478 questions total · 7pages · All types, answers revealed
When creating a network object in FMC, which field allows you to define a group of IP addresses using CIDR notation?
Network allows defining an IP block using CIDR.
Why this answer
The Network object type allows single hosts, ranges, or subnets using CIDR notation.
An administrator needs to deploy an FTD in inline mode for IPS functionality but must ensure that the traffic remains uninterrupted if the software process fails. Which feature should be enabled?
Hardware bypass allows traffic to pass through the interface pair physically if the system is down.
Why this answer
The fail-open feature (hardware bypass) on supported FTD interfaces ensures that traffic continues to flow even if the FTD software fails or reboots.
Which FTD deployment mode is best suited for an environment where the device should monitor traffic without performing any blocking or dropping actions?
Passive mode only receives copies of traffic for analysis.
Why this answer
Passive mode is specifically designed for monitoring traffic via a SPAN or TAP port without impacting traffic flow.
An administrator is deploying Cisco Secure Firewall Virtual in a Microsoft Azure environment using automated templates. The deployment requires multiple network interfaces for management, internal, and external zones. How does Azure assign IP configurations to these virtual network interfaces (NICs)?
Azure VNets provide IP addresses via DHCP to the guest OS interfaces, which are mapped inside the firewall configuration.
Why this answer
Azure allocates private IP addresses from the Azure Virtual Network (VNet) subnet via DHCP to the virtual machine's NICs, which must then match the interface configuration defined in the firewall deployment template.
An FTD high-availability pair is experiencing split-brain behavior due to a unidirectional failure of the state and heartbeat links. As a result, both units are claiming to be Active. Which CLI command on the FTD should an administrator use to troubleshoot interface failover status and verify interface health across the failover link?
'show failover' provides detailed status on unit roles, mate status, state links, and interface health.
Why this answer
To check failover status and health on an FTD device, administrators use the diagnostic CLI command 'show failover' or 'show failover history'.
An engineer deploys an Access Control Policy change from the FMC to a managed FTD device. The task hangs in the Deployment History with a status of 'Applying' for an extended period. Upon checking the FTD CLI, the engineer notices a locked deployment file or stuck process. What action should be taken to clear or restart the deployment process safely?
The Task Monitor allows administrators to cancel stuck tasks, and checking pending changes prevents duplicate deployment locks.
Why this answer
If a deployment hangs, administrators can check deployment status, cancel or restart the deployment daemon (sfims) or use the task manager in FMC to cancel the task. On the FTD, checking the deployment status or restarting management services may be required.
An administrator is configuring security zones on a Cisco Secure Firewall Threat Defense. Which TWO rules regarding security zones and interface assignments are correct? (Choose two)
Security zones can aggregate multiple interfaces for unified policy application.
Why this answer
Security zones can contain multiple interfaces, but a single physical or logical interface can only belong to one security zone at a time.
An administrator notices that health alerts from managed FTD devices are not appearing in the FMC health monitor, although traffic logs are updating normally. Which service or daemon on the FMC is primarily responsible for collecting and processing health and performance metrics from managed devices?
The healthd daemon on FMC is responsible for collecting, aggregating, and processing health monitor data from managed devices.
Why this answer
The sftunnel daemon manages communication between FMC and FTD for control traffic, while specific health daemons handle metrics. Specifically, the 'healthd' process on FMC processes health monitoring data.
Which tab in the FMC Object Manager allows you to manage pre-defined objects?
Shows system-provided objects.
Why this answer
FMC provides a list of pre-defined objects under the 'Network' or 'Port' categories; you can filter for 'System' objects.
An administrator needs to troubleshoot an issue where legitimate traffic is being silently dropped by the FTD device. The standard packet trace does not reveal the exact reason. Which command executed on the FTD CLI is best suited to diagnose accelerated security path (ASP) drops in real time?
Capturing type asp-drop all on the FTD CLI allows the firewall to intercept and display packets dropped by the ASP mechanism along with the specific drop reason string.
