300-710 SNCF Quick Quiz — 10 Questions

Question 1

You are configuring SSL decryption. To ensure that traffic to a specific financial domain is NOT decrypted due to privacy regulations, what must you configure in the SSL Decryption Policy?

Accepted Answer

Configure an SSL rule with the 'Do Not Decrypt' action. The 'Do Not Decrypt' action is used in SSL policies to bypass inspection for specific URLs or categories.

Answer

Use a 'Monitor' action in the SSL policy

Answer

Create an Access Control Rule with a 'Decrypt' action

Answer

Add the domain to the Prefilter Policy

Question 2

An administrator is configuring a Manual NAT rule in the FMC for an internal server that needs to be accessed from the outside zone. The internal IP is 192.168.1.50, and it must be translated to a public IP 203.0.113.10. Which TWO configuration parameters must be specified when defining this Manual NAT rule? (Choose two)

Accepted Answer

Original Source. Manual NAT rules require defining the Source Interface (original source zone/interface), Destination Interface (translated destination zone/interface), Original Source IP, and Translated Source IP.

Answer

Interface PAT (PAT Pool)

Answer

ARP Inspection Profile

Answer

DNS Resolution Option

Question 3

Which type of object is best suited for defining a web server's public-to-private NAT mapping?

Accepted Answer

Network object (Host). A Host object representing the specific server IP is required for precise Static NAT mapping.

Answer

VLAN object

Answer

Port object

Answer

Network object (Group)

Question 4

How do you ensure that a specific host object is only used in a specific interface?

Accepted Answer

Use an Interface Object. By using the 'Interface Objects' feature in FMC, you can restrict where a network object is valid.

Answer

Use a VLAN group

Answer

Use a Security Zone

Answer

Use a Port object

Question 5

An administrator is configuring a new Access Control Policy on the Firepower Management Center and needs to add a rule that blocks peer-to-peer file sharing applications regardless of port. Which rule type should the administrator select?

Accepted Answer

Access control rule. Access Control Rules of type Access are used to allow, block, or inspect traffic. To block applications regardless of port, the administrator uses the Applications tab within an Access rule.

Answer

NAT rule

Answer

Identity rule

Answer

Prefilter rule

Question 6

An administrator is setting up a new Cisco Firepower Threat Defense device and needs to configure platform-level parameters using FMC Platform Settings. Which TWO features can be configured via Platform Settings? (Choose two)

Accepted Answer

SNMP parameters. Platform Settings manage device-level settings such as Syslog/logging configuration, SNMP, Time Synchronization (NTP), and Banner settings. Access Control Policies and NAT are configured elsewhere.

Answer

SSL Decryption Certificate assignment

Answer

Network Address Translation (NAT)

Answer

Access Control Policy rules

Question 7

Which THREE settings can be configured within a Prefilter Policy on the FMC? (Choose three)

Accepted Answer

FastPath action to bypass Snort inspection. Prefilter policies support FastPath, Tunnel rules, and Default Actions (Analyze or FastPath).

Answer

Intrusion Policy signature tuning

Answer

Security Intelligence block lists

Question 8

Which THREE components of an Access Control rule can be used to identify traffic as 'Application' based?

Accepted Answer

Application Category. Applications are identified by the App-ID engine, which uses signatures, categories, and tags.

Answer

Device Type

Answer

OS Version

Question 9

An enterprise requires FTD to decrypt outbound SSL/TLS traffic so internal users visiting external websites can be inspected by Snort for malware. Which policy and action combination must be configured?

Accepted Answer

SSL/TLS Decryption Policy with Decrypt - Resign action. Outbound SSL decryption requires an SSL/TLS Decryption Policy with a 'Decrypt - Resign' action using an internal subordinate CA certificate.

Answer

Prefilter Policy configured with SSL Bypass

Answer

SSL/TLS Decryption Policy with Decrypt - Inbound action

Answer

Access Control Policy with Malware Inspection enabled and no SSL policy

Question 10

An administrator needs to create a variable set to define specific port or network variables used within Intrusion Rules. Where are variable sets managed in the FMC?

Accepted Answer

Objects > Object Management > Variable Sets. Variable sets are managed under Objects > Object Management > Variable Sets.

Answer

Devices > Device Management > Variables

Answer

System > Localized Variables

Answer

Policies > Access Control > Variables