Cisco Securing Networks with Cisco Firewalls (300-710 SNCF, CCNP Security) (300-710 SNCF) (300-710 SNCF) — Questions 1–75

DNS translation rewrites A-record payloads inside DNS replies, so an external client querying an internal server's hostname receives the mapped public NAT address rather than the unreachable private IP. This satisfies the stem's requirement that DNS injection and rewriting accompany the manual NAT rule, keeping name resolution consistent with address translation.

System > Health > Monitor displays disk usage and other appliance health metrics, letting the administrator confirm whether sufficient free space exists for the upgrade image. This is the FMC location exposing storage consumption before initiating the software update.

The Deploy menu's Deployment page lists all pending policy and object changes staged on the FMC before they are pushed to managed FTD devices. Reviewing it lets the engineer audit unauthorised modifications prior to deployment, matching the requirement to inspect pending changes.

Within an access control rule, the Inspection tab allows you to select intrusion and malware policies. Enabling these options ensures that matching traffic is inspected by the chosen IPS and malware policies. This is the standard method to apply deep inspection in FTD access control.

The management interface on an FTD device is used for out-of-band management, including communication with FMC for policy deployment, logging, and health monitoring. It must be configured with an IP address, gateway, and DNS settings. Without a properly configured management interface, the FTD cannot register with FMC or receive policies.

The Default Action is the terminal rule applied when no earlier rule matches the packet, ensuring every connection receives a definitive verdict rather than being dropped implicitly. It satisfies the requirement that unmatched traffic still be handled by an explicit allow, block, or monitor decision.

Transparent mode forwards traffic without an IP address on the data interfaces, bridging frames at Layer 2 using destination MAC addresses inside a Bridge Group. This satisfies the requirement to pass frames between internal and external interfaces without routing or NAT.

Passive mode copies traffic for inspection without sitting inline, so packets never traverse the sensor. This satisfies the stem's requirement that deployment be non-disruptive to the forwarding path, since a failure of the NGIPS cannot break connectivity.

Custom Network/IP Lists are administrator-defined objects holding specific addresses or ranges, uploaded directly to the FMC. They populate Security Intelligence blacklists without relying on external reputation services, satisfying the requirement for locally controlled, static blocklists in this scenario.

An Identity Policy in FMC binds users to realm and group attributes, then maps those identities to specific access control policies. Group membership from Active Directory therefore determines which security policy each internal user receives.

Routed mode allows the FTD to act as a Layer 3 device, performing routing, NAT, and policy enforcement between networks. It is the standard mode for inter-network traffic that requires IP address translation and access control, making it the correct choice for this scenario.

Transparent mode places the FTD as a Layer 2 bridge, so it forwards traffic based on MAC addresses without altering IP addressing or routing. A bridge group binds the interfaces into a logical bridge, allowing inspection of traffic between the two segments while remaining invisible at Layer 3, which matches the requirement exactly.

VMXNET3 is a paravirtualised adapter designed for VMware, delivering higher throughput and lower CPU overhead than emulated E1000 or flexible adapters. It satisfies the stem's optimal-performance constraint for an FTD virtual appliance on ESXi, where inspection throughput depends heavily on efficient packet handling.

The cluster control link carries heartbeat health checks plus stateful failover traffic — connection state tables and configuration synchronisation — between cluster members. Continuous heartbeats over this dedicated link let each unit detect peer failure, so a node cannot unilaterally assume active status and cause a split-brain condition.

Transparent mode operates as a Layer 2 bridge, forwarding frames without participating in IP routing, so the Threat Defense device can sit inline within an existing subnet while endpoints retain their current default gateway. This directly satisfies the requirement to avoid redesigning gateway or routing configurations during insertion.

Dynamic PAT using the outside interface address allows many inside hosts to share the single dynamic ISP address, which matches the scenario. Manual NAT rules can be added later for static translations, and the automatic NAT rules handle the general inside-to-outside traffic without conflicting.

The Monitor action logs and evaluates traffic against the rule without blocking it, so you can observe what the rule would have denied while production traffic continues unaffected. This satisfies the requirement to test the Access Control Rule without impacting production.

Cisco ISE supplies IP-to-user mappings for remote access VPN sessions through RADIUS Accounting and pxGrid, which the User Agent alone cannot capture because it only passively monitors Active Directory logins. Integrating ISE satisfies the requirement to resolve VPN users' identities, enabling the Identity Policy to enforce user-based access control.

