300-710 SNCF Timed Practice Test 1 — 10 Questions

Question 1

Which protocol is natively used by Cisco Secure Firewall Management Center to stream connection and intrusion events to external SIEM systems in real time?

Accepted Answer

eStreamer. eStreamer is Cisco's proprietary protocol and API used for streaming security events from FMC to SIEMs.

Answer

HTTP SOAP

Answer

TFTP

Answer

NetFlow v9

Question 2

An engineer is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) in Google Cloud Platform (GCP). The architecture requires multiple network interfaces. How does GCP map these interfaces during deployment?

Accepted Answer

GCP allows multiple discrete NICs per instance, with nic0 assigned to management and subsequent NICs mapped to data subnets.. GCP allows multiple Network Interface Cards (NICs) on a single compute instance, where nic0 is typically assigned for management and subsequent nic1, nic2, etc., are assigned for data traffic.

Answer

GCP requires all data traffic to pass through an external HTTP(S) load balancer before reaching nic0.

Answer

GCP supports only a single interface per VM; all VLAN subinterfaces must be trunked through nic0.

Answer

GCP virtual machines cannot be managed by Cisco FMC; they require deployment via Google Deployment Manager only.

Question 3

When configuring ECMP (Equal-Cost Multi-Path) on FTD, what happens if one of the next-hop paths fails?

Accepted Answer

Traffic is automatically load-balanced across the remaining active paths.. FTD monitors the routes; if a path fails, the FTD removes that specific route from the routing table, and traffic is automatically redistributed across the remaining paths.

Answer

Traffic is dropped until manual intervention.

Answer

The entire cluster enters a maintenance mode.

Answer

All traffic is rerouted to the primary management interface.

Question 4

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO fields or parameters can be included in the syslog output to facilitate incident investigation and event parsing by the SIEM? (Choose two)

Accepted Answer

Precise timestamp formatting (UTC or local time) configured in Platform Settings. Option B is correct because the syslog timestamp format (UTC or local time) is configurable under Platform Settings > Syslog in FTD, and consistent, precise timestamps are essential for correlating events across the SIEM and establishing accurate incident timelines. Option D is correct because including the firewall device name or identifier in the syslog header lets the SIEM attribute each event to its originating sensor, which is critical in multi-device deployments for parsing, filtering, and investigation. The remaining options are not valid syslog fields: a full memory core dump (A) is a diagnostic binary artifact, not syslog content; FMC administrator SSH private keys (C) are credentials that must never be transmitted in logs; and raw PCAP data (E) is captured separately via packet capture tools and cannot be embedded as text in syslog messages.

Answer

Full memory core dump binary attachments

Answer

FMC administrator SSH private keys

Answer

Raw packet captures (PCAP) of dropped connections embedded in syslog text

Question 5

An administrator is integrating Cisco Secure Firewall Threat Defense with Cisco Identity Services Engine (ISE) using Platform Exchange Services (pxGrid). Which service must be enabled and running on the ISE nodes for pxGrid communication to succeed?

Accepted Answer

Cisco pxGrid Service. pxGrid must be enabled on the designated ISE nodes so that Cisco Secure Firewall Threat Defense can subscribe to user identity and session updates.

Answer

IPAM Synchronization Service

Answer

RADIUS Accounting Service

Answer

TACACS+ Authentication Service

Question 6

An administrator configures pxGrid integration between Cisco ISE and Cisco Secure Firewall Threat Defense. During the certificate enrollment process, the firewall fails to trust the ISE pxGrid node. What is the most likely root cause of this failure in a standalone FMC deployment?

Accepted Answer

The ISE pxGrid root CA certificate is not imported into the FMC trusted certificates store.. For pxGrid communication to establish successfully, the ISE pxGrid node certificate and FMC/Firewall pxGrid certificate must be signed by a mutually trusted Certificate Authority (CA), and the CA root certificate must be imported into the FMC trusted certificates store.

Answer

The SXP secret password does not match between ISE and the firewall.

Answer

The pxGrid subscriber profile on ISE was not approved within 24 hours.

Answer

RADIUS shared secrets are mismatched on the Policy Service Nodes.

Question 7

An administrator is troubleshooting a Prefilter Policy configured on an FMC. Which THREE actions are available when creating a rule in a Prefilter Policy? (Choose three)

Accepted Answer

Slow Path (send traffic through normal inspection pipeline). In an FMC Prefilter Policy, each rule can take one of three actions: Block, which drops matching traffic immediately without further inspection (option D); Fast Path, which bypasses the inspection pipeline and fast-forwards traffic (option E); and Slow Path, which sends traffic through the normal inspection pipeline for further analysis (option C). These three actions are the only ones available at the prefilter stage, which exists to reduce the load on the Snort inspection engine by handling traffic before it reaches the access control policy. Option A (Decrypt - Resign) is an SSL policy action, not a prefilter rule action, and option B (Inspect with Snort 3 Intrusion Prevention) is an access control rule action, so neither belongs in a Prefilter Policy rule.

Answer

Decrypt - Resign (intercept and re-sign SSL certificate)

Answer

Inspect with Snort 3 Intrusion Prevention

Question 8

What is the primary function of a 'Security Zone' in FMC?

Accepted Answer

To logically group interfaces. Security Zones allow applying the same policy to multiple interfaces at once.

Answer

To set bandwidth limits

Answer

To enable routing

Answer

To define IP ranges

Question 9

An engineer is configuring a QoS policy on an FMC-managed FTD and needs to police traffic to a maximum bandwidth limit on an interface. Which shaping/policing parameter must be configured?

Accepted Answer

Traffic Policing with specified Committed Information Rate (CIR). Traffic policing on FTD is configured via a QoS policy that enforces a maximum bandwidth limit using a Committed Information Rate (CIR). The CIR defines the average rate allowed, and traffic exceeding it is dropped or marked down, directly capping bandwidth. This is the standard mechanism for rate limiting on an interface in Cisco Secure Firewall, and it must be applied through the FMC QoS policy.

Answer

Prefilter FastPath Rate Cap

Answer

Access Control Rate Limiting action

Answer

Random Early Detection (RED) drop threshold

Question 10

Which TWO settings are available when configuring the 'Logging' tab in an Access Control Rule?

Accepted Answer

Log at End. In Cisco Firepower Management Center, an Access Control Rule's Logging tab lets you choose when to generate connection events for traffic matching the rule, and the two available timing settings are 'Log at Beginning' (option E) and 'Log at End' (option D). 'Log at Beginning' generates a connection event when the connection is first seen, which is useful for capturing attempted connections even if they are later blocked or never complete. 'Log at End' generates the event when the connection closes, providing full session details such as bytes sent/received and duration. 'Log to Cloud' (A) is not a logging-timing option in the Access Control Rule Logging tab, and 'Log every packet' (B) and 'Log at Middle' (C) are not valid settings for this tab.

Answer

Log to Cloud

Answer

Log every packet

Answer

Log at Middle