Why this answer
The command 'capture drop type asp-drop' or monitoring ASP drop counters using 'show asp drop' helps identify packets dropped by the accelerated security path due to ACLs, spoofing, or exhausted resources.
When configuring the integration between Cisco Secure Firewall and Cisco ISE via pxGrid, what is the primary role of Cisco ISE in this architecture?
ISE provides rich identity and context via pxGrid to enrich firewall policies.
Why this answer
Cisco ISE acts as the source of truth for user identity, endpoint posture, and contextual metadata, sharing it with the firewall via pxGrid.
An organization is planning to deploy a Cisco Secure Firewall Threat Defense Cluster using three Secure Firewall 9300 security modules to handle a massive aggregate throughput requirement. Which consideration is critical when designing this cluster?
Clustering requires uniform hardware models and matching interface configurations across all cluster members.
Why this answer
In a firewall cluster, one unit is automatically elected as the control node, while the others act as data nodes. All units share a common configuration and distributed connection table, but session handling is managed across the cluster nodes via a central cluster control link.
You are configuring a NAT rule on an FTD device managed by FMC. You need to translate the source IP of internal hosts to a specific public IP address when they access the internet. Which NAT type must be selected in the FMC NAT Rule editor?
Dynamic NAT is the correct selection for source translation from a group of internal hosts.
Why this answer
Dynamic NAT allows mapping a range of internal addresses to a single or range of public addresses, typically used for internet access.
When configuring a QoS policy, what happens if you exceed the 'Rate Limit' set for a traffic class?
Policing discards traffic exceeding the threshold.
Why this answer
Traffic exceeding the rate limit is policed (dropped or shaped).
Which TWO FTD interface types are commonly used for connectivity to an ISP?
Standard for ISP connections.
Why this answer
Routed interfaces are standard for ISP connectivity, often using sub-interfaces for VLAN-based segmenting.
Intrusion policies contain the rule states and alert actions, including syslog notification configuration.
Why this answer
Intrusion event alerting via syslog in FMC is configured by navigating to Policies > Access Control > Intrusion, editing the intrusion policy, and configuring the alert destination settings or global alert responses.
Which Cisco SecureX component acts as the central pivot point for threat investigations across Cisco Secure Firewall, Cisco Secure Endpoint, and third-party security tools?
Cisco Threat Response (integrated into SecureX) provides the pivoting and threat investigation engine across products.
Why this answer
Cisco SecureX (or Cisco XDR) provides a cloud-native platform that unifies visibility and enables pivoting across security products.
Which TWO methods can be used to identify users in an Identity Policy?
Active auth via browser.
Why this answer
Passive (ISE/AD) and Active (Captive Portal) are the main identification methods.
An administrator wants to configure an Access Control rule that triggers an Intrusion Policy only when specific vulnerability signatures match. Where is the Intrusion Policy assigned?
An individual Access Control rule allows assigning a specific Intrusion Policy under its Inspection tab.
Why this answer
Intrusion policies are assigned to Access Control rules under the Inspection tab or as the default intrusion policy for the access control policy.
An administrator wants to configure automated backup generation on the FMC and ensure that backup archives are securely offloaded to a remote server. Where is this configured in the FMC GUI?
Backup schedules, manual backup generation, and remote storage locations are managed under System > Tools > Backup / Restore.
Why this answer
System > Tools > Backup/Restore allows administrators to configure scheduled automated backups and define remote storage locations such as SFTP servers.
An administrator is deploying a Cisco Secure Firewall Virtual (Fv) appliance in an Amazon Web Services (AWS) environment. Which licensing model is typically supported for traffic throughput and feature activation during this cloud deployment?
AWS and Azure deployments support both BYOL (Smart Licensing) and PAYG billing models.
Why this answer
Cisco Secure Firewall Virtual supports both Bring Your Own License (BYOL) using Smart Licensing and Pay-As-You-Go (PAYG) directly from cloud marketplaces.
An administrator is reviewing the health of the Cisco Secure Firewall Management Center integration with Cisco SecureX. Which TWO methods can be used to verify that the integration is functioning properly? (Choose two)
FMC expert shell logs detail API calls and cloud synchronization events.
