during the upgrade process to minimize downtime and avoid failure? (Choose three)

Accepted Answer

Take a complete backup of the FMC and export device configurations prior to starting the upgrade.. Option A is correct because taking a full FMC backup and exporting FTD configurations before any upgrade provides a rollback point if the upgrade fails or corrupts data, which is essential for minimizing downtime. Option B is correct because Cisco's upgrade best practice requires the FMC to be upgraded to the target version first, since a newer FMC can manage older FTD versions but an older FMC cannot manage newer FTD devices, avoiding management incompatibility. Option C is correct because running the pre-upgrade checker (e.g., via the FTD CLI or the FMC upgrade readiness check) identifies blockers such as unsupported configurations, insufficient disk space, or deprecated features before the upgrade begins. Option D is incorrect because factory resetting FTD devices after pushing an upgrade would erase the configuration and cause an outage, not minimize downtime. Option E is incorrect because the sftunnel is the management tunnel between FMC and FTD; disabling it permanently would break management and prevent the FMC from pushing the upgrade or policies, and it is not a valid upgrade practice.

Answer

Factory reset all FTD devices immediately after pushing the upgrade package.

Answer

Disable the sftunnel service permanently during the upgrade to prevent packet inspection.

Question 10

An administrator is investigating an issue where connection events are failing to reach the FMC from a managed FTD. Which THREE daemons or logs on the FTD and FMC should be checked to troubleshoot event transport and communication issues? (Choose three)

Accepted Answer

FTD event streaming and SFIMS logs. Option A is correct because the FTD's event streaming process and SFIMS (the Firepower Management Center communication agent) are responsible for generating and forwarding connection events to the FMC, so their logs directly reveal whether events are being produced and transmitted. Option C is correct because /var/log/cisco/sftunnel.log records the status of the sftunnel (Secure Firewall Tunnel) connection between the FTD and FMC; if this tunnel is down or flapping, event transport will fail. Option E is correct because on the FMC, the event collection and correlator components receive and process events, and their logs (for example /var/log/messages or application logs under /var/sf/log) show whether events arrive and are ingested. Option B is not relevant because /var/log/dhcpd.log pertains to DHCP daemon activity, which has nothing to do with FTD-to-FMC event transport. Option D is not relevant because /var/log/samba/smb.log relates to SMB/CIFS file-sharing services, which are unrelated to Firepower event communication.

Answer

/var/log/dhcpd.log

Answer

/var/log/samba/smb.log

Question 11

An administrator is setting up health monitoring alerts on the FMC. Which TWO notification methods can be configured when a health alert is triggered? (Choose two)

Accepted Answer

Email notification. On the Cisco Firepower Management Center (FMC), health monitoring alerts can be delivered through the built-in notification mechanisms, and the two supported methods are Email notification (B) and SNMP Trap (C). Email notification (B) is correct because FMC's health monitor configuration allows you to specify recipient email addresses and an SMTP server so that alert messages are sent when a health event occurs. SNMP Trap (C) is correct because FMC can be configured with SNMP trap receivers, allowing health alerts to be forwarded as SNMP traps to a monitoring station. The remaining options are not valid FMC health alert delivery methods: FMC has no built-in cellular SIM for SMS (A), no Bluetooth broadcast capability for alerts (D), and no SIP trunking integration to place automated phone calls (E).

Answer

Automated SMS text message directly via built-in cellular SIM

Answer

Direct Bluetooth broadcast

Answer

Automated phone call via SIP trunking

Question 12

An engineer needs to troubleshoot high CPU usage on an FTD device caused by Snort. Which THREE actions or features can be adjusted or implemented to mitigate Snort CPU load? (Choose three)

Accepted Answer

Configure SSL Decryption policies to bypass trusted internal traffic or known safe applications.. Option B is correct because SSL Decryption is one of the most CPU-intensive operations Snort performs; bypassing trusted internal traffic or known safe applications in the SSL policy prevents Snort from decrypting and inspecting that traffic, directly reducing CPU load. Option D is correct because the Intrusion Policy determines which Snort rules are evaluated, and disabling rules not applicable to the network environment reduces the number of signatures Snort must process per packet, lowering CPU utilization. Option E is correct because Access Control rules are evaluated top-down, and placing frequently matched allow rules higher with fewer inspection requirements (e.g., no intrusion or file inspection) lets traffic be allowed early with minimal Snort processing, reducing overall CPU demand. Option A is incorrect because converting physical interfaces to switchports without IP addresses is a Layer 2 deployment consideration and does not by itself reduce Snort CPU load. Option C is incorrect because disabling the FTD kernel and running Snort in standalone user-space loopback mode is not a supported or valid FTD configuration and would not mitigate CPU usage.