In routed mode the FTD acts as a Layer 3 hop, so it needs a default or static route pointing to the next-hop gateway to forward traffic off its connected subnets; without it, packets destined beyond directly attached networks are dropped.

State synchronisation between HA peers requires an isolated Layer 2 path, so the dedicated failover/state link carries only failover hello and stateful replication traffic. Mixing this with data or management interfaces risks asymmetric replication and split-brain, so the stem's strict reservation is satisfied only by this dedicated link.

The Zones tab defines source and destination security zones for traffic matching the rule, satisfying the requirement to scope the policy by zone. Zones map interfaces to trust levels, so specifying them here controls which network segments the rule inspects, unlike Applications or Ports tabs which filter by service and protocol.

LACP requires at least one side to initiate negotiation. Configuring both peers as active, or one active and the other passive, forms the port channel; if both sides are passive, no LACPDUs are sent and the EtherChannel never negotiates.

The failover link carries state and health information between HA peers. It can be a dedicated physical interface or a VLAN subinterface on an existing data interface. This separation ensures that failover traffic does not compete with data traffic and is isolated for reliability. Using a dedicated link or VLAN is a requirement for proper HA operation.

This allows the traffic to pass through the firewall without SSL inspection.

FMC configuration backups are version-specific: the restore process validates the backup against the appliance's software build, and mismatched versions or patch levels cause restoration to fail or corrupt the configuration database. Matching the source's exact version and patch level is therefore a mandatory precondition.

Physical link lights and cable integrity confirm the layer 1 path on the dedicated failover interfaces. A failed LED or damaged cable breaks the failover link regardless of configuration, so this check isolates physical faults before investigating logical causes.

Connection Events in the FMC analyse view record each flow's allow or block decision, the matching access control rule and the drop reason, directly revealing why traffic was denied. This satisfies the stem's need to identify the cause of drops.

Snort Statistics under Device Management exposes per-instance CPU, packet and rule metrics plus rule update status, letting the administrator pinpoint whether high utilisation stems from rule load or traffic. This satisfies the first-line investigation requirement without disrupting traffic.

In Distributed mode, every cluster member actively processes traffic rather than concentrating flows on a single owner, spreading load across all nodes. This satisfies the scenario's requirement that processing is not centralised on one unit.

Stateful failover replicates the inspection state table, but dynamic NAT translations are synchronised separately. With NAT sync disabled, the standby lacks the translation entries, so returning packets for long-lived TCP flows cannot be untranslated and the connections drop after failover.

The Control Plane IP provides a single, stable management endpoint for the whole cluster, so the FMC registers and manages the cluster as one logical device rather than individual member units. Data Plane IPs handle traffic, while this address carries management and cluster control traffic.

A CIDR network object accepts an address plus prefix length, defining an entire subnet such as 10.10.0.0/24 in one entry. This satisfies the stem's requirement for populating FMC objects, since CIDR notation efficiently represents whole networks rather than listing individual host addresses.

Static NAT is one of the three Type values offered by the NAT Rule editor, giving a fixed one-to-one mapping between an original and translated address. It satisfies the stem because the editor presents it as a selectable rule type, not a separate policy setting.

Correct, this page has the search functionality.

In FMC, the Analysis > Users page displays user identity information learned from ISE via pxGrid. It shows usernames, IP addresses, and other session details. This is the correct place to verify that identity data is being received and mapped correctly.

Cisco Secure Firewall evaluates NAT rules sequentially and applies the first rule whose match criteria the traffic satisfies, then stops processing further NAT rules. Rule order therefore determines the outcome, so overlapping rules must be arranged with the most specific entries placed above broader ones.

QoS on FTD is applied through a dedicated QoS Policy, separate from access control and other policy types. Creating one and attaching it to the relevant access control policy lets you rate-limit guest traffic, satisfying the bandwidth restriction the requirement demands.

Access Control Policies are created and managed under the Policies menu in the FMC UI, where the Access Control sub-item lists existing policies and offers the New Policy action. This path satisfies the requirement to create a new policy rather than edit an existing one.

eStreamer enforces mutual TLS: the FMC server validates a client certificate before streaming any events. Without a generated client certificate and its pkcs12 password configured under eStreamer, the TLS handshake fails and the FMC immediately resets the connection, satisfying the stem's reset symptom.