Why this answer
Integration status can be verified through the FMC System > Integration > SecureX health status and by checking cloud services API logs on the FMC expert shell.
An administrator is configuring Cisco Secure Firewall Threat Defense to forward syslog messages. The security team requires that only critical intrusion events and high-severity security alerts are sent via syslog, filtering out routine connection permits. Where should the administrator configure severity filtering for syslog export?
Platform Settings allow fine-tuning which event categories and severity levels are exported to syslog.
Why this answer
In FTD Platform Settings > Syslog, administrators can select specific event classes (such as Intrusion, Security Intelligence, or Access Control) and assign severity filters so that only desired severity levels are exported.
An administrator wishes to configure third-party SIEM integration with Cisco Secure Firewall Threat Defense by forwarding security events in a standard format. While eStreamer is available, the SIEM only accepts standard syslog. Which configuration options must be selected in FMC to ensure the SIEM receives parseable CEF (Common Event Format) or LEEF logs?
FMC allows configuring syslog message formats and severity levels in Platform Settings to match SIEM parsing expectations.
Why this answer
FMC Platform Settings or Alert configurations allow formatting syslog output into industry-standard formats such as Cisco standard, or leveraging advanced logging integrations. Wait, FMC syslog settings support Cisco legacy format or standard syslog, but third-party SIEM parsing often relies on specific header mappings or third-party connectors. Let's look at standard FMC syslog capabilities: FMC allows configuring syslog alert formats under Platform Settings.
An administrator notices that health monitors on the FMC show a critical warning for high disk utilization on the /var partition of an FTD device. What is the safest and most standard method to resolve disk space exhaustion caused by accumulated core files and rotated logs on FTD?
Clearing core files and old logs safely frees space on the /var partition without affecting active configurations.
Why this answer
The command 'system support purge log' or clearing rotated logs and core files via expert mode is used, but specifically, FMC allows administrators to manage and delete core files and rotated logs safely through the FTD CLI or FMC device management settings.
FTD supports both UDP and TCP transport protocols for syslog transmission.
Which TWO protocols are commonly managed via Port objects in FMC?
Primary L4 protocol.
TCP 8910 is the standard designated port for Cisco pxGrid services.
Why this answer
Cisco ISE pxGrid typically operates over TCP port 8910 for client-server communications.
An administrator needs to restore an FMC configuration from a previously saved backup file. Where in the FMC GUI is the Backup/Restore utility located?
System > Tools > Backup/Restore is the exact menu path for creating and restoring FMC backups.
Why this answer
FMC backup and restore operations are managed centrally under System > Tools > Backup/Restore.
An administrator is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) on-premises using a KVM hypervisor. During the initial deployment, the virtual machine fails to boot and console logs indicate an issue with interface mapping. What is a key requirement for physical interface mapping on KVM-based FTDv deployments?
The FTDv architecture demands eth0 for management, with subsequent interfaces mapped sequentially for internal/external data planes.
Why this answer
KVM deployments require correct mapping of virtual NICs (vNICs) to specific bridge or SR-IOV interfaces, where eth0 is strictly reserved for management, eth1 for internal, and eth2 for external data traffic.
An administrator needs to create a custom URL object to block a specific malicious domain name 'example.malicious.com' in an Access Control Policy. Which object type should be created?
URL objects allow specifying exact web domains or paths for layer 7 URL filtering rules.
Why this answer
URL objects are created under Object Management to define specific web domains or URLs for use in access control rules.
An engineer needs to analyze the connection history and security events from an FTD device that occurred three weeks ago. However, when querying the FMC event viewer, the events are missing. What is the most likely cause of this behavior?
FMC purges old events based on database retention policies and storage limits.
Why this answer
FMC event databases have configurable retention policies and disk space thresholds. If event retention settings are low or disk space fills up, older events are automatically purged to prevent disk exhaustion.
