300-710 SNCF Management And Troubleshooting Practice Test 7 — 15 Questions

Question 1

An administrator is troubleshooting a scenario where configuration deployment from FMC to an FTD device fails with a 'Deployment Validation Error'. Where can the administrator view the detailed validation messages and deployment task history?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

System > Monitoring > Task Manager. The Task Manager in FMC (System > Monitoring > Task Manager) provides detailed deployment task history, including validation errors and the specific reasons why a configuration deployment to an FTD failed. It shows each deployment attempt, its status, and any error messages generated during validation.

Answer

Objects > Object Management > History

Answer

Analysis > Intrusions > Events

Answer

Devices > Platform Settings > Deployment Log

Question 2

An administrator is troubleshooting intermittent connectivity loss between an FTD managed device and the FMC. Which TWO methods or tools can be used to verify registration and communication status between the managed device and the FMC? (Choose two.)

Accepted Answer

Review the connection status in the FMC GUI under Devices > Device Management.. Option C is correct because the FMC GUI at Devices > Device Management displays each managed device's registration and connectivity state (e.g., 'Up'/'Down' or 'Reachable'), which directly reflects the SFTunnel-based management channel status. Option E is correct because the FTD CLI commands 'show sftunnel status' (or the newer 'sftm status') report the state of the Secure Firewall Tunnel (SFTunnel) that carries management traffic between the FTD and FMC, including peer connectivity and heartbeat information. Option A is wrong because Access Control policy hit counts show traffic matching rules, not the management/registration tunnel status. Option B is wrong because UDP port 514 is syslog, not the SFTunnel management protocol, and capturing on the FMC management interface would not verify registration state. Option D is wrong because the health monitor's 'SNMP Agent' status concerns SNMP polling, not the FTD-to-FMC registration and communication channel.

Answer

Inspect the Access Control policy rule hit counts.

Answer

Run a packet capture on the FMC management interface filtering for UDP port 514.

Answer

Check the health monitor alerts specifically for 'SNMP Agent' status.

Question 3

An administrator needs to perform a full system backup of the FMC. Where is the most appropriate place to store this backup for long-term disaster recovery?

Accepted Answer

Remote server using SCP or SFTP. The FMC full system backup must be stored off-box for true disaster recovery. Cisco explicitly supports exporting the backup to a remote server via SCP or SFTP, which provides a durable, external location that survives FMC hardware failure, reimaging, or replacement. Because the backup contains the entire FMC configuration, database, and OS state, keeping it on a remote server ensures it can be restored to a new appliance or VM during a full-site disaster.

Answer

Local /var/log/backup partition

Answer

The FMC /tmp directory

Answer

Attached USB storage drive

Answer

The managed FTD flash memory

Question 4

When troubleshooting policy deployment failures, which log file on the FMC should be examined to see the specific error returned by the device during the commit process?

Accepted Answer

Deployment History. The Deployment History in FMC records each policy deployment attempt, including the specific error messages returned by the managed device during the commit process. It is the primary place to troubleshoot deployment failures.

Answer

FMC kernel log

Answer

Snort logs

Answer

System Access Log

Answer

Audit logs

Question 5

Which license state must an FTD device reach to allow the FMC to push policy configurations to it?

Accepted Answer

Registered and licensed. An FTD device must be in the 'Registered and licensed' state for the FMC to push policy configurations to it. Registration establishes the management connection, and licensing ensures that the device is entitled to the required features. Only when both conditions are met can policies be deployed.

Answer

Disabled

Answer

Unregistered

Answer

Waiting for registration

Answer

Standby mode only

Question 6

When troubleshooting an issue where an FTD interface is in a 'down' state, which command helps verify if there is a physical layer issue or an administrative shutdown?

Accepted Answer

show interface. The 'show interface' command on FTD displays detailed per-interface status including line protocol state, administrative state, speed, duplex, and error counters, which lets the administrator distinguish a physical layer problem (line down, no link) from an administrative shutdown (interface administratively down). This is the standard CLI check for interface state on FTD.

Answer

show link status

Answer

show hardware interface

Answer

show run interface

Answer

show status

Question 7

You are analyzing connection events and notice a block action. Which field in the connection event details best explains why the connection was dropped by the policy?

Accepted Answer

Reason. The 'Reason' field in a connection event explicitly states why the connection was dropped, such as 'Blocked by Access Control Rule' or 'Drop due to Snort rule'. It is the most direct indicator of the policy enforcement cause. Other fields like Policy Enforcement or Connection Policy may show related metadata but do not provide the specific drop reason.

Answer

Policy Enforcement

Answer

Connection Policy

Answer

Traffic Log

Answer

Drop Description

Question 8

An administrator needs to determine if the FMC has enough disk space to hold a new software upgrade image. Which menu should they check?

Accepted Answer

System > Health > Monitor. FMC displays disk space and other appliance health metrics under System > Health > Monitor, where the administrator can view disk utilization for the FMC and managed devices. This is the correct menu to confirm whether enough disk space exists for a new software upgrade image.

Answer

Devices > Device Management > System

Answer

Policies > Settings

Answer

System > Configuration > Disk

Answer

System > Updates > Disk Space

Question 9

When a packet capture is running on the FTD, where can you download the resulting .pcap file for analysis in Wireshark?

Accepted Answer

Devices > Device Management > Captures. Packet capture files (.pcap) generated on the FTD can be downloaded from Devices > Device Management > Captures in the FMC GUI. This page lists active and completed captures and provides a download option for the resulting pcap file, which can then be opened in Wireshark for detailed analysis. It is the designated location for managing and retrieving capture files.

