300-710 SNCF Management And Troubleshooting — Timed 15 Questions

Question 1

An administrator successfully restores an FMC backup onto a freshly deployed FMC virtual appliance of the exact same software version. However, after the restore completes, all managed FTD devices show a status of 'Offline' or 'Config Apply Failed'. What is the most likely root cause and correct resolution?

15 minute time limit — choose an answer to begin.

Accepted Answer

The new FMC has a different system UUID and Internal Certificate Authority keys; the administrator must re-establish trust by re-registering the FTD devices using new registration keys.. When an FMC backup is restored onto a new FMC appliance, the new FMC generates its own system UUID and Internal Certificate Authority (CA) keys, which differ from the original FMC's. FTD devices trust the original FMC's CA and UUID, so after restore they cannot re-establish the sftunnel trust relationship and show as Offline or Config Apply Failed. The correct resolution is to re-register each FTD with the new FMC using fresh registration keys.

Answer

The FTD management interface IP addresses must be manually changed to match the old FMC management subnet.

Answer

The administrator must run 'configure manager add' on the FMC CLI to force an SNMP trap listener.

Answer

The FTD devices automatically wipe their configurations when an FMC backup is restored; the administrator must factory reset every FTD.

Question 2

An administrator notices that the Firepower Management Center (FMC) health monitor shows a critical warning regarding high disk utilization on the /var partition. Which built-in utility or action should the administrator perform first to safely free up disk space without disrupting critical database integrity?

Accepted Answer

Use the FMC GUI to delete unneeded packet captures and older correlation event logs or prune event data via System > Health > Monitor.. The FMC health monitor flags /var disk pressure primarily because event data, correlation logs, and stored packet captures accumulate there. The supported, non-disruptive remediation is to use the FMC GUI to delete unneeded packet captures and prune older correlation/event data (System > Health > Monitor, plus Analysis > Correlation > Audit Log or the event pruning settings). This frees space while preserving the database schema and integrity, unlike manual filesystem surgery.

Answer

Reboot the FMC appliance into single-user mode and execute a complete filesystem format on the /var partition.

Answer

Navigate to System > Integration > Snort and delete all historical rule inspection data.

Answer

Run the 'rm -rf /var/sf/imagedb/*' command directly from the expert mode CLI to purge immediate image databases.

Question 3

An FTD device managed by FMC is experiencing high CPU utilization attributed to the Snort inspection engine. The administrator wants to identify which specific intrusion rules or access control rules are consuming the most resources. Which tool or report should the administrator use?

Accepted Answer

Access the FTD CLI and run 'system support diagnostic-cli' followed by 'show perfstats' or review the Intrusion Performance dashboard in FMC.. The Intrusion Performance dashboard in FMC provides detailed statistics on Snort inspection performance, including top rules by packet count, byte count, and CPU usage. Additionally, the FTD CLI command 'system support diagnostic-cli' followed by 'show perfstats' gives real-time performance data for the Snort engine. Together, these tools allow the administrator to identify which specific intrusion rules or access control rules are consuming the most resources.

Answer

Run a packet capture on the management interface (eth0) with a BPF filter for CPU interrupts.

Answer

Navigate to Analysis > Datastores > Packet Trace and export the raw CPU register dump.

Answer

Check the Interfaces > Counters page in the Cisco Integrated Management Controller (CIMC).

Question 4

An engineer needs to troubleshoot an intermittent connectivity issue between a secured zone and the internet through a Firepower Threat Defense (FTD) managed by FMC. The engineer wants to capture traffic hitting a specific Access Control rule without overwhelming the system. Which packet capture configuration is most appropriate?

Accepted Answer

Create an advanced capture in the FMC under Devices > Device Management > Packet Capture, specifying the ingress interface, matching IP filters, and enabling the 'Promiscuous Mode' option.. FMC's advanced packet capture feature (Devices > Device Management > Packet Capture) allows you to define a capture with specific ingress interfaces, IP/port filters, and buffer settings, which limits the capture to only the traffic of interest. This targeted approach avoids overwhelming the FTD's CPU and disk while still capturing packets that hit the specific Access Control rule being troubleshot. Promiscuous mode is not strictly required for FTD captures but the option is available; the key is the filtering and interface scoping.

Answer

Configure a global capture on all interfaces using the 'capture global interface any' command without any access lists or filters.

Answer

Enable 'Debug All Packets' in the FTD expert mode shell via system support diagnostic-cli.

Answer

Modify the Snort detection engine configuration to write every inspected packet directly to a text file in /var/log/snort.