Answer

Convert all physical interfaces into switchports without IP addresses.

Answer

Disable the FTD kernel entirely and run Snort in standalone user-space loopback mode.

Question 13

An administrator is performing a backup and restore operation on an FMC appliance. Which THREE statements are correct regarding the FMC restore process? (Choose three)

Accepted Answer

Restoring a backup overwrites the existing configuration and database on the target FMC.. Option B is correct because the FMC restore process is destructive: it replaces the existing configuration and database on the target appliance with the contents of the backup, so any current settings are overwritten. Option D is correct because the backup includes the FMC's internal CA and certificate material; when restored to a different appliance, the CA keys and identity differ from what managed FTD devices originally trusted, so the devices may need to be re-registered or have trust re-established. Option E is correct because FMC backups are version-specific and can only be restored onto an FMC running the exact same software version as the one that generated the backup. Option A is incorrect because restoring across major version differences (e.g., v6.2 backup onto v7.4) is not supported; you must first restore to the matching version and then upgrade. Option C is incorrect because an FMC backup captures the FMC configuration and database, not the local flash images on managed FTD devices, so those images are not restored by an FMC restore.

Answer

Backups can be restored across major software version differences (e.g., restoring a v6.2 backup directly onto v7.4).

Answer

Restoring an FMC backup automatically restores all connected FTD local flash images.

Question 14

An administrator is troubleshooting an issue where Snort inspection engine crashes repeatedly on an FTD device. Which THREE diagnostic artifacts or steps should the administrator collect and perform to assist Cisco TAC in resolving the core dump issue? (Choose three)

Accepted Answer

Collect the generated core dump files located in the core directory (such as /var/common/ or /var/sf/cores/).. Option A is correct because when the Snort inspection engine crashes on an FTD, the resulting core dump files are written to directories such as /var/common/ or /var/sf/cores/, and these binaries are essential for TAC to perform root-cause analysis of the crash. Option C is correct because recording the exact timestamp of the crash along with any preceding intrusion events or traffic patterns helps TAC correlate the core dump with the triggering conditions and reproduce the fault. Option D is correct because generating a full 'system support tech-support' bundle from the FTD CLI captures the complete device state, configuration, logs, and diagnostics that Cisco TAC requires alongside the core files. Option B is incorrect because deleting log files in /var/log destroys forensic evidence and does not address the core dump issue. Option E is incorrect because formatting the flash partition containing the Snort binaries would remove critical software and is a destructive action that would not help diagnose the crash.

Answer

Delete all log files in /var/log to clear disk space before opening a TAC case.

Answer

Format the flash memory partition containing the Snort binaries.

Question 15

An administrator is troubleshooting a high availability (HA) failover link failure between two FTD physical appliances. Which THREE checks should be performed to diagnose physical and logical connectivity between the failover interfaces? (Choose three)

Accepted Answer

Verify physical link lights (LEDs) and cable integrity on the dedicated failover interfaces.. Option A is correct because verifying physical link lights (LEDs) and cable integrity on the dedicated failover interfaces is the first step to confirm Layer 1 connectivity, since a failed or unplugged cable or dead interface will prevent any failover communication. Option B is correct because the 'show failover' command on the FTD diagnostic CLI reports mate status, failover link state, and interface monitoring states, directly revealing whether the failover link is up or down and whether the peer is reachable. Option C is correct because if Layer 3 failover is used, the dedicated failover interfaces must have valid IP addresses in the same subnet and be ping-reachable; checking IP configuration and ping reachability validates logical connectivity across that subnet. Option D is not relevant because changing the management IP address does not diagnose or repair the dedicated failover link and could disrupt management access. Option E is not relevant because rebooting the FMC does not restart failover polling between FTD appliances; failover is handled by the FTD data plane, not the management center.

Answer

Change the FTD management IP address on both units.

Answer

Reboot the FMC to restart failover polling.