Answer

Devices > Device Management > Diagnostics

Answer

System > Tools > File Transfer

Answer

Objects > File Lists

Answer

Analysis > Packet Analysis

Question 10

When troubleshooting a connectivity issue where traffic is being dropped, which TWO of the following logs or tools should be reviewed first to determine the cause?

Accepted Answer

Connection Events. Connection Events (A) should be reviewed first because they record per-flow details such as source/destination, ingress/egress interfaces, matched access-control rule, and the specific drop reason (e.g., deny by ACL, no matching rule, or security-intelligence block), directly revealing why traffic was dropped. Packet Tracer (C) is also correct because it simulates a specific packet against the configured policies and shows the exact point in the policy chain where it is allowed or dropped, making it ideal for pinpointing the cause of a connectivity failure. The System Access Log (B) only records administrative login/authentication activity, not traffic-forwarding decisions, so it cannot explain dropped packets. The File Policy Report (D) covers file-type detection and malware/blocking actions on files, which is unrelated to general connectivity drops. Hardware Inventory (E) merely lists device components and serial numbers and provides no insight into traffic handling.

Answer

System Access Log

Answer

File Policy Report

Answer

Hardware Inventory

Question 11

Which action must be taken on the FTD CLI after a manual configuration change is made, if you want to ensure the FMC does not overwrite it?

Accepted Answer

Manual changes should be avoided; perform all changes in FMC.. Manual changes on the FTD CLI should be avoided because the FMC is the central management platform and will overwrite any manual configuration changes during the next policy deployment. To ensure the FMC does not overwrite manual changes, the best practice is to perform all changes in FMC. There is no CLI command to lock manual changes from being overwritten.

Answer

Set the device to 'Read-Only' mode.

Answer

Run 'fmc update lock'.

Answer

Run 'write memory' to lock the configuration.

Answer

Run 'commit configuration' to save the state.

Question 12

Which TWO methods can be used to gather diagnostic information for a Cisco TAC case from an FTD device?

Accepted Answer

Generate a troubleshooting file in the FMC. Option A is correct because the Firepower Management Center (FMC) provides a built-in 'Generate Troubleshooting File' feature under the device's Troubleshoot menu, which bundles logs, configuration, and health data into a single archive specifically intended for Cisco TAC analysis. Option E is correct because running a packet capture on the FTD CLI (e.g., using the 'capture-traffic' command or the FTD 'capture' command in expert mode) lets an administrator collect live packet-level data that TAC commonly requests to diagnose traffic and inspection issues. Option B is not a standard TAC diagnostic method for FTD; a Snort memory dump is not a routine, supported data-gathering procedure and is typically used only for specific crash analysis. Option C is wrong because re-imaging the device is a destructive recovery action, not a diagnostic data-gathering method, and would erase evidence. Option D is wrong because exporting a full database schema is not a supported FTD diagnostic collection method and provides no useful troubleshooting data for TAC.

Answer

Taking a memory dump of the Snort process

Answer

Running a full system re-image

Answer

Exporting the full database schema

Question 13

When configuring FMC backup schedules, which TWO storage options are natively supported for the backup files?

Accepted Answer

Remote SCP server. FMC's backup scheduling feature natively supports exporting backups to a remote host via SCP, allowing administrators to store configuration backups off-box using the SCP protocol. Option D (Local management appliance storage) is also correct because FMC natively supports storing scheduled backups on the local disk of the management appliance itself. Options B (Local USB drive), C (Cloud S3 storage bucket), and E (Centralized Syslog server) are not natively supported backup destinations for FMC scheduled backups; USB and S3 are not built-in options in the FMC backup schedule configuration, and a Syslog server is used for event/log forwarding, not for storing backup files.

Answer

Local USB drive

Answer

Cloud S3 storage bucket

Answer

Centralized Syslog server

Question 14

When analyzing performance issues, which THREE metrics should an administrator monitor in the FMC Health Monitor?

Accepted Answer

CPU utilization. In the FMC Health Monitor, CPU utilization (A) is a core metric because sustained high processor load directly degrades policy deployment, event processing, and GUI responsiveness. Memory utilization (B) must be monitored since FMC runs multiple services (e.g., the database, Tomcat, and eventing processes) that can exhaust RAM and trigger swapping or service restarts. Disk utilization (C) is equally critical because the FMC stores event data, configuration backups, and updates on disk; a full /var or / volume can halt logging and even the web interface. The unmarked options do not belong because user login frequency (D) and the number of active GUI sessions (E) are administrative activity indicators, not system health or performance metrics tracked by the FMC Health Monitor.

Answer

User login frequency

Answer

Number of active GUI sessions

Question 15

Which THREE steps are part of a standard FTD upgrade workflow managed via the FMC?

Accepted Answer

Upload the upgrade package to the FMC. Option C is correct because the standard FTD upgrade workflow managed through the FMC begins by uploading the FTD software upgrade package (image) to the FMC, which then stages it for deployment to managed devices. Option E is correct because after the package is available, the administrator selects the target device(s) in the FMC's Upgrade management page to initiate and schedule the upgrade. Option D is correct because the workflow includes running a readiness/health check on the device and reviewing and approving the resulting health check report before proceeding with the actual upgrade. Options A and B are incorrect: manually deleting all existing access rules is not a step in the upgrade workflow and would disrupt policy, and running a factory reset on the FTD is not part of a standard upgrade—it would wipe the configuration rather than upgrade the software.

Answer

Manually delete all existing access rules

Answer

Run a factory reset on the FTD