300-710 SNCF Multiple Select — 50 Questions

Question 1

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO fields or parameters can be included in the syslog output to facilitate incident investigation and event parsing by the SIEM? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Precise timestamp formatting (UTC or local time) configured in Platform Settings. Option B is correct because the syslog timestamp format (UTC or local time) is configurable under Platform Settings > Syslog in FTD, and consistent, precise timestamps are essential for correlating events across the SIEM and establishing accurate incident timelines. Option D is correct because including the firewall device name or identifier in the syslog header lets the SIEM attribute each event to its originating sensor, which is critical in multi-device deployments for parsing, filtering, and investigation. The remaining options are not valid syslog fields: a full memory core dump (A) is a diagnostic binary artifact, not syslog content; FMC administrator SSH private keys (C) are credentials that must never be transmitted in logs; and raw PCAP data (E) is captured separately via packet capture tools and cannot be embedded as text in syslog messages.

Answer

Full memory core dump binary attachments

Answer

FMC administrator SSH private keys

Answer

Raw packet captures (PCAP) of dropped connections embedded in syslog text

Question 2

An administrator is troubleshooting a Prefilter Policy configured on an FMC. Which THREE actions are available when creating a rule in a Prefilter Policy? (Choose three)

Accepted Answer

Slow Path (send traffic through normal inspection pipeline). In an FMC Prefilter Policy, each rule can take one of three actions: Block, which drops matching traffic immediately without further inspection (option D); Fast Path, which bypasses the inspection pipeline and fast-forwards traffic (option E); and Slow Path, which sends traffic through the normal inspection pipeline for further analysis (option C). These three actions are the only ones available at the prefilter stage, which exists to reduce the load on the Snort inspection engine by handling traffic before it reaches the access control policy. Option A (Decrypt - Resign) is an SSL policy action, not a prefilter rule action, and option B (Inspect with Snort 3 Intrusion Prevention) is an access control rule action, so neither belongs in a Prefilter Policy rule.

Answer

Decrypt - Resign (intercept and re-sign SSL certificate)

Answer

Inspect with Snort 3 Intrusion Prevention

Question 3

Which TWO settings are available when configuring the 'Logging' tab in an Access Control Rule?

Accepted Answer

Log at End. In Cisco Firepower Management Center, an Access Control Rule's Logging tab lets you choose when to generate connection events for traffic matching the rule, and the two available timing settings are 'Log at Beginning' (option E) and 'Log at End' (option D). 'Log at Beginning' generates a connection event when the connection is first seen, which is useful for capturing attempted connections even if they are later blocked or never complete. 'Log at End' generates the event when the connection closes, providing full session details such as bytes sent/received and duration. 'Log to Cloud' (A) is not a logging-timing option in the Access Control Rule Logging tab, and 'Log every packet' (B) and 'Log at Middle' (C) are not valid settings for this tab.

Answer

Log to Cloud

Answer

Log every packet

Answer

Log at Middle

Question 4

Which TWO of the following are benefits of using a Port Channel on an FTD?

Accepted Answer

Improved link redundancy.. Option A is correct because a Port Channel (EtherChannel/LACP or static) bundles multiple physical interfaces into one logical interface, so if a member link fails, traffic continues over the remaining links, providing link redundancy without a topology change. Option E is correct because the bundled member links share traffic through the hashing algorithm, so the logical interface's throughput is the aggregate of its members, increasing total available bandwidth beyond a single link. Options B, C, and D are not benefits of a Port Channel: it does not inherently reduce latency, it does not eliminate spanning tree (STP still runs on the logical bundle and the FTD still participates in loop prevention), and it has nothing to do with automatic NAT mapping, which is a separate FTD NAT policy function.

Answer

Reduced latency.

Answer

Elimination of spanning tree.

Answer

Automatic NAT mapping.

