300-710 SNCF Management And Troubleshooting Practice Test 6 — 15 Questions

Question 1

An administrator is planning an upgrade of an FMC managing multiple FTD devices across various software versions. Which THREE factors must be validated according to Cisco compatibility guidelines before proceeding? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Supported upgrade paths (e.g., whether a direct jump from v6.4 to v7.4 is supported or requires an intermediate upgrade).. Option A is correct because Cisco upgrade planning requires verifying supported upgrade paths; for example, a direct jump from v6.4 to v7.4 may not be supported and may require an intermediate release such as v7.0 or v7.2 before reaching v7.4. Option B is correct because the upgrade process must have sufficient free space on FMC and FTD partitions, including /var and /root, so that downloaded packages and temporary files can be unpacked and staged without filling the filesystem. Option E is correct because the Cisco Firepower Compatibility Guide must be consulted to confirm that the target FMC software version interoperates with and supports the FTD versions currently managed by that FMC. Option C is not required because NTP stratum 1 is not a Cisco Firepower upgrade prerequisite; time synchronization matters, but the local NTP server does not have to be stratum 1. Option D is not required because the serial numbers of external power supplies are irrelevant to software compatibility and upgrade validation.

Answer

The local NTP server stratum level must be exactly stratum 1.

Answer

The serial number of the external power supplies attached to the rack mount chassis.

Question 2

An FMC high availability (HA) pair has split-brain symptoms due to a management network failure. After restoring network connectivity, the standby unit remains in a 'Failed' state and does not automatically re-synchronize. What is the correct procedure to recover the HA sync?

Accepted Answer

Go to System > Integration > HA, break the HA pairing, and re-establish it using the active unit as the primary.. When an FMC HA pair experiences split-brain and the standby unit remains in a 'Failed' state after network restoration, the correct recovery is to break the HA pairing and re-establish it using the active unit as the primary. This forces a clean re-synchronization and resolves the failed state.

Answer

Run 'system support fmc-ha-sync' from the standby FMC CLI.

Answer

Reboot both FMC units simultaneously.

Answer

From the primary FMC CLI, run 'configure ha restore-sync'.

Question 3

An administrator wants to generate a health report on the FMC to present hardware utilization trends over the past 30 days. Which section of the FMC GUI provides pre-built health reports and metric tracking?

Accepted Answer

Analysis > Health > Monitor. The FMC's Analysis > Health > Monitor section provides pre-built health dashboards and metric tracking for managed devices, including CPU, memory, disk, and interface statistics over configurable time ranges such as the past 30 days. This is where administrators generate health reports and view historical utilization trends.

Answer

Policies > Actions > Health Reporting

Answer

Devices > Device Management > Health Status

Answer

System > Monitoring > Syslog

Question 4

An engineer needs to troubleshoot intermittent packet loss between an FTD inside interface and a destination server. The engineer runs the 'packet-tracer' command on the FTD CLI. What limitation must the engineer keep in mind regarding packet-tracer?

Accepted Answer

Packet-tracer simulates packet processing through the firewall and Snort engine without transmitting physical packets.. The FTD CLI 'packet-tracer' command simulates a packet's processing through the firewall's policy and Snort inspection engine without actually transmitting physical packets on the wire. This makes it a safe diagnostic for policy path verification but not a true end-to-end connectivity or latency test.

Answer

Packet-tracer actually transmits physical packets out of the egress interface to test real network latency.

Answer

Packet-tracer bypasses the Snort inspection engine entirely.

Answer

Packet-tracer only works for encrypted IPsec VPN traffic.

Question 5

An FTD high availability pair experiences a failover due to a hardware failure on the active unit. After the standby unit takes over, the administrator notices that existing TCP connections were dropped and did not state-fully fail over. What configuration setting should the administrator verify?

Accepted Answer

Verify that stateful failover is enabled and the failover link interface is operational and passing state packets.. Stateful failover in an FTD HA pair requires that the failover link be up and actively passing state synchronization packets between the active and standby units. If the failover link is down or stateful failover is not enabled, the standby unit takes over the interfaces but has no session table, so existing TCP connections are dropped and must be re-established.

Answer

Ensure that dynamic routing protocols are configured with graceful restart.

Answer

Verify that clustering is enabled instead of high availability.

Answer

Check that adaptive inspection is disabled in the Access Control Policy.

Question 6

An engineer is troubleshooting a newly deployed FTD device where syslog messages are not reaching the external syslog server. Which tool on the FTD CLI can the engineer use to verify if the syslog generation and transmission process is attempting to send packets out the management or data interface?