An administrator is configuring Security Intelligence on the FMC to drop traffic from known malicious IP addresses. Where in the Access Control Policy is Security Intelligence evaluated relative to standard access rules?
Security Intelligence acts as a pre-filter step within the Access Control Policy, dropping bad IPs before rule matching begins.
Why this answer
Security Intelligence is evaluated before Access Control Policy rules are processed, providing an efficient early drop mechanism.
An administrator configures an eStreamer client script on a remote server to receive events from FMC. The script connects successfully and starts receiving events, but after a few hours, the connection drops and throws a timeout error. What is the most likely cause of this behavior?
Stateful firewalls drop idle TCP connections if no keepalives or data are exchanged within the configured timeout window.
Why this answer
Firewalls or intermediate network devices along the path between the external eStreamer client and the FMC often have idle session timeouts (e.g., 30 minutes or 1 hour). If eStreamer traffic is quiet, the session times out. eStreamer keepalive configurations or firewall idle timeouts must be adjusted.
An engineer configures Cisco Secure Firewall Threat Defense to ingest SGTs from Cisco ISE via pxGrid and wants to enforce access control based on these tags. Which TWO requirements must be met for the firewall to successfully enforce SGT-based policies? (Choose two)
pxGrid provides the runtime IP-to-SGT mapping table consumed by the firewall.
Why this answer
Enforcing SGT-based policies requires an active pxGrid connection for mapping retrieval and SXP/inline propagation so data plane packets carry the tag metadata.
What is the purpose of an 'FQDN' object in FMC?
FQDN stands for Fully Qualified Domain Name.
Why this answer
FQDN objects are used to define network resources by domain name, which the FTD resolves.
Correct, it rewrites the A-record to the internal IP.
A network security engineer is setting up a high availability (HA) pair for two Cisco Secure Firewall Threat Defense devices managed by Cisco FMC. Which prerequisite condition must be met between the primary and secondary units before configuring the HA pair?
Each unit in an HA pair must retain its own unique management IP address for FMC communication, even after pairing.
Why this answer
Before configuring an HA pair, both units must have the same exact model, identical license configurations, the same software version, and identical interface configurations/naming.
In routed mode, what is the purpose of the 'Name' assigned to an interface?
The interface name acts as the identifier in the configuration.
Why this answer
The name assigned to an interface (e.g., 'outside') is used in policy rules and NAT definitions to identify the zone or security level.
An engineer is troubleshooting Cisco Secure Firewall integration with Cisco SecureX. The integration is active, but a custom threat indicator block action initiated in SecureX fails to reach the managed FTD devices. Which TWO troubleshooting steps should the engineer perform? (Choose two)
FMC logs API transactions and will show authentication or parsing errors if SecureX requests fail.
Why this answer
Troubleshooting SecureX action delivery involves checking API communication between SecureX and FMC, and verifying that FMC successfully deploys policy updates to the FTD sensors.
An administrator is deploying static route tracking combined with IP SLA on a Cisco Secure Firewall Threat Defense device managed by Cisco FMC. Which TWO components must be configured to implement this feature successfully? (Choose two)
A tracking object references the IP SLA object to monitor its up/down state.
Why this answer
Route tracking requires creating an IP SLA Monitor object to test reachability and configuring a Track object linked to that SLA, which is then referenced in the static route.
An engineer has deployed an active/standby High Availability pair of Cisco Secure Firewall Threat Defense devices. A failure occurs on the active unit, and a failover successfully takes place. However, upon recovery of the original active unit, it immediately resumes its role as the active unit, causing a brief secondary interruption. Which failover setting governs this behavior?
Preempt settings control whether the primary unit automatically takes back the active role when it recovers.
Why this answer
The 'Preempt' setting dictates whether a recovered primary unit will reclaim its active role from the current active unit. By default, preemption may be enabled or disabled depending on configuration preferences.
An administrator needs to monitor the real-time health and status of managed devices from the FMC dashboard. Which TWO dashboard widgets or features are available in FMC to assist with device monitoring? (Choose two)
The Health Status widget highlights CPU, memory, disk, and hardware health across managed devices.