Question 5

An administrator wants to ensure that all security event logs from Cisco Secure Firewall Threat Defense are exported reliably and in real time to external security analytics tools. Which TWO deployment and configuration practices should be implemented? (Choose two)

Accepted Answer

Configure Reliable Syslog (TCP with TLS) in FTD Platform Settings to ensure encrypted and guaranteed log delivery.. Option B is correct because configuring Reliable Syslog in FTD Platform Settings uses TCP with TLS (port 6514 by default) to provide encrypted, connection-oriented, acknowledged delivery of syslog events, which prevents log loss and satisfies the requirement for reliable, real-time export to external analytics tools. Option D is correct because eStreamer on the FMC streams intrusion, connection, malware, and other security events in near real time to a SIEM collector over a persistent TLS connection, which is the Cisco-recommended method for feeding external security analytics platforms. Option A is wrong because local disk storage with weekly manual SCP exports is neither real-time nor reliable, and risks losing events if the disk fills or the device fails. Option C is wrong because disabling the Snort engine would stop intrusion event generation entirely and does not address log transport. Option E is wrong because SNMPv1 traps only carry event counters and are unencrypted, unacknowledged, and not designed for streaming detailed security event logs.

Answer

Rely solely on local FTD disk storage and export logs via manual SCP once a week.

Answer

Disable the Snort engine to prevent log buffer congestion.

Answer

Configure SNMPv1 traps to poll event counters every 60 seconds.

Question 6

An administrator is investigating an issue where connection events are failing to reach the FMC from a managed FTD. Which THREE daemons or logs on the FTD and FMC should be checked to troubleshoot event transport and communication issues? (Choose three)

Accepted Answer

FTD event streaming and SFIMS logs. Option A is correct because the FTD's event streaming process and SFIMS (the Firepower Management Center communication agent) are responsible for generating and forwarding connection events to the FMC, so their logs directly reveal whether events are being produced and transmitted. Option C is correct because /var/log/cisco/sftunnel.log records the status of the sftunnel (Secure Firewall Tunnel) connection between the FTD and FMC; if this tunnel is down or flapping, event transport will fail. Option E is correct because on the FMC, the event collection and correlator components receive and process events, and their logs (for example /var/log/messages or application logs under /var/sf/log) show whether events arrive and are ingested. Option B is not relevant because /var/log/dhcpd.log pertains to DHCP daemon activity, which has nothing to do with FTD-to-FMC event transport. Option D is not relevant because /var/log/samba/smb.log relates to SMB/CIFS file-sharing services, which are unrelated to Firepower event communication.

Answer

/var/log/dhcpd.log

Answer

/var/log/samba/smb.log

Question 7

An administrator is configuring high availability for Cisco Secure Firewall Threat Defense using Cisco FMC. Which TWO configuration steps are required during the initial setup of an Active/Standby HA pair? (Choose two)

Accepted Answer

Configure a dedicated failover interface and IP address scheme for stateful heartbeat communication.. Option A is correct because an Active/Standby Threat Defense HA pair requires a dedicated failover link (a physical interface or subinterface) with its own IP addressing scheme, over which the units exchange heartbeat and stateful failover messages. Option D is correct because, during HA configuration in FMC, the administrator must designate which chassis is the Primary unit and which is the Secondary unit, which determines failover precedence and role assignment. Option B is incorrect because HA management interfaces must use static IP addresses on the same subnet, not DHCP, so each unit retains a stable, unique management address for FMC communication. Option C is incorrect because both HA peers must run the same firewall mode (both routed or both transparent); mismatched modes are not supported. Option E is incorrect because stateful failover synchronization should remain enabled so that connections and state tables are replicated to the standby unit for seamless failover.

Answer

Configure the management interfaces to use DHCP so the standby unit can adopt the primary IP address.

Answer

Ensure both units are configured in different firewall modes (one routed, one transparent).

Answer

Disable stateful synchronization to improve failover switching speed.