Question 5

An administrator is preparing to upgrade a high-availability (HA) pair of Firepower Threat Defense devices managed by an FMC. Before initiating the upgrade task via the FMC upgrade tool, which preliminary action is mandatory to ensure a seamless process and prevent split-brain conditions?

Accepted Answer

Run the software pre-upgrade checker package on the FTD units via the FMC System > Updates interface to identify blocking dependencies or insufficient disk space.. Before upgrading an FTD HA pair via FMC, the mandatory preliminary step is to run the software pre-upgrade checker package on the FTD units through the FMC System > Updates interface. This checker validates readiness by identifying blocking dependencies, insufficient disk space, and other conditions that could cause the upgrade to fail or cause HA split-brain. It is a required step in the FMC upgrade workflow.

Answer

Manually break the High Availability pair, upgrade the Secondary unit first, and promote it to Primary before upgrading the old Primary unit.

Answer

Execute 'ha-manager failover-disable' from the expert CLI on both units to permanently disable heartbeat signaling.

Answer

Export the entire database, reinstall the operating system from a USB thumb drive on both devices, and restore the configuration.

Question 6

An administrator is troubleshooting a scenario where Snort inspection threads on an FTD are crashing intermittently, producing core dumps. To assist Cisco TAC in root cause analysis, what is the correct sequence of tools or CLI commands to collect the necessary diagnostic data?

Accepted Answer

Access the FTD CLI and execute the 'system support tech-support' command to generate a comprehensive diagnostic tarball containing core files and system logs.. The correct approach is to access the FTD CLI and run 'system support tech-support', which generates a comprehensive diagnostic tarball that includes core files, system logs, and configuration data needed by Cisco TAC for root cause analysis. This is the standard Cisco-recommended method for collecting troubleshooting data from FTD devices.

Answer

Log into the FMC GUI, go to System > Health > Diagnostics, and click 'Purge Cores'.

Answer

Run 'snort-engine restart --debug' in the expert mode shell and capture live stderr streams using tcpdump.

Answer

Export the running-config via TFTP and open the core dump files using a standard text editor.

Question 7

An administrator is troubleshooting an issue where an FMC cannot communicate with a managed FTD device. The health monitor shows registration is down. The administrator checks the FTD CLI and verifies the registration key and NAT ID. Which log file on the FTD should the administrator examine to troubleshoot registration and communication daemon errors (such as sftunnel)?

Accepted Answer

/var/log/cisco/sftunnel.log. The sftunnel daemon manages secure communication between FTD and FMC. Its logs are located in /var/log/cisco/sftunnel.log on the FTD filesystem.

Answer

/var/sf/nl/nl_manager.log

Answer

/var/log/messages

Answer

/opt/cisco/wsm/logs/startup.log

Question 8

An administrator wants to verify the NTP synchronization status and time offset on a managed FTD device from the FMC GUI. Where can this health and system information be viewed?

Accepted Answer

Devices > Device Management > Edit Device > General / Platform Settings. In FMC, per-device health and system information — including NTP synchronization status, time offset, and clock source — is viewed by navigating to Devices > Device Management, editing the specific FTD, and reviewing the General and Platform Settings sections. This is where the device's time synchronization state and related health details are surfaced for that managed device.

Answer

Policies > Platform Settings > Time Synchronization

Answer

System > Health > NTP Status

Answer

Analysis > Dashboards > Time Sync

Question 9

An FMC managed deployment is experiencing slow GUI performance and delayed event reporting. The administrator suspects database table bloat in the FMC PostgreSQL database. Which utility or command can the administrator run from the FMC expert shell to analyze and vacuum/optimize the database safely?

Accepted Answer

Execute the FMC database optimization script or use 'system support database-optimizer' if available, or consult Cisco documentation for running vacuum scripts via the sf bin directory.. To address database table bloat in the FMC PostgreSQL database, the administrator can run the FMC database optimization script or use 'system support database-optimizer' if available, or consult Cisco documentation for running vacuum scripts via the sf bin directory. This safely analyzes and vacuums the database to reclaim space and improve performance.

Answer

Use the FMC GUI under System > Database > Purge and click 'Format Storage'.

Answer

Run 'pg_ctlcluster 12 main restart' in the root shell.

Answer

Execute 'drop database sf_db; recreate database;' from the PostgreSQL prompt.

Question 10

An administrator is troubleshooting a VPN tunnel termination issue on an FTD device. To check IPsec Phase 1 and Phase 2 security associations (SAs) and real-time crypto debugging messages, which command should be executed on the FTD diagnostic CLI?

