Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.
Start Scenario PracticeAn administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO fields or parameters can be included in the syslog output to facilitate incident investigation and event parsing by the SIEM? (Choose two)
Explanation: Option B is correct because the syslog timestamp format (UTC or local time) is configurable under Platform Settings > Syslog in FTD, and consistent, precise timestamps are essential for correlating events across the SIEM and establishing accurate incident timelines. Option D is correct because including the firewall device name or identifier in the syslog header lets the SIEM attribute each event to its originating sensor, which is critical in multi-device deployments for parsing, filtering, and investigation. The remaining options are not valid syslog fields: a full memory core dump (A) is a diagnostic binary artifact, not syslog content; FMC administrator SSH private keys (C) are credentials that must never be transmitted in logs; and raw PCAP data (E) is captured separately via packet capture tools and cannot be embedded as text in syslog messages.
An administrator is troubleshooting a Prefilter Policy configured on an FMC. Which THREE actions are available when creating a rule in a Prefilter Policy? (Choose three)
Explanation: In an FMC Prefilter Policy, each rule can take one of three actions: Block, which drops matching traffic immediately without further inspection (option D); Fast Path, which bypasses the inspection pipeline and fast-forwards traffic (option E); and Slow Path, which sends traffic through the normal inspection pipeline for further analysis (option C). These three actions are the only ones available at the prefilter stage, which exists to reduce the load on the Snort inspection engine by handling traffic before it reaches the access control policy. Option A (Decrypt - Resign) is an SSL policy action, not a prefilter rule action, and option B (Inspect with Snort 3 Intrusion Prevention) is an access control rule action, so neither belongs in a Prefilter Policy rule.
Which TWO settings are available when configuring the 'Logging' tab in an Access Control Rule?
Explanation: In Cisco Firepower Management Center, an Access Control Rule's Logging tab lets you choose when to generate connection events for traffic matching the rule, and the two available timing settings are 'Log at Beginning' (option E) and 'Log at End' (option D). 'Log at Beginning' generates a connection event when the connection is first seen, which is useful for capturing attempted connections even if they are later blocked or never complete. 'Log at End' generates the event when the connection closes, providing full session details such as bytes sent/received and duration. 'Log to Cloud' (A) is not a logging-timing option in the Access Control Rule Logging tab, and 'Log every packet' (B) and 'Log at Middle' (C) are not valid settings for this tab.
Which TWO of the following are benefits of using a Port Channel on an FTD?
Explanation: Option A is correct because a Port Channel (EtherChannel/LACP or static) bundles multiple physical interfaces into one logical interface, so if a member link fails, traffic continues over the remaining links, providing link redundancy without a topology change. Option E is correct because the bundled member links share traffic through the hashing algorithm, so the logical interface's throughput is the aggregate of its members, increasing total available bandwidth beyond a single link. Options B, C, and D are not benefits of a Port Channel: it does not inherently reduce latency, it does not eliminate spanning tree (STP still runs on the logical bundle and the FTD still participates in loop prevention), and it has nothing to do with automatic NAT mapping, which is a separate FTD NAT policy function.
An administrator wants to ensure that all security event logs from Cisco Secure Firewall Threat Defense are exported reliably and in real time to external security analytics tools. Which TWO deployment and configuration practices should be implemented? (Choose two)
Explanation: Option B is correct because configuring Reliable Syslog in FTD Platform Settings uses TCP with TLS (port 6514 by default) to provide encrypted, connection-oriented, acknowledged delivery of syslog events, which prevents log loss and satisfies the requirement for reliable, real-time export to external analytics tools. Option D is correct because eStreamer on the FMC streams intrusion, connection, malware, and other security events in near real time to a SIEM collector over a persistent TLS connection, which is the Cisco-recommended method for feeding external security analytics platforms. Option A is wrong because local disk storage with weekly manual SCP exports is neither real-time nor reliable, and risks losing events if the disk fills or the device fails. Option C is wrong because disabling the Snort engine would stop intrusion event generation entirely and does not address log transport. Option E is wrong because SNMPv1 traps only carry event counters and are unencrypted, unacknowledged, and not designed for streaming detailed security event logs.
+15 more scenario questions available
Practice all Select Two (Multi-Select) QuestionsMulti-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination. These appear throughout the 300-710 SNCF and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the 300-710 SNCF. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free 300-710 SNCF scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Select Two (Multi-Select) Questions session with instant scoring and detailed explanations.
Start Scenario Practice →