Question 8

An administrator is preparing an upgrade plan for an FMC and its managed FTD devices. Which THREE best practices should be followed during the upgrade process to minimize downtime and avoid failure? (Choose three)

Accepted Answer

Take a complete backup of the FMC and export device configurations prior to starting the upgrade.. Option A is correct because taking a full FMC backup and exporting FTD configurations before any upgrade provides a rollback point if the upgrade fails or corrupts data, which is essential for minimizing downtime. Option B is correct because Cisco's upgrade best practice requires the FMC to be upgraded to the target version first, since a newer FMC can manage older FTD versions but an older FMC cannot manage newer FTD devices, avoiding management incompatibility. Option C is correct because running the pre-upgrade checker (e.g., via the FTD CLI or the FMC upgrade readiness check) identifies blockers such as unsupported configurations, insufficient disk space, or deprecated features before the upgrade begins. Option D is incorrect because factory resetting FTD devices after pushing an upgrade would erase the configuration and cause an outage, not minimize downtime. Option E is incorrect because the sftunnel is the management tunnel between FMC and FTD; disabling it permanently would break management and prevent the FMC from pushing the upgrade or policies, and it is not a valid upgrade practice.

Answer

Factory reset all FTD devices immediately after pushing the upgrade package.

Answer

Disable the sftunnel service permanently during the upgrade to prevent packet inspection.

Question 9

Which TWO protocols or mechanisms are used to integrate Cisco Identity Services Engine (ISE) with Cisco Secure Firewall Threat Defense? (Choose two)

Accepted Answer

SXP. Cisco ISE integrates with Secure Firewall using pxGrid (for identity/context sharing) and SXP (for SGT tag and IP mapping propagation).

Answer

NetFlow v5

Answer

LDAP direct bind

Answer

SNMPv1

Question 10

Which THREE steps are part of a standard FTD upgrade workflow managed via the FMC?

Accepted Answer

Upload the upgrade package to the FMC. Option C is correct because the standard FTD upgrade workflow managed through the FMC begins by uploading the FTD software upgrade package (image) to the FMC, which then stages it for deployment to managed devices. Option E is correct because after the package is available, the administrator selects the target device(s) in the FMC's Upgrade management page to initiate and schedule the upgrade. Option D is correct because the workflow includes running a readiness/health check on the device and reviewing and approving the resulting health check report before proceeding with the actual upgrade. Options A and B are incorrect: manually deleting all existing access rules is not a step in the upgrade workflow and would disrupt policy, and running a factory reset on the FTD is not part of a standard upgrade—it would wipe the configuration rather than upgrade the software.

Answer

Manually delete all existing access rules

Answer

Run a factory reset on the FTD

Question 11

An administrator is planning an upgrade of an FMC managing multiple FTD devices across various software versions. Which THREE factors must be validated according to Cisco compatibility guidelines before proceeding? (Choose three)

Accepted Answer

Supported upgrade paths (e.g., whether a direct jump from v6.4 to v7.4 is supported or requires an intermediate upgrade).. Option A is correct because Cisco upgrade planning requires verifying supported upgrade paths; for example, a direct jump from v6.4 to v7.4 may not be supported and may require an intermediate release such as v7.0 or v7.2 before reaching v7.4. Option B is correct because the upgrade process must have sufficient free space on FMC and FTD partitions, including /var and /root, so that downloaded packages and temporary files can be unpacked and staged without filling the filesystem. Option E is correct because the Cisco Firepower Compatibility Guide must be consulted to confirm that the target FMC software version interoperates with and supports the FTD versions currently managed by that FMC. Option C is not required because NTP stratum 1 is not a Cisco Firepower upgrade prerequisite; time synchronization matters, but the local NTP server does not have to be stratum 1. Option D is not required because the serial numbers of external power supplies are irrelevant to software compatibility and upgrade validation.

Answer

The local NTP server stratum level must be exactly stratum 1.

Answer

The serial number of the external power supplies attached to the rack mount chassis.

Question 12

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO fields or parameters can be included in the syslog output to facilitate incident investigation and event parsing by the SIEM? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automatic synchronization of dynamic Indicators of Compromise (IoCs) to block malicious traffic.. SecureX integration allows sharing indicators of compromise (IoCs) for automated blocking/alerting and pivoting to Threat Response for investigation.