Accepted Answer

Capture traffic on the designated egress interface matching the syslog server IP and UDP port 514.. To verify if syslog packets are being sent out the correct interface, the engineer should capture traffic on the designated egress interface matching the syslog server IP and UDP port 514. This will show whether the FTD is attempting to transmit syslog messages and on which interface.

Answer

Run 'debug syslog all' from the FTD expert mode.

Answer

Use 'system support reset-logging'.

Answer

Check the FMC dashboard under System > Logging > Syslog status.

Question 7

An administrator wants to export a packet capture (.pcap file) taken on an FTD interface directly from the FMC GUI for offline analysis in Wireshark. Where should the administrator navigate?

Accepted Answer

Analysis > Captures or Devices > Device Management > Packet Capture. To export a packet capture (.pcap) taken on an FTD interface from the FMC GUI, the administrator navigates to Analysis > Captures or Devices > Device Management > Packet Capture. These locations provide access to captures stored on the FTD, allowing download of the .pcap file for offline analysis in Wireshark.

Answer

System > Tools > Packet Export

Answer

Policies > Access Control > Advanced > Packet Capture

Answer

Objects > Object Management > Captures

Question 8

An FMC administrator is troubleshooting a scenario where device registration between an FTD and FMC fails immediately with a registration key mismatch error. The administrator verified the NAT ID and registration key. What underlying protocol handshake fails during this registration process, and how can it be debugged?

Accepted Answer

The sftunnel (TCP 8305) handshake fails; debug using 'sftunnel status' and examining /var/log/sftunnel.log.. FTD-to-FMC registration relies on the sftunnel, which uses TCP 8305 for its handshake and ongoing management communication. When registration fails with a key mismatch, the sftunnel handshake is what is failing, and it can be debugged with 'sftunnel status' and by examining /var/log/sftunnel.log on the FTD.

Answer

The HTTPS REST API (TCP 443) handshake fails; debug using 'debug rest-api'.

Answer

The SNMP trap receiver fails; debug using 'system support snmp-debug'.

Answer

The SSH tunnel (TCP 22) fails; debug using 'tail -f /var/log/secure'.

Question 9

An administrator is troubleshooting high memory utilization on an FMC appliance. Which TWO actions or tools can be used to identify resource-heavy processes or clean up storage? (Choose two)

Accepted Answer

Navigate to Analysis > Health > Monitor to review historical memory utilization graphs and identify anomalies.. Option A is correct because the FMC's Analysis > Health > Monitor page provides Health Monitor graphs, including historical memory utilization, which let the administrator spot trends and anomalies that correlate with resource-heavy periods. Option C is correct because entering expert mode from the FMC CLI gives access to the underlying Linux shell, where standard utilities like 'top' and 'ps' show per-process CPU and memory consumption so the offending process can be identified. Option B is wrong because 'system support memory-dump' is not a valid FMC GUI action for this purpose. Option D is wrong because restarting the Snort inspection engine on the FMC does not identify resource-heavy processes or clean up storage, and Snort typically runs on managed devices rather than the FMC itself. Option E is wrong because 'clear memory cache' is not a valid FMC CLI command.

Answer

Run 'system support memory-dump' from the FMC GUI.

Answer

Restart the Snort inspection engine on the FMC.

Answer

Execute 'clear memory cache' in the FMC CLI.

Question 10

An engineer is troubleshooting a scenario where an FTD device fails its pre-upgrade health check during an upgrade initiated from the FMC. Which THREE common pre-check failures must be resolved before proceeding? (Choose three)

Accepted Answer

Unapplied pending configuration deployments between FMC and FTD.. Option B is correct because the FMC pre-upgrade health check verifies configuration synchronization, and any pending, undeployed policy or configuration changes between FMC and the managed FTD must be deployed before the upgrade can proceed. Option C is correct because the upgrade process requires adequate free space on the target partition (such as /var or /CiscoMFT) to stage and extract the new software image, and the pre-check fails if disk space is insufficient. Option D is correct because active critical health monitor alarms indicate an unhealthy device state, and the pre-check blocks the upgrade until those critical alarms are cleared. Option A is not a pre-check failure condition, since active SSH sessions to the FTD CLI do not by themselves block an FMC-initiated upgrade. Option E is not a failure condition either, as static routes and default gateways are normal, valid configuration and are not checked as an upgrade blocker.

Answer

Active SSH sessions logged into the FTD CLI.

Answer

Configured static routing tables with default gateways.