Accepted Answer

Access the diagnostic CLI via 'system support diagnostic-cli' and run 'show crypto ipsec sa' and 'show crypto isa sa'.. To check IPsec Phase 1 and Phase 2 SAs and real-time crypto debugging on FTD, you must access the diagnostic CLI via 'system support diagnostic-cli' and then run 'show crypto ipsec sa' and 'show crypto isa sa'. These commands display the security associations and can be used with debug commands for real-time troubleshooting.

Answer

Run 'system support VPN-debug enable' from the FTD expert shell.

Answer

Run 'vpn session print' in the expert mode root shell.

Answer

Execute 'show vpn-status' from the FMC CLI.

Question 11

An FTD high-availability pair is experiencing split-brain behavior due to a unidirectional failure of the state and heartbeat links. As a result, both units are claiming to be Active. Which CLI command on the FTD should an administrator use to troubleshoot interface failover status and verify interface health across the failover link?

Accepted Answer

show failover. The command 'show failover' on FTD provides detailed information about the failover state, including interface status and health across the failover link. It is the primary CLI command to verify failover status and diagnose split-brain scenarios by showing which unit is active and the state of the failover interfaces.

Answer

system support failover-check

Answer

show cluster info

Answer

ha-manager status --detailed

Question 12

An administrator is troubleshooting a memory leak on an FTD virtual appliance. The administrator wants to inspect real-time memory usage of individual system processes and identify top memory-consuming tasks. Which command should be run in the FTD expert mode shell?

Accepted Answer

top or ps aux --sort=-%mem. In FTD expert mode, the underlying OS is Linux, so 'top' and 'ps aux --sort=-%mem' are the standard tools to view real-time per-process memory and CPU usage and to sort by memory consumption. These are the correct commands for identifying top memory-consuming tasks during a memory leak investigation.

Answer

system support memory-leak-detector

Answer

show memory detail

Answer

pmtool memory-dump all

Question 13

An engineer needs to troubleshoot connectivity through an FTD firewall and wants to use the FTD packet tracer utility. Which THREE parameters are required when executing a basic packet tracer command from the diagnostic CLI? (Choose three)

Accepted Answer

Protocol (such as tcp, udp, or icmp). The FTD packet tracer utility requires a protocol such as tcp, udp, or icmp (option B) because it must build a synthetic packet of the specified type to simulate the flow through the data path. It also requires the ingress interface name (option C) so the tracer knows at which interface the simulated packet enters the device and can apply the correct interface-based policies and routing decisions. Finally, a source IP address (option D) is mandatory to populate the packet's source field, which is needed for evaluating access control, NAT, and routing lookups. Options A and E are not required: an SNMP community string is unrelated to packet tracing, and a packet payload hex string is optional (the tracer can generate a default payload), not a mandatory parameter for a basic trace.

Answer

SNMP community string

Answer

Packet payload hex string

Question 14

An engineer is troubleshooting a packet loss issue on an FTD interface. Which THREE CLI commands executed in the diagnostic CLI can help identify interface drops, errors, and buffer issues? (Choose three)

Accepted Answer

show interface detailed. To check interface errors, drops, and counters on FTD, administrators use 'show interface', 'show interface detailed', and 'cphw interface' or similar diagnostic commands.

Answer

show running-config interface-errors

Answer

show memory packet-buffers

Question 15

An administrator is configuring automated backup tasks on the FMC. Which TWO destinations or protocols are natively supported by the FMC for storing backup archives? (Choose two)

Accepted Answer

Local storage on the FMC appliance. Option B (Local storage on the FMC appliance) is correct because the FMC natively supports saving backup archives to its own local disk, which is the default destination when you run a backup from the FMC GUI or CLI. Option C (Remote SCP / SFTP server) is correct because the FMC backup configuration allows you to specify an external server and transfer the archive using SCP or SFTP as the native remote storage protocol. Option A is not a backup destination; the Smart Licensing Cloud Repository is used for license registration and entitlement, not for storing FMC configuration backups. Option D is not supported because the FMC does not back up to a Windows SYSVOL share or use SMB/CIFS natively for backup archives. Option E is not supported because the FMC does not provide direct AWS S3 API backup integration without a mounted or intermediary file system.

Answer

Cisco Smart Licensing Cloud Repository

Answer

Windows Active Directory SYSVOL share

Answer

Public AWS S3 bucket via direct API access without a local mount