Answer

Real-time firmware updates pushed from the SecureX cloud console to the managed firewalls.

Answer

Replacement of local FMC policy administration with cloud-only RBAC management.

Answer

Direct deployment of Snort 3 custom intrusion rules compiled locally on the SecureX cloud platform.

Question 13

Which THREE criteria can be used to match traffic within an Access Control rule on the FMC? (Choose three)

Accepted Answer

URL Categories. In Cisco FMC, an Access Control rule can match traffic using criteria such as URL Categories (C), which let you filter based on reputation or category of requested web destinations; Applications (D), which identify traffic by application or application group via Snort/App-ID; and Security Zones (E), which match the ingress/egress interfaces assigned to zones. These three are all valid match conditions on the rule's main criteria tabs. Intrusion Policy Signatures (A) are not a match criterion — an Intrusion Policy is an inspection action applied to traffic that already matched the rule. Device Platform Settings (B) are also not a match condition; platform settings are applied via a Platform Settings policy to managed devices, not used to select traffic in an access rule.

Answer

Intrusion Policy Signatures

Answer

Device Platform Settings

Question 14

An engineer needs to troubleshoot high CPU usage on an FTD device caused by Snort. Which THREE actions or features can be adjusted or implemented to mitigate Snort CPU load? (Choose three)

Accepted Answer

Configure SSL Decryption policies to bypass trusted internal traffic or known safe applications.. Option B is correct because SSL Decryption is one of the most CPU-intensive operations Snort performs; bypassing trusted internal traffic or known safe applications in the SSL policy prevents Snort from decrypting and inspecting that traffic, directly reducing CPU load. Option D is correct because the Intrusion Policy determines which Snort rules are evaluated, and disabling rules not applicable to the network environment reduces the number of signatures Snort must process per packet, lowering CPU utilization. Option E is correct because Access Control rules are evaluated top-down, and placing frequently matched allow rules higher with fewer inspection requirements (e.g., no intrusion or file inspection) lets traffic be allowed early with minimal Snort processing, reducing overall CPU demand. Option A is incorrect because converting physical interfaces to switchports without IP addresses is a Layer 2 deployment consideration and does not by itself reduce Snort CPU load. Option C is incorrect because disabling the FTD kernel and running Snort in standalone user-space loopback mode is not a supported or valid FTD configuration and would not mitigate CPU usage.

Answer

Convert all physical interfaces into switchports without IP addresses.

Answer

Disable the FTD kernel entirely and run Snort in standalone user-space loopback mode.

Question 15

Which TWO benefits are gained by integrating Cisco Secure Firewall with Cisco Identity Services Engine (ISE) using TrustSec SGTs? (Choose two)

Accepted Answer

Propagation of security tags across network boundaries via SXP for consistent enforcement. Option A is correct because integrating Cisco Secure Firewall with ISE via TrustSec uses SXP (SGT Exchange Protocol) to propagate Security Group Tags (SGTs) across network boundaries, allowing consistent policy enforcement even where inline tagging is not supported. Option B is correct because ISE supplies identity and group information (user roles, AD group membership) that maps to SGTs, so firewall rules can be written against security group tags instead of volatile IP addresses. Option C is incorrect because the firewall does not send quarantine commands directly to Active Directory; remediation is typically handled by ISE/pxGrid and endpoint tools, not AD. Option D is incorrect because TrustSec is a segmentation/policy framework and does not replace routing protocols such as OSPF or BGP. Option E is incorrect because access control rules are still required on the firewall; SGTs enrich and simplify them rather than eliminating them.