Question 11

An administrator is analyzing a troubleshooting scenario involving Snort inspection crashes on an FTD device. Which THREE locations or tools should the administrator check to diagnose why the Snort process restarted or crashed? (Choose three)

Accepted Answer

Examine /var/log/messages and system log files for Out-Of-Memory (OOM) killer events targeting Snort.. Option C is correct because when the Snort process on an FTD is killed due to memory exhaustion, the Linux kernel OOM killer logs the event in /var/log/messages and other system logs, showing which process (snort) was terminated and why. Option D is correct because Snort-specific runtime errors, such as inspection engine failures or rule-related crashes, are written to the Snort logs under /var/log/snort/ and are also surfaced as health alerts in FMC, making them a primary diagnostic source. Option E is correct because when Snort crashes it can generate core dump files in the crash directories; these can be listed in expert mode or managed with the 'system support clean-core' command, and analyzing them (or their presence) helps confirm and diagnose the crash. Option A is incorrect because Smart Software Manager license expiration would cause registration or entitlement issues, not a Snort process restart or crash. Option B is incorrect because DHCP lease logs in /var/log/dhcpd.log relate to address assignment and have no bearing on Snort inspection crashes.

Answer

Check the Cisco Smart Software Manager portal for license expiration alerts.

Answer

Inspect the DHCP lease logs in /var/log/dhcpd.log.

Question 12

An administrator needs to monitor the real-time health and status of managed devices from the FMC dashboard. Which TWO dashboard widgets or features are available in FMC to assist with device monitoring? (Choose two)

Accepted Answer

Health Status widget. The Health Status widget (A) is a standard FMC dashboard widget that displays real-time health metrics for managed devices, including CPU, memory, disk usage, and interface status, making it directly relevant to monitoring device health. The Device Status widget (E) is also an FMC dashboard widget that shows the current up/down status and connectivity of managed devices, which is exactly what the administrator needs for real-time status monitoring. The Real-time Packet Replay widget (B) does not exist in FMC; packet capture and replay are handled through troubleshooting tools, not dashboard widgets. The Firewall Cluster Load Balancing Graph widget (C) is not an FMC dashboard feature; FMC provides cluster status via device health monitors, not a dedicated load-balancing graph widget. The Active BGP Neighbor Matrix widget (D) is not an FMC dashboard widget; BGP neighbor status is viewed through device-specific routing tables or CLI, not a dashboard matrix.

Answer

Real-time Packet Replay widget

Answer

Firewall Cluster Load Balancing Graph widget

Answer

Active BGP Neighbor Matrix widget

Question 13

An administrator needs to troubleshoot an issue where legitimate traffic is being silently dropped by the FTD device. The standard packet trace does not reveal the exact reason. Which command executed on the FTD CLI is best suited to diagnose accelerated security path (ASP) drops in real time?

Accepted Answer

capture drop type asp-drop all. The command 'capture drop type asp-drop all' is specifically designed to capture packets dropped by the Accelerated Security Path (ASP) on Cisco FTD devices. It provides real-time visibility into drops that occur in the ASP, which are not always visible through standard packet traces. This makes it the best tool for diagnosing silent drops caused by ASP-level issues.

Answer

capture capin interface outside match ip any any

Answer

system support firewall-engine-debug

Answer

debug crypto ipsec

Question 14

An administrator needs to restore an FMC configuration backup onto a replacement hardware appliance. Which of the following conditions must be met for the backup restoration to succeed successfully?

Accepted Answer

The target FMC must run the exact same software version and patch level as the source appliance.. FMC backup restoration requires that the target appliance run the exact same software version and patch level as the source appliance that produced the backup. The backup archive contains version-specific database schemas and configuration structures, so a mismatch in version or patch level will cause the restore to fail or produce an inconsistent configuration. Cisco documentation explicitly states this as a prerequisite for successful restoration.

Answer

Smart Licensing must be disabled on the target appliance prior to importing the backup.

Answer

The target FMC must be running a newer major software version than the backup file.

Answer

The target appliance hardware model must be different to allow schema remapping.

Question 15

An administrator notices that the FMC Health Monitor shows a 'Critical' alert for the Snort process utilization on an FTD device. What is the most appropriate first-line troubleshooting step from the FMC GUI or FTD CLI to investigate the cause of high Snort CPU usage?

Accepted Answer

Check the Snort performance statistics and rule update status via Devices > Device Management > Advanced > Snort Statistics.. The most appropriate first-line troubleshooting step is to check Snort performance statistics and rule update status via Devices > Device Management > Advanced > Snort Statistics in the FMC GUI. This provides visibility into Snort's CPU usage, packet processing rates, and rule-related metrics that can reveal whether the issue stems from rule complexity, traffic volume, or a recent rule update. It is a non-disruptive diagnostic step that gathers data before any remediation.

Answer

Restart the database process via 'pmtool restartbyname mysqld'.

Answer

Change the Access Control policy action from 'Inspect' to 'Block' globally without logging.

Answer

Delete all custom intrusion rules immediately to clear the buffer.