In Active/Standby Threat Defense, interface monitoring tracks designated interfaces; when failures exceed the configured failure threshold count, the standby unit assumes the active role. This satisfies the stem's requirement for an automatic failover trigger, unlike a single transient interface blip.

OSPF on Cisco Secure Firewall Threat Defense requires three distinct steps: global process enablement, area association, and interface-level activation. Because routed interfaces bound to security zones only participate once OSPF is enabled on them, all three are mandatory for dynamic routing across zones.

SXP carries SGT-to-IP mappings across network devices that cannot perform inline tagging, propagating group metadata between Cisco Secure Firewall Threat Defense and intermediate routers. This directly satisfies the stem's constraint of exchanging SGT metadata where inline tagging is unsupported.

GigabitEthernet0/0 serves as the dedicated management interface on a virtual FTD, carrying administrative traffic such as SSH, HTTPS, and the FDM or FMC registration channel. This satisfies the stem's constraint by separating out-of-band management from data-plane interfaces, so device administration remains reachable independently of inspected traffic.

URL categories are populated by the URL filtering database, which requires a valid URL Filtering licence to be installed and active on the firewall. Without that licence, category-based matching is unavailable, so the Access Control Rule cannot reference URL categories as match criteria.

Firepower Management Center is the only component that provides centralised policy, event and device management across multiple FTD appliances. Distributed deployments require FMC to push unified access control, intrusion and malware policies to every managed device, satisfying the stem's mandatory central management constraint.

FTD HA requires a dedicated failover link carrying hello, stateful failover and role-election traffic between peers. Configuring that interface and its IP addressing during initial setup is mandatory; without it the pair cannot form or synchronise state.

Inline inspection maintains per-flow state, so both directions of a TCP session must traverse the same device. Asymmetric routing breaks this, causing dropped or reset connections; the constraint is that flow symmetry must be preserved across the inline pair.

Access Control Policies are processed top-down, first-match-wins, so reordering rules alters which rule matches a given packet first. Moving a permit above a deny, or vice versa, therefore changes the evaluation sequence and the resulting action.

Applying an IPS policy to an Access Control Rule activates the intrusion prevention engine on traffic matching that rule, enabling deep packet inspection of the permitted flows. The policy inspects packet payloads against signatures and blocks malicious activity inline, satisfying the requirement to detect and prevent exploits within allowed connections.

FTDv runs as a virtual machine on ESXi, delivering the same unified NGFW/NGIPS feature set in virtualised form. This satisfies the deployment-method requirement by using a supported hypervisor rather than dedicated hardware, enabling flexible placement in virtualised data centres.

TLS encryption protects syslog payloads from interception and tampering as they traverse untrusted networks, directly satisfying the stem's secure-transmission constraint. Standard syslog sends cleartext over UDP, exposing sensitive firewall event data; wrapping the transport in TLS provides confidentiality and integrity for messages sent to the remote SIEM.

In pxGrid integration, the FMC must subscribe to specific topics to receive user identity and session information. If the subscriptions are missing or incorrect, the FMC will not receive the data even if connectivity and certificates are valid. The administrator should verify that the FMC is subscribed to topics like com.cisco.ise.session and com.cisco.ise.identity. This is a common oversight during integration.

Changes to the Access Control Policy remain in a draft state until committed to the managed devices. Clicking Deploy pushes the edited policy to the firewalls, so the new rules take effect; saving alone leaves the previous policy running.

Traffic policing enforces a maximum bandwidth by dropping or marking excess packets, and requires a Committed Information Rate defining the allowed average rate. This satisfies the stem's requirement to cap traffic at a maximum bandwidth limit on the interface.

Registering FMC with SecureX and enabling eventing publishes security events and context to the SecureX platform, where indicators and affected endpoints can be correlated with other telemetry. This is the supported integration that provides the visibility the team wants. Without the SecureX registration, FMC events remain local to the management center.

Without an intrusion policy bound to the access control rule, the FTD performs no intrusion inspection, so no intrusion events are generated for eStreamer to forward. The connection succeeds, but the event stream stays empty because the missing policy assignment, not transport, is the constraint.

The configure manager add command on the FTD CLI supplies the management center address and a registration key, which allows the device to initiate the registration handshake. This is the required first step before the management center can discover and add the device.

A Security Group object references a Security Group Tag, so the rule matches traffic by the SGT value carried in the packet rather than by IP address, subnet, or interface. This satisfies the requirement to enforce policy based on SGT.

The Control Link is the dedicated interface over which the master and slave units exchange state and configuration data, satisfying the requirement for control plane communication in an FTD cluster. It carries heartbeat and synchronisation traffic, distinct from the data and replication links, ensuring cluster state stays consistent across units.

Object Management in FMC stores reusable definitions such as network, port, URL and geolocation objects, which policies then reference. This satisfies the requirement to create reusable objects rather than duplicating values across access control rules.

In FTD HA, a dedicated failover link is required to exchange heartbeat and state information between the active and standby units. This link must be configured on both devices and cannot be used for regular data traffic. It ensures rapid detection of failures and coordination of failover events.

Hardware bypass pairs use an external bypass switch that physically bridges the two inline interfaces when the FTD software process or power fails, so traffic keeps flowing without inspection. This directly satisfies the stem's requirement for uninterrupted traffic during software failure, which software-based fail-to-wire cannot guarantee.

Passive mode satisfies the stem's no-blocking constraint because the FTD interfaces receive copies of traffic rather than sitting inline, so packets are analysed and events generated without any forwarding decision or drop action. Unlike inline sets or routed modes, it cannot interrupt flows, making it ideal for pure monitoring.

Cancelling the stuck task in FMC Task Monitor releases the deployment lock held on the FTD, allowing the pending configuration to be cleared and redeployed cleanly. This directly addresses the locked deployment file and hung 'Applying' state described in the stem.

A security zone is a logical grouping that can contain multiple interfaces, including physical ports, subinterfaces, and EtherChannels. Grouping them lets one zone apply consistent policy to several interfaces, satisfying the rule that zones aggregate interfaces.

ASP drops occur in the accelerated security path and are invisible to standard packet traces. The capture drop type asp-drop all command captures packets dropped by the ASP in real time, exposing the exact drop reason, which satisfies the stem's need to diagnose silent drops.

ISE acts as the identity source, publishing user-to-IP mappings and group memberships to the firewall over pxGrid. This lets the firewall enforce identity-based policy rather than relying solely on IP addresses, which is the integration's core purpose.

Transparent mode uses a bridge group virtual interface (BVI) to forward traffic at Layer 2 without altering IP headers. Assigning physical interfaces to the bridge group and adding VLAN subinterfaces allows the device to bridge multiple VLANs transparently, meeting both requirements.

Exceeding a QoS policy's Rate Limit causes the policer to drop or remark excess packets beyond the committed rate, keeping traffic within the configured class limit. Policing, rather than shaping or queuing, is the action applied to out-of-profile traffic.

A routed interface is a Layer 3 interface assigned an IP address, supporting static routes, dynamic routing protocols and NAT, which ISP handoffs require. It satisfies the ISP connectivity requirement because the FTD must route traffic between the internet-facing link and internal networks, unlike a transparent Layer 2 interface.

An Intrusion Policy is bound to a specific Access Control rule via its Inspection tab, so the policy is evaluated only for traffic matching that rule's conditions. This scopes intrusion detection to the vulnerability signatures the administrator wants.

Fv in AWS supports both Smart Licensing bring-your-own-licence and Pay-As-You-Go purchased through the AWS Marketplace. BYOL suits existing entitlements, while PAYG bills hourly through AWS, satisfying the throughput and feature-activation licensing requirement for cloud deployment.

UDP and TCP are both natively supported for syslog export from Cisco Secure Firewall Threat Defense, satisfying the stem's requirement for transport layer protocols. UDP provides connectionless, fire-and-forget delivery, while TCP adds reliable, connection-oriented transmission with acknowledgement, letting you choose based on SIEM reliability needs.

UDP is a transport-layer protocol identified by port numbers, so FMC represents it as a Port object for use in access control rules. Port objects pair the protocol with the relevant port or range when defining policy.

TCP 8910 is the registered pxGrid port used for secure publish-subscribe communication between Cisco ISE and the Firepower Management Center. Allowing it through the intermediate firewall satisfies the stem's requirement for pxGrid traffic, since the alternative ports serve unrelated services such as STOMP messaging or web administration.