Answer

Automatic remediation of endpoint malware infections via direct quarantine commands sent from the firewall to Active Directory

Answer

Replacement of traditional routing protocols with TrustSec matrix routing

Answer

Elimination of the need for access control rules on the firewall

Question 16

An administrator integrates Cisco Secure Firewall with Cisco SecureX. Which TWO components or settings are required on the FMC to establish and maintain this cloud integration? (Choose two)

Accepted Answer

Valid API integration keys / credentials generated from the Cisco SecureX cloud management console and pasted into the FMC.. Option A is correct because integrating the FMC with Cisco SecureX requires generating API credentials (client ID and secret / API key) in the SecureX cloud portal and entering them on the FMC under the SecureX/Cloud Services registration, which authenticates the FMC to the cloud service. Option E is correct because the FMC management interface must reach the SecureX cloud endpoints over outbound HTTPS on TCP 443 for registration, token exchange, and ongoing telemetry/health updates. Option B is incorrect: eStreamer (TCP 8302) is a legacy event-streaming service used by other integrations, not the mechanism SecureX uses to poll the FMC. Option C is incorrect because SecureX integration uses REST APIs over HTTPS, not a direct SSH tunnel to the FTD data plane. Option D is incorrect because pxGrid is an ISE-based identity sharing framework and is not required on each managed FTD for SecureX cloud integration.

Answer

An active eStreamer daemon listening on TCP port 8302 for SecureX incoming connection polls.

Answer

A direct SSH tunnel between the FTD data plane and the SecureX cloud.

Answer

An active pxGrid session client on every managed FTD device.

Question 17

An administrator is performing health monitoring on an FMC appliance. Which TWO health monitors are available out-of-the-box in the FMC Health Monitor dashboard to track system resource utilization? (Choose two)

Accepted Answer

CPU Utilization. The FMC Health Monitor dashboard ships with a set of default, out-of-the-box monitors that focus on appliance-level system resources, and CPU Utilization (A) is one of them, tracking processor load on the FMC so administrators can detect performance degradation. Disk Utilization (B) is also a built-in monitor, reporting how full the FMC's disk partitions are, which is critical because a full disk can halt logging, event storage, and database operations. Both A and B are standard system-resource monitors present by default without any additional configuration. The other options do not belong: SSL Handshake Latency (C) is not a default FMC health monitor, SNMP Trap Queue Depth (D) is not an out-of-the-box FMC system-resource monitor, and BGP Peer Flap Counter (E) relates to routing protocol state rather than FMC appliance resource utilization.

Answer

SSL Handshake Latency

Answer

SNMP Trap Queue Depth

Answer

BGP Peer Flap Counter

Question 18

Which TWO protocols are commonly managed via Port objects in FMC?

Accepted Answer

UDP. TCP and UDP are the primary protocols managed via port objects.

Answer

ARP

Answer

IGMP

Answer

ICMP

Question 19

An administrator is setting up Cisco ISE pxGrid integration with Cisco Secure Firewall Management Center. Which TWO configuration steps must be performed on the Cisco ISE side to ensure successful integration? (Choose two)

Accepted Answer

Approve the FMC client registration request in the Cisco ISE pxGrid client management settings.. Option D is correct because pxGrid uses mutual certificate-based authentication, and when FMC first connects as a pxGrid client, its registration request must be approved by an ISE administrator under Administration > pxGrid Services > Client Management before the client can subscribe to or publish on the pxGrid bus. Option E is correct because the pxGrid persona is not enabled by default; the administrator must enable the pxGrid service on the appropriate ISE node (typically the PAN/MnT or a dedicated pxGrid node) under Administration > System > Deployment so the node can host the pxGrid controller and accept client connections. Option A is wrong because eStreamer is a Firepower/FSMC-side event-streaming service, not an ISE policy service node component. Option B is wrong because SNMPv2c traps are for monitoring/alerting and play no role in pxGrid integration. Option C is wrong because TACACS+ shared secrets are for device administration authentication, not for pxGrid, which relies on certificates rather than a shared secret.

Answer

Configure an eStreamer server instance on the ISE policy service node.

Answer

Enable SNMPv2c traps on the ISE administration node.

Answer

Export the ISE TACACS+ shared secret to the FTD CLI.

Question 20

Which TWO items must be defined to create a fully functional Network Object group in FMC?

Accepted Answer

Member Objects. A group needs a name and at least one member (object) assigned to it.

Answer

Object Description

Answer

SNMP Traps

Answer

Routing Table