Why this answer
FMC provides customizable dashboards with widgets such as Device Status, Health Status, Connection Events, and System Notices.
If you need to block a specific file type (e.g., .exe) from being downloaded, which feature must you enable in the Access Control Rule?
File policies handle file inspection and blocking.
Why this answer
File policies are associated with Access Control rules to inspect and block files.
An administrator is preparing to perform a system backup on the FMC. Which TWO data categories can be optionally included or excluded when generating the backup? (Choose two)
Certificates and licensing tokens are part of system settings that can be managed in backups.
Why this answer
FMC backup configuration allows selecting whether to include event data and historical data, as well as configuration files, health data, and certificates.
An engineer is configuring NGIPS inline sets on a Cisco Secure Firewall Threat Defense deployment. Which THREE configuration options or behaviors are associated with inline sets? (Choose three)
Snort Bypass protects against traffic drops during high CPU or memory load.
Why this answer
Inline sets inspect traffic passing between paired interfaces, support Snort bypass options, and can utilize tap or inline normalization features.
Administrators can configure the syslog facility and severity filtering per event category.
An administrator is troubleshooting an eStreamer integration where the client script disconnects immediately after authentication. Upon inspecting the logs, the administrator notes an SSL certificate verification error. Which TWO areas should be checked to resolve this certificate error? (Choose two)
The client must trust the FMC CA to validate the server certificate.
Which action must be taken on the FTD CLI after a manual configuration change is made, if you want to ensure the FMC does not overwrite it?
The FMC manages the configuration and will overwrite out-of-band CLI changes.
Why this answer
Manual CLI changes are generally discouraged because the FMC will overwrite them during the next deployment. The best practice is to always perform changes via the FMC.
An administrator is deploying an FTD in a virtual environment. What is the minimum recommended vCPU and RAM configuration for an FTDv instance?
This meets the Cisco deployment requirements for FTDv.
Why this answer
FTDv instances have specific requirements (e.g., 4 vCPUs and 8GB RAM minimum for basic functionality) which must be met to ensure stability.
An engineer needs to deploy a Cisco Secure Firewall Threat Defense in transparent firewall mode. Which TWO statements describe characteristics of transparent mode? (Choose two)
Transparent mode performs Layer 2 bridging.
Why this answer
Transparent mode bridges traffic across interfaces in a bridge group using BVIs, acting as a stealth firewall at Layer 2.
Which license state must an FTD device reach to allow the FMC to push policy configurations to it?
A licensed state is a prerequisite for policy application.
Why this answer
Devices must be registered and properly licensed (or in grace period) for policy deployment to succeed.
An enterprise is deploying a Cisco Secure Firewall Threat Defense cluster. During the setup of the Cluster Control Link (CCL), the administrator must ensure specific networking criteria are met. What is a primary design requirement for the CCL interface?
CCL traffic is sensitive to latency and bandwidth, requiring a dedicated Layer 2 connection between nodes.
Why this answer
The Cluster Control Link requires low latency, high bandwidth, and a dedicated non-routable Layer 2 connection (or directly connected point-to-point links) between cluster members.
An administrator is troubleshooting Cisco ISE pxGrid integration with Secure Firewall Management Center. Which TWO issues commonly prevent successful pxGrid registration and trust establishment? (Choose two)
New pxGrid client registrations on ISE often require manual approval unless automatic approval is configured.
Why this answer
pxGrid integration issues frequently stem from certificate validation errors (missing CA chains) or unapproved client registrations on the ISE pxGrid dashboard.
An administrator is configuring manual NAT on an FTD device managed by FMC. Which TWO parameters must be defined when creating a manual NAT rule? (Choose two)
Every manual NAT rule must define the Original Source network/IP object being translated.
Why this answer
Manual NAT rules require defining the NAT type (Static or Dynamic) and the Original Source (along with other matching parameters like interfaces or destination).
An administrator is integrating Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. The connection fails during the certificate validation phase because the FMC rejects the ISE pxGrid certificate. Upon inspection, the FMC certificate store lacks the intermediate CA certificate of the PKI hierarchy used by ISE. How should the administrator resolve this?
