300-710 SNCF Timed Practice Test 3 — 10 Questions

Question 1

Which THREE criteria can be used to match traffic within an Access Control rule on the FMC? (Choose three)

Accepted Answer

URL Categories. Access Control rules support matching based on Networks, Ports, Applications, URL categories, Users, and Zones.

Answer

Intrusion Policy Signatures

Answer

Device Platform Settings

Question 2

An administrator wants to create a Port object group containing TCP ports 80, 443, and 8080 on the FMC. Where is this object configured?

Accepted Answer

Objects > Object Management > Ports. Port object groups and individual ports are created under Objects > Object Management > Ports.

Answer

Policies > Access Control > Ports

Answer

Devices > Device Management > Object Explorer

Answer

System > Configuration > Port Groups

Question 3

An administrator needs to create a Geolocation object in the FMC to block traffic originating from a specific country. Where is this object used?

Accepted Answer

In Access Control rules under the Networks tab as Country objects. Geolocation objects are used directly within Access Control rules under the Source/Destination Country criteria.

Answer

In manual NAT rules under Original Source

Answer

In Identity policies to restrict user login locations

Answer

In Prefilter policies under Geo-FastPath

Question 4

An engineer wants to group several FTD interfaces into a single logical zone to simplify Access Control rule creation. Where are security zones created in the FMC?

Accepted Answer

Objects > Object Management > Security Zones. Security zones are created under Objects > Object Management > Security Zones.

Answer

System > Integration > Security Zones

Answer

Policies > Access Control > Zones

Answer

Devices > Device Management > Interfaces > Zones

Question 5

An administrator needs to configure Active Authentication using a captive portal on an FTD device. Which firewall feature must be properly configured and running to present the authentication prompt to users?

Accepted Answer

HTTP/HTTPS Response Page and Authentication Certificate configuration. Captive portal active authentication requires an HTTP/HTTPS response server configuration on the FTD to intercept unauthenticated HTTP sessions and prompt for credentials.

Answer

Prefilter Bypass rule with SSL Resign

Answer

SNMPv3 trap notification server

Answer

Platform Settings AAA server group for SSH/Telnet

Question 6

An administrator is configuring manual NAT on an FTD device managed by FMC. Which TWO parameters must be defined when creating a manual NAT rule? (Choose two)

Accepted Answer

Original Source. Manual NAT rules require defining the NAT type (Static or Dynamic) and the Original Source (along with other matching parameters like interfaces or destination).

Answer

Prefilter FastPath action

Answer

Security Intelligence Whitelist

Answer

Snort Inspection Engine Mode

Question 7

Which THREE actions can be assigned to an individual rule within an Access Control Policy on the FMC? (Choose three)

Accepted Answer

Allow. Access Control rules support actions such as Allow, Block, Interactive Block, Trust, and Monitor.

Answer

Decrypt

Answer

FastPath

Question 8

When editing an Access Control Rule, which action allows you to drop traffic while simultaneously sending a TCP RST to the client?

Accepted Answer

Block with Reset. The 'Block with Reset' action drops the connection and sends a reset packet to notify the sender.

Answer

Interactive Block

Answer

Block

Answer

Trust

Question 9

You have a large number of NAT rules. How does the FTD process them?

Accepted Answer

Top-down. NAT rules are processed in a top-down order until the first match is found.

Answer

Bottom-up

Answer

Specific to General

Answer

Alphabetical

Question 10

What is the result of applying an 'IPS Policy' to an Access Control Rule?

Accepted Answer

It enables deep packet inspection. The IPS policy enables deep packet inspection for the traffic matched by the rule.

Answer

It bypasses decryption

Answer

It blocks traffic based on IP

Answer

It disables the rule