The FMC must have the entire CA chain trusted to validate the ISE pxGrid server certificate successfully.
An engineer is configuring Cisco eStreamer to stream security events from FMC to a third-party SIEM. Which THREE components or prerequisites must be properly established for the eStreamer client to successfully connect and receive events? (Choose three)
The FMC must authorize the client IP and issue a client certificate bundle for mutual TLS authentication.
Why this answer
eStreamer integration requires generating client certificate bundles, ensuring network access on port 8302, and enabling the eStreamer service/client rights on the FMC.
An administrator is configuring an NGIPS deployment using a Cisco Secure Firewall Threat Defense inline set. Traffic needs to be analyzed, but certain trusted bulk data transfers should bypass the Snort inspection engine without breaking the inline flow. Which feature should the administrator configure?
Snort Bypass on an inline set ensures that if the inspection engine is overloaded, traffic can either drop or pass uninspected based on the configuration.
Why this answer
Inline Bypass or Advanced Inspection and Prevention settings allow traffic to bypass Snort inspection under specific conditions. Specifically, Snort performance overload or configured bypass settings on inline sets can drop or pass traffic without inspection.
You are configuring SSL decryption. To ensure that traffic to a specific financial domain is NOT decrypted due to privacy regulations, what must you configure in the SSL Decryption Policy?
The Do Not Decrypt action explicitly tells the FTD to pass the traffic as-is.
Why this answer
The 'Do Not Decrypt' action is used in SSL policies to bypass inspection for specific URLs or categories.
An administrator needs to perform a full system backup of the FMC. Where is the most appropriate place to store this backup for long-term disaster recovery?
Remote storage is best practice for disaster recovery.
Why this answer
Backups should be stored on a remote server (e.g., via SCP or FTP) to ensure they are available if the FMC appliance fails entirely.
An administrator needs to verify if an FTD is correctly receiving updates from the Cisco Support Cloud. Which menu path shows the status of rule updates and threat intelligence feeds?
Product Updates is where rule and vulnerability database updates are monitored.
Why this answer
Updates are managed under the 'Updates' section of the 'System' menu, where you can view update history and current versions.
An enterprise environment requires streaming connection events, intrusion events, and file events from Cisco Secure Firewall Threat Defense to a third-party SIEM. Which native protocol and feature on the firewall is designed to stream these events in real time?
eStreamer is Cisco's proprietary protocol designed to securely stream intrusion, connection, and file events to third-party SIEMs.
Why this answer
The eStreamer (Event Streamer) API allows external applications and SIEM systems to stream real-time connection, intrusion, and file events from the FMC.
An administrator is troubleshooting a scenario where Snort inspection threads on an FTD are crashing intermittently, producing core dumps. To assist Cisco TAC in root cause analysis, what is the correct sequence of tools or CLI commands to collect the necessary diagnostic data?
The 'system support tech-support' command collects all logs, core dump metadata, and system state required by TAC.
Why this answer
Cisco provides a dedicated troubleshooting bundle generation tool on both FMC and FTD. On the FTD CLI, running 'system support diagnostic-cli' or generating a tech-support file via 'system support tech-support' collects core dumps, logs, and system metrics.
Which THREE features are critical for maintaining a stable FTD cluster?
Required for policy consistency.
Why this answer
Clustering requires a dedicated control link for health, a data port channel for traffic, and consistent configuration via the FMC.
Which THREE actions can be assigned to an individual rule within an Access Control Policy on the FMC? (Choose three)
Allow passes traffic for inspection and forwarding.
Why this answer
Access Control rules support actions such as Allow, Block, Interactive Block, Trust, and Monitor.
An administrator is deploying a Cisco Secure Firewall Threat Defense High Availability pair. During the initial configuration in Cisco FMC, the administrator assigns specific priority values. How does the failover process use the primary and secondary unit designations and priorities?
Failover selection evaluates unit health, priorities, and preemption settings to elect the active unit.
Why this answer
In an Active/Standby HA pair, the unit configured with the higher priority or designated role determines preemption and active state behavior when both units boot up simultaneously.
An administrator configures an SSL Decryption Policy with a rule to 'Do Not Decrypt' financial traffic. However, the administrator also wants to ensure that the encrypted session still undergoes basic certificate validation and categorization. How does FTD handle 'Do Not Decrypt' traffic?
Client Hello inspection allows URL categorization and SNI matching even when full decryption is disabled.
Why this answer
Even when traffic is set to Do Not Decrypt, FTD can inspect the TLS handshake (Client Hello) to extract SNI, categorize the URL, and validate basic certificate attributes without decrypting the payload.
In an FTD cluster, which unit is responsible for assigning flow ownership to other units in the cluster?
The master unit coordinates cluster resources and flow assignments.
Why this answer
The master unit in an FTD cluster handles management, orchestration, and the distribution/assignment of traffic flows to subordinate units.
Which command is used on the Cisco Secure Firewall Threat Defense CLI to verify that the device is successfully communicating with the Cisco Secure Firewall Management Center?
'show managers' displays the FMC IP address, connection status, and registration key details on the FTD CLI.
Why this answer
To check the registration and management connection status between FTD and FMC, the administrator uses the CLI command 'show managers'.
An administrator wants to check the status of all software processes running on an FMC appliance (such as the web server, database, and event handlers) to ensure everything is running smoothly. Which command should be run in the FMC CLI?
pmtool is the standard Cisco Firepower utility to check, start, and stop internal application processes.
Why this answer
The 'pmtool status' command is used across Cisco Firepower appliances to check the status of internal process manager (pm) daemons and services.
An enterprise integrates Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. Which TWO conditions or events can cause an active user-to-IP mapping to be purged from the FTD identity table? (Choose two)
Accounting stop messages or session timeouts signal the end of a user session, clearing the identity map.
Why this answer
Active identity mappings are purged when ISE sends session termination notices (logoff) or when accounting stop messages are received from the network access device.
When registering a new Cisco Secure Firewall Threat Defense device to Cisco Defense Orchestrator (CDO) or Cisco FMC, what is the primary prerequisite protocol or connectivity requirement that must be established from the managed device toward the management platform?
The FTD device establishes an outbound secure tunnel (sftunnel) on TCP 8305 to the management platform.
Why this answer
Managed devices initiate outbound secure communication (typically over TCP port 8305 / sftunnel) to the management platform (FMC or CDO).
An administrator is configuring port channels (EtherChannels) on Cisco Secure Firewall Threat Defense interfaces. Which TWO requirements or guidelines must be followed? (Choose two)
LACP is fully supported for dynamic EtherChannel formation.
Why this answer
Port channels require matching channel-group configurations, identical speed/duplex/mode on member ports, and support LACP.
An administrator needs to configure manual NAT on an FTD device to translate both the source IP and source port of outbound packets originating from 192.168.2.50 to a specific public IP 198.51.100.10 and port 50000. Which manual NAT rule element achieves this?
Manual NAT allows granular control over source IP and source port translation parameters.
Why this answer
Manual NAT rules allow specifying Original Source, Translated Source (IP), and Port translation options to achieve Port Address Translation.
A network engineer is troubleshooting a Cisco ISE and Cisco Secure Firewall integration where users are failing to get assigned identity-based access control policies. The engineer notices that user-to-IP mappings are successfully retrieved via pxGrid, but Security Group Tags are missing. Where in Cisco FMC should the engineer verify the SXP connection settings?
In modern FMC versions, the Cisco ISE integration settings including SXP peer connections are managed under the Integration menu.
Why this answer
SXP configuration on the Secure Firewall managed by FMC is located under Devices > Device Management > Platform Settings, or directly under the specific device configuration depending on the deployment, but specifically under Access Control and Identity Policies for identity sources. Wait, SXP configuration specifically resides under Integration > Cisco ISE > SXP on FMC versions 6.7 and later.
Practice 300-710 SNCF by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →