Courseiva

Cisco Securing Networks with Cisco Firewalls (300-710 SNCF, CCNP Security) (300-710 SNCF) (300-710 SNCF) — Questions 76–150

358 questions total · 5 pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 5

Page 3
76
MCQmedium

An engineer needs to analyze the connection history and security events from an FTD device that occurred three weeks ago. However, when querying the FMC event viewer, the events are missing. What is the most likely cause of this behavior?

A.The administrator must run 'database-cli optimize' on the FTD CLI to unhide historical events.
B.The FTD automatically flushes its local event buffer every 48 hours regardless of FMC configuration.
C.Security events older than 7 days are automatically archived to the Cisco Cloud Analytics platform by default.
D.The events were overwritten because the event database retention period or disk space limit was reached.
AnswerD

The FMC event database has a finite retention period and disk allocation; once either limit is reached, older events are purged. Three-week-old FTD connection and security events were therefore overwritten, explaining their absence from the event viewer.

Why this answer

FMC event databases have configurable retention policies and disk space thresholds. If event retention settings are low or disk space fills up, older events are automatically purged to prevent disk exhaustion.

Full explanation →
77
MCQmedium

An administrator is configuring Security Intelligence on the FMC to drop traffic from known malicious IP addresses. Where in the Access Control Policy is Security Intelligence evaluated relative to standard access rules?

A.Inside the Prefilter policy configuration menu
B.Before Access Control rules are evaluated
C.After all Access Control rules are evaluated as a fallback action
D.Concurrently with Intrusion Policy inspection
AnswerB

Security Intelligence uses reputation and category-based blocking lists evaluated before the access control rules, so malicious IP traffic is dropped without reaching rule matching. This ordering satisfies the stem's requirement, since blacklisted sources never consume rule processing or reach later allow decisions.

Why this answer

Security Intelligence is evaluated before access control rules in the FMC access control policy. This allows the system to quickly drop traffic from known malicious IP addresses, URLs, or DNS names without having to process the full access control rule set. This pre-evaluation improves performance and security by blocking threats early.

Exam trap

The trap is assuming Security Intelligence is part of Prefilter or evaluated after access rules, but it is actually evaluated before access control rules within the Access Control Policy.

How to eliminate wrong answers

Option A is wrong because Security Intelligence is configured within the Access Control Policy, not the Prefilter policy. Option C is wrong because Security Intelligence is not a fallback after access control rules; it is evaluated first. Option D is wrong because Security Intelligence is evaluated before intrusion policy inspection, not concurrently.

Full explanation →
78
MCQmedium

An administrator configures an eStreamer client script on a remote server to receive events from FMC. The script connects successfully and starts receiving events, but after a few hours, the connection drops and throws a timeout error. What is the most likely cause of this behavior?

A.The eStreamer service on the FMC has a hard-coded 2-hour session limit for security reasons.
B.The FMC automatically rotates the eStreamer client certificate every 4 hours.
C.The Snort inspection engine on the FTD restarts hourly to clear cache.
D.An intermediate firewall or stateful device closed the TCP port 8302 session due to inactivity timeout.
AnswerD

eStreamer uses a persistent TCP session on port 8302. Stateful devices silently drop idle TCP sessions after their inactivity timeout, causing the client's connection to fail with a timeout. The script must send keepalives or reconnect to survive these intermediate timeouts.

Why this answer

Firewalls or intermediate network devices along the path between the external eStreamer client and the FMC often have idle session timeouts (e.g., 30 minutes or 1 hour). If eStreamer traffic is quiet, the session times out. eStreamer keepalive configurations or firewall idle timeouts must be adjusted.

Full explanation →
79
Multi-Selecthard

An engineer configures Cisco Secure Firewall Threat Defense to ingest SGTs from Cisco ISE via pxGrid and wants to enforce access control based on these tags. Which TWO requirements must be met for the firewall to successfully enforce SGT-based policies? (Choose two)

Select 2 answers
A.An active eStreamer subscription for intrusion event streaming.
B.Syslog server configuration with local4 facility enabled.
C.Active Directory domain controller LDAP integration directly configured on the FTD CLI.
D.An active and healthy pxGrid connection between ISE and FMC to synchronize IP-to-SGT mappings.
E.Proper SXP peering or inline TrustSec configuration so data plane packets retain SGT metadata across the network.
AnswersD, E

SGT enforcement depends on FMC learning each endpoint's IP-to-SGT mapping, which only pxGrid publishes from ISE. Without a healthy, active pxGrid session, mappings never synchronise, so the firewall cannot resolve a source IP to its tag and policy lookups fail. This directly satisfies the stem's requirement for tag ingestion before enforcement.

Why this answer

Option D is correct because SGT-based enforcement on Cisco Secure Firewall Threat Defense depends on the FMC receiving IP-to-SGT mappings from Cisco ISE over pxGrid; without a healthy, active pxGrid session between ISE and FMC, the firewall has no tag-to-IP binding to match in access control rules. Option E is correct because the SGT metadata must actually reach the enforcement point in the data plane: either via SXP peering (to propagate SGT bindings to devices that cannot natively carry tags) or via inline TrustSec tagging, so packets retain their SGT across the network and the FTD can enforce policy on them. Option A is incorrect because eStreamer is used for exporting intrusion and connection events to external collectors, not for SGT ingestion or enforcement.

Option B is incorrect because syslog with the local4 facility is only for logging/event delivery and has no role in SGT synchronization or policy enforcement. Option C is incorrect because direct LDAP integration to Active Directory on the FTD CLI is not required for SGT-based access control; identity and SGT mapping come through ISE/pxGrid, not a direct FTD LDAP configuration.

Exam trap

The trap is confusing the roles of pxGrid (for control plane mapping) and SXP/inline (for data plane tagging), and being distracted by unrelated services like eStreamer or syslog that are not involved in SGT enforcement.

Full explanation →
80
MCQeasy

What is the purpose of an 'FQDN' object in FMC?

A.To define a protocol port
B.To define a zone
C.To define a domain name
D.To define a static IP
AnswerC

An FQDN object resolves a fully qualified domain name to its IP addresses, so access control rules can reference a hostname rather than hard-coded addresses. This satisfies the requirement to define a domain name, letting policies survive DNS changes without rule rewrites.

Why this answer

FQDN objects are used to define network resources by domain name, which the FTD resolves.

Full explanation →
81
MCQhard

When defining a NAT rule for an internal server, what happens if the 'DNS Rewrite' option is enabled?

A.The FTD forces a DNS query to an external server
B.The FTD creates a new NAT object
C.The FTD blocks all DNS traffic
D.The FTD modifies DNS responses
AnswerD

Correct, it rewrites the A-record to the internal IP.

Why this answer

DNS Rewrite modifies the payload of DNS responses to ensure clients reach the correct internal server IP instead of the NAT public IP.

Full explanation →
82
MCQeasy

In routed mode, what is the purpose of the 'Name' assigned to an interface?

A.To define the interface for use in security policies and NAT.
B.To define the failover priority.
C.To change the speed of the physical interface.
D.To set the MAC address.
AnswerA

The interface Name is a logical label that security policies and NAT rules reference instead of a physical identifier, letting rules survive interface changes. This satisfies the requirement to identify the interface within policy and NAT configuration.

Why this answer

The name assigned to an interface (e.g., 'outside') is used in policy rules and NAT definitions to identify the zone or security level.

Full explanation →
83
Multi-Selectmedium

An administrator is deploying static route tracking combined with IP SLA on a Cisco Secure Firewall Threat Defense device managed by Cisco FMC. Which TWO components must be configured to implement this feature successfully? (Choose two)

Select 2 answers
A.A secondary management interface configured for out-of-band SLA telemetry.
B.A Track object that monitors the state of the IP SLA operation.
C.A BGP routing peer group that automatically advertises SLA status to upstream routers.
D.An IP SLA monitor object defining the target IP and probe parameters (such as ICMP Echo).
E.An Access Control Rule explicitly permitting ICMP traffic destined for the firewall's loopback interface.
AnswersB, D

A Track object polls the IP SLA operation's return code, translating reachability into a tracked state that route injection can reference. This satisfies the stem's requirement for static route tracking, because without a Track object the SLA probe's results never influence the route table, leaving the static route permanently installed regardless of path failure.

Why this answer

Option B is correct because static route tracking on Cisco Secure Firewall Threat Defense requires a Track object that references the IP SLA operation and whose up/down state is bound to the static route, so the route is withdrawn or reinstalled based on probe results. Option D is correct because the underlying IP SLA monitor object must be defined first, specifying the target IP address and probe type (for example ICMP Echo) that the Track object monitors. Together, the IP SLA monitor generates the reachability data and the Track object translates that data into a route-tracking state used by the static route.

Option A is incorrect because IP SLA telemetry does not require a dedicated secondary management interface; probes are sourced from the data interface associated with the route. Option C is incorrect because static route tracking with IP SLA is a local mechanism and does not depend on BGP peering or advertising SLA status to upstream routers. Option E is incorrect because no Access Control Rule permitting ICMP to a loopback interface is needed; IP SLA ICMP Echo probes are generated by the device itself and are not subject to FMC Access Control policy in that manner.

Exam trap

The trap here is that candidates assume dynamic routing (BGP/OSPF) or an Access Control Rule is needed to make SLA tracking work, when in fact the feature is entirely local to the device and only requires the SLA monitor plus the Track object.

Full explanation →
84
MCQhard

An engineer has deployed an active/standby High Availability pair of Cisco Secure Firewall Threat Defense devices. A failure occurs on the active unit, and a failover successfully takes place. However, upon recovery of the original active unit, it immediately resumes its role as the active unit, causing a brief secondary interruption. Which failover setting governs this behavior?

A.MAC Address Persistence Timer
B.HEMS Poll Frequency
C.Stateful Failover Sync Interval
D.Failover Preempt Configuration
AnswerD

Preempt lets a higher-priority unit reclaim the active role once it recovers, which is exactly the behaviour described. Disabling preempt would keep the standby unit active after failover, avoiding the secondary interruption caused by the recovered unit seizing control again.

Why this answer

Failover Preempt Configuration controls whether a recovered higher-priority unit automatically reclaims the active role. When preempt is enabled, the recovered unit immediately takes back active status, causing the brief secondary interruption described. When preempt is disabled (the default in many deployments), the recovered unit stays in standby and the current active unit retains the role, avoiding the extra failover.

Exam trap

The trap is conflating 'priority' with 'preempt' — candidates assume the higher-priority unit always reclaims active status, but that only happens when preempt is explicitly enabled, which is the setting actually being tested.

How to eliminate wrong answers

Option A is wrong because the MAC Address Persistence Timer governs how long the shared virtual MAC address is retained after a failover to prevent switch CAM table flapping — it has nothing to do with a recovered unit reclaiming the active role. Option B is wrong because HEMS (Health and Event Monitoring System) Poll Frequency controls how often the units exchange health-check heartbeats, not which unit becomes active after recovery. Option C is wrong because the Stateful Failover Sync Interval determines how frequently state/connection tables are replicated between peers, which affects session continuity, not role reclamation.

Full explanation →
85
Multi-Selectmedium

An administrator needs to monitor the real-time health and status of managed devices from the FMC dashboard. Which TWO dashboard widgets or features are available in FMC to assist with device monitoring? (Choose two)

Select 2 answers
A.Health Status widget
B.Real-time Packet Replay widget
C.Firewall Cluster Load Balancing Graph widget
D.Active BGP Neighbor Matrix widget
E.Device Status widget
AnswersA, E

The Health Status widget on the FMC dashboard displays real-time health and status metrics for managed devices, satisfying the requirement to monitor device health. It aggregates appliance-level indicators such as CPU, memory and disk usage.

Why this answer

The Health Status widget (A) is a standard FMC dashboard widget that displays real-time health metrics for managed devices, including CPU, memory, disk usage, and interface status, making it directly relevant to monitoring device health. The Device Status widget (E) is also an FMC dashboard widget that shows the current up/down status and connectivity of managed devices, which is exactly what the administrator needs for real-time status monitoring. The Real-time Packet Replay widget (B) does not exist in FMC; packet capture and replay are handled through troubleshooting tools, not dashboard widgets.

The Firewall Cluster Load Balancing Graph widget (C) is not an FMC dashboard feature; FMC provides cluster status via device health monitors, not a dedicated load-balancing graph widget. The Active BGP Neighbor Matrix widget (D) is not an FMC dashboard widget; BGP neighbor status is viewed through device-specific routing tables or CLI, not a dashboard matrix.

Exam trap

The trap is selecting plausible-sounding but non-existent widgets; only the documented FMC dashboard widgets (Health Status, Device Status, etc.) are valid.

Full explanation →
86
MCQhard

If you need to block a specific file type (e.g., .exe) from being downloaded, which feature must you enable in the Access Control Rule?

A.SSL Policy
B.IPS Policy
C.File Policy
D.QoS Policy
AnswerC

File Policy is the Access Control Rule setting that inspects file attributes such as type or reputation, enabling blocking of specific extensions like .exe. Without it enabled, the rule cannot evaluate file characteristics for download decisions.

Why this answer

File policies are associated with Access Control rules to inspect and block files.

Full explanation →
87
MCQhard

An engineer is troubleshooting an FTD device that is not sending events to the FMC. The engineer suspects that the connection between the FTD and FMC is down. Which CLI command on the FTD should the engineer use to verify the status of the management connection to the FMC?

A.show running-config
B.show events
C.show interface
D.show managers
AnswerD

The 'show managers' command on the FTD CLI displays the status of the management connection to the FMC, including whether the FTD is registered and the last communication time. It is the primary command to verify connectivity and management status.

Why this answer

The 'show managers' command is specifically designed to display the status of the FTD's management connection to FMC, including registration state and last heartbeat. It is the quickest way to verify if the FTD is successfully communicating with the FMC.

Exam trap

The trap here is using 'show running-config' to check manager status; it shows configuration but not live connectivity, which is what 'show managers' provides.

Full explanation →
88
Multi-Selecthard

An engineer is configuring NGIPS inline sets on a Cisco Secure Firewall Threat Defense deployment. Which THREE configuration options or behaviors are associated with inline sets? (Choose three)

Select 3 answers
A.Snort Bypass can be configured to pass traffic uninspected if the inspection engine is overloaded.
B.Inline sets automatically function as dynamic OSPF routers for neighboring switches.
C.Inline normalization can be enabled to proactively mitigate packet evasion techniques.
D.Traffic entering one interface of the inline set is inspected and forwarded out the paired interface.
E.Inline sets require every participating interface to have a unique Layer 3 IP address.
AnswersA, C, D

Snort Bypass is an inline-set-specific feature: when the inspection engine is overloaded, it lets packets pass uninspected rather than dropping them, preserving availability. Passive interfaces cannot bypass because they never forward traffic, so this behaviour satisfies the inline deployment constraint in the stem.

Why this answer

Option A is correct because inline sets support Snort Bypass, which allows traffic to be passed uninspected when the inspection engine is overloaded or fails, preserving availability. Option C is correct because inline normalization is a configurable feature that rewrites packets to remove ambiguities, proactively mitigating evasion techniques such as overlapping fragments or TTL manipulation. Option D is correct because an inline set pairs two interfaces, and traffic entering one interface is inspected by the NGIPS engine and forwarded out the paired interface, dropping malicious traffic as needed.

Option B is incorrect because inline sets are Layer 2 transparent inspection constructs and do not run dynamic routing protocols like OSPF. Option E is incorrect because inline set interfaces are typically configured without Layer 3 IP addresses, operating in transparent mode rather than requiring unique IPs.

Full explanation →
89
Multi-Selecthard

An administrator is configuring Cisco Secure Firewall Threat Defense to export syslog messages to a remote SIEM. Which TWO parameters can be customized under the FTD Platform Settings syslog configuration? (Choose two)

Select 2 answers
A.The encryption algorithm used for IPsec VPN tunnels terminating on the FTD
B.The OSPF routing protocol router ID
C.The Snort inspection engine memory allocation size
D.Syslog facility levels (e.g., local0 through local7) and severity filters
E.Syslog transport protocol (UDP or TCP/Reliable Syslog with TLS encryption)
AnswersD, E

FTD Platform Settings lets you assign the syslog facility (local0–local7) so the SIEM can separate FTD events from other devices, and apply severity filters to control which messages are exported. Both parameters are customisable there, satisfying the stem's requirement for two configurable syslog options.

Why this answer

Under FTD Platform Settings > Syslog, the administrator can define the logging destination and customize how messages are sent, including the syslog facility (local0 through local7) and severity level filters that determine which messages are forwarded to the SIEM, making option D correct. The same configuration section also lets you select the transport used to reach the syslog server—UDP or TCP with Reliable Syslog (TLS encryption)—so option E is correct. Option A is wrong because IPsec tunnel encryption algorithms are configured in the VPN/IPsec settings, not in Platform Settings syslog.

Option B is wrong because the OSPF router ID is set under routing protocol configuration, not syslog. Option C is wrong because Snort inspection memory allocation is tuned in the inspection engine/advanced settings, not in the syslog configuration.

Full explanation →
90
Multi-Selecthard

An administrator is troubleshooting an eStreamer integration where the client script disconnects immediately after authentication. Upon inspecting the logs, the administrator notes an SSL certificate verification error. Which TWO areas should be checked to resolve this certificate error? (Choose two)

Select 2 answers
A.Verify the pxGrid client approval status on the Cisco ISE dashboard.
B.Verify that the FMC CA root certificate has been correctly imported into the client application's trust store.
C.Ensure that the client certificate and private key bundle generated from the FMC were correctly copied and referenced by the client script.
D.Check the FTD Platform Settings syslog server IP configuration.
E.Restart the Snort engine on the FTD device.
AnswersB, C

Importing the FMC CA root certificate into the client trust store lets the eStreamer client validate the server certificate chain presented during the TLS handshake, resolving the verification error. Without that anchor, the client aborts immediately after authentication, satisfying the stem's requirement to check certificate trust configuration.

Why this answer

The SSL certificate verification error during eStreamer authentication points to a trust or identity problem in the TLS handshake between the client and the FMC. Option B is correct because the eStreamer client must trust the FMC's server certificate; if the FMC CA root certificate is not imported into the client application's trust store, the client cannot validate the server's certificate chain and will abort the connection. Option C is correct because eStreamer mutual TLS requires the client to present the certificate and private key bundle generated from the FMC; if that bundle was not copied correctly or the script references the wrong path, the certificate exchange fails and the client disconnects immediately after authentication.

Option A is incorrect because pxGrid client approval is an ISE concept unrelated to eStreamer, which authenticates directly against the FMC. Option D is incorrect because syslog server IP configuration in FTD Platform Settings has no bearing on eStreamer TLS certificate validation. Option E is incorrect because restarting the Snort engine on the FTD does not address certificate trust or client credential issues on the eStreamer client.

Full explanation →
91
MCQhard

An engineer is comparing configuration states between FMC and a managed FTD after several changes were made directly on the FTD CLI by a local technician. The engineer wants to confirm whether the device configuration currently running differs from what FMC last deployed, without pushing any new policy. Which FMC feature provides this comparison?

A.The FTD CLI command 'show configuration diff' executed from the diagnostic CLI, which outputs the delta against the FMC-deployed policy.
B.The 'Compare' option on the Device Management page, which shows the running configuration versus the last-deployed configuration for the managed device.
C.The 'show running-config' output captured automatically in the FMC audit log after each CLI session on the device.
D.The Health Monitor's 'Analysis' tab, which correlates configuration drift with performance anomalies on the device.
AnswerB

The Compare function on the FMC Device Management page retrieves the device's current running configuration and diffs it against the configuration FMC last deployed. This reveals out-of-band CLI changes without triggering a deployment, which is exactly what the engineer needs to detect drift caused by local edits.

Why this answer

FMC provides a Compare feature on the Device Management page that pulls the device's running configuration and diffs it against the last configuration FMC deployed. This lets administrators detect out-of-band CLI changes without deploying new policy, which is essential for identifying configuration drift.

Exam trap

The trap here is believing the FTD CLI itself can produce a diff against FMC-deployed policy, when reconciliation is performed from the manager side.

Full explanation →
92
MCQeasy

Which action must be taken on the FTD CLI after a manual configuration change is made, if you want to ensure the FMC does not overwrite it?

A.Manual changes should be avoided; perform all changes in FMC.
B.Set the device to 'Read-Only' mode.
C.Run 'fmc update lock'.
D.Run 'write memory' to lock the configuration.
E.Run 'commit configuration' to save the state.
AnswerA

The FMC is the authoritative management plane for managed FTD devices, so any CLI change made outside it is unsynchronised and can be overwritten at the next deployment. Performing all configuration in FMC therefore prevents that overwrite by keeping the device and manager consistent.

Why this answer

Manual changes on the FTD CLI should be avoided because the FMC is the central management platform and will overwrite any manual configuration changes during the next policy deployment. To ensure the FMC does not overwrite manual changes, the best practice is to perform all changes in FMC. There is no CLI command to lock manual changes from being overwritten.

Exam trap

The trap is thinking that a CLI command can lock manual changes from being overwritten by FMC. Candidates may believe that saving the configuration or using a lock command will prevent FMC from overwriting, but the correct approach is to avoid manual changes altogether.

How to eliminate wrong answers

Option B is wrong because there is no 'Read-Only' mode on FTD that prevents FMC from overwriting changes. Option C is wrong because 'fmc update lock' is not a valid command. Option D is wrong because 'write memory' saves the running configuration to startup, but it does not prevent FMC from overwriting it.

Option E is wrong because 'commit configuration' is not a valid command to lock changes; FTD uses a different configuration model.

Full explanation →
93
MCQeasy

Which license state must an FTD device reach to allow the FMC to push policy configurations to it?

A.Disabled
B.Unregistered
C.Waiting for registration
D.Registered and licensed
E.Standby mode only
AnswerD

Reaching Registered and licensed state is what permits the FMC to push policy configurations to the FTD. Registration alone establishes the management connection, but policy deployment additionally requires a valid licence entitlement, such as a Smart Licence reservation, to be applied. This satisfies the stem's requirement for the licence state enabling configuration pushes.

Why this answer

An FTD device must be in the 'Registered and licensed' state for the FMC to push policy configurations to it. Registration establishes the management connection, and licensing ensures that the device is entitled to the required features. Only when both conditions are met can policies be deployed.

Exam trap

The trap is assuming that registration alone is sufficient; candidates must remember that licensing is also required for policy deployment.

How to eliminate wrong answers

Option A is wrong because 'Disabled' means the device is not enabled for management or inspection. Option B is wrong because 'Unregistered' means the device has not completed registration with the FMC. Option C is wrong because 'Waiting for registration' indicates the device is in the process of registering but not yet fully registered.

Option E is wrong because 'Standby mode only' is not a valid license state; it may refer to HA standby, but licensing is still required.

Full explanation →
94
MCQmedium

An administrator needs Cisco Secure Firewall Threat Defense to send connection and intrusion events to a third-party SIEM. The SIEM vendor requires that events arrive in a structured format over a reliable transport and supports only a specific event schema. Which FMC configuration should be used to meet these requirements?

A.Export events from FMC as CSV files on a schedule and import them into the SIEM with a custom script.
B.Enable syslog forwarding from each Threat Defense device and rely on the SIEM's generic syslog parser.
C.Configure the eStreamer service on FMC and use the vendor's eStreamer client to receive events in the vendor-supported schema.
D.Configure SNMP traps on FMC and map the OIDs to SIEM fields using a management information base.
AnswerC

eStreamer is the FMC service that streams security events, including connection and intrusion data, to external clients using a structured binary protocol. Many SIEM vendors provide an eStreamer-compatible client that maps the data into their schema. This satisfies the structured format, reliable TCP transport, and vendor schema requirements in a supported way.

Why this answer

eStreamer is purpose-built to export FMC security events, including connection and intrusion data, to external consumers over a reliable TCP connection and in a structured format. Because many SIEM vendors ship an eStreamer-compatible client that understands the schema, this configuration meets the structured format, reliability, and vendor schema requirements without custom parsing or batch delays.

Exam trap

The trap here is assuming syslog is sufficient for structured SIEM ingestion, when vendor schema support and reliable transport point to eStreamer instead.

Full explanation →
95
MCQhard

An enterprise is deploying a Cisco Secure Firewall Threat Defense cluster. During the setup of the Cluster Control Link (CCL), the administrator must ensure specific networking criteria are met. What is a primary design requirement for the CCL interface?

A.It must be a dedicated, high-bandwidth, low-latency Layer 2 link between cluster nodes.
B.It must share the same physical interface as the external data interfaces using 802.1Q subinterfaces.
C.It must be routed across a public Layer 3 MPLS cloud with dynamic BGP peering.
D.It must be configured with NAT overload enabled to translate inter-node control packets.
AnswerA

The CCL carries state synchronisation, heartbeats and failover traffic between cluster nodes, so it needs a dedicated Layer 2 segment with high bandwidth and low latency. Sharing it with data traffic or routing it at Layer 3 would break clustering.

Why this answer

The Cluster Control Link requires low latency, high bandwidth, and a dedicated non-routable Layer 2 connection (or directly connected point-to-point links) between cluster members.

Full explanation →
96
Multi-Selectmedium

An administrator is configuring manual NAT on an FTD device managed by FMC. Which TWO parameters must be defined when creating a manual NAT rule? (Choose two)

Select 2 answers
A.Prefilter FastPath action
B.Security Intelligence Whitelist
C.Snort Inspection Engine Mode
D.Original Source
E.NAT Type (Static or Dynamic)
AnswersD, E

Original Source identifies the real internal host or subnet whose traffic is translated, forming the match criterion for the manual NAT rule. It satisfies the mandatory parameter requirement because FMC needs this object to determine which packets the translation applies to.

Why this answer

Manual NAT rules require defining the NAT type (Static or Dynamic) and the Original Source (along with other matching parameters like interfaces or destination).

Full explanation →
97
MCQhard

An administrator is integrating Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. The connection fails during the certificate validation phase because the FMC rejects the ISE pxGrid certificate. Upon inspection, the FMC certificate store lacks the intermediate CA certificate of the PKI hierarchy used by ISE. How should the administrator resolve this?

A.Configure an SNMPv3 community string to bridge the certificate trust gap.
B.Upload the complete certificate authority chain (Root and Intermediate CA certificates) into the FMC Trusted CAs object repository.
C.Generate a self-signed certificate on the FTD CLI and assign it as the pxGrid trust anchor.
D.Disable certificate validation in the FMC pxGrid advanced configuration menu.
AnswerB

pxGrid certificate validation requires the full issuing chain; uploading the Root and Intermediate CA certificates into the FMC Trusted CAs repository lets the FMC build a path to ISE's certificate. This directly resolves the stem's stated missing-intermediate-CA constraint.

Why this answer

Mutual TLS for pxGrid requires the FMC to trust the entire certificate chain presented by ISE. The administrator must upload both the Root CA and Intermediate CA certificates of the ISE PKI to the FMC's trusted certificate store under Object Management > PKI > Trusted CAs.

Full explanation →
98
MCQhard

You are configuring SSL decryption. To ensure that traffic to a specific financial domain is NOT decrypted due to privacy regulations, what must you configure in the SSL Decryption Policy?

A.Use a 'Monitor' action in the SSL policy
B.Configure an SSL rule with the 'Do Not Decrypt' action
C.Create an Access Control Rule with a 'Decrypt' action
D.Add the domain to the Prefilter Policy
AnswerB

An SSL rule matching the financial domain with the 'Do Not Decrypt' action exempts that traffic from decryption, satisfying the privacy regulation constraint. The rule is evaluated before decryption rules, so matching sessions pass through encrypted.

Why this answer

In Palo Alto Networks SSL decryption policy, the 'Do Not Decrypt' action is specifically designed to bypass decryption for traffic that must remain encrypted for legal, privacy, or compliance reasons. When a financial domain is matched by an SSL rule with this action, the firewall forwards the session without performing any SSL forward proxy or inbound inspection, preserving end-to-end encryption. This satisfies privacy regulations while still allowing the firewall to log the connection metadata.

Exam trap

The trap here is confusing the SSL Decryption Policy with the Security Policy or Prefilter Policy; candidates may think a 'Monitor' action or an Access Control Rule can prevent decryption, but only the SSL Decryption Policy's 'Do Not Decrypt' action achieves that.

How to eliminate wrong answers

Option A is wrong because a 'Monitor' action in an SSL policy still decrypts the traffic but only logs it without blocking, so it does not prevent decryption. Option C is wrong because an Access Control Rule with a 'Decrypt' action would explicitly force decryption, the opposite of the requirement. Option D is wrong because the Prefilter Policy is used for tunnel content inspection and application override, not for selectively excluding domains from SSL decryption.

Full explanation →
99
MCQmedium

An administrator needs to perform a full system backup of the FMC. Where is the most appropriate place to store this backup for long-term disaster recovery?

A.Local /var/log/backup partition
B.Remote server using SCP or SFTP
C.The FMC /tmp directory
D.Attached USB storage drive
E.The managed FTD flash memory
AnswerB

SCP or SFTP transfers the FMC backup archive to a separate remote host, so the image survives local disk failure, theft or site loss. Storing it on the FMC itself or an attached USB drive cannot satisfy the long-term disaster recovery requirement in the stem.

Why this answer

The FMC full system backup must be stored off-box for true disaster recovery. Cisco explicitly supports exporting the backup to a remote server via SCP or SFTP, which provides a durable, external location that survives FMC hardware failure, reimaging, or replacement. Because the backup contains the entire FMC configuration, database, and OS state, keeping it on a remote server ensures it can be restored to a new appliance or VM during a full-site disaster.

Exam trap

300-710 SNCF often tests the misconception that any local or attached storage is acceptable for disaster recovery, when the exam expects you to recognize that only an off-box remote server via SCP/SFTP satisfies long-term DR requirements.

How to eliminate wrong answers

Option A is wrong because the local /var/log/backup partition resides on the same FMC disk subsystem, so it is lost if the FMC fails, is reimaged, or is destroyed. Option C is wrong because /tmp is volatile temporary storage that is cleared on reboot and is not intended for persistent backup retention. Option D is wrong because an attached USB drive is not a supported or reliable long-term backup target for FMC full system backups and is physically tied to the appliance.

Option E is wrong because the managed FTD flash memory stores the FTD device's own configuration and software, not the FMC's full system backup, and it is not a valid FMC backup destination.

Full explanation →
100
MCQeasy

An enterprise environment requires streaming connection events, intrusion events, and file events from Cisco Secure Firewall Threat Defense to a third-party SIEM. Which native protocol and feature on the firewall is designed to stream these events in real time?

A.NetFlow v9
B.Syslog over UDP
C.eStreamer
D.SNMPv3 Traps
AnswerC

eStreamer is the native Firepower API that streams connection, intrusion and file events to external clients in real time, without syslog reformatting. It directly satisfies the requirement for native real-time event streaming to a third-party SIEM.

Why this answer

The eStreamer (Event Streamer) API allows external applications and SIEM systems to stream real-time connection, intrusion, and file events from the FMC.

Full explanation →
101
MCQmedium

An administrator manages several FTD devices from a single FMC. After a policy deployment, a remote-site FTD shows 'Deployment Failed' in the FMC task list, and the administrator needs to identify which specific configuration object caused the failure without opening a TAC case. Which FMC workflow should the administrator use to review the detailed deployment failure reason for that device?

A.Open the FTD device's Health Monitor page and review the CPU and disk usage graphs captured during the deployment window.
B.Run the 'show managers' command on the FTD CLI and read the deployment error code returned in the registration status output.
C.Navigate to Policies > Access Control and click the Deploy icon on the individual access control policy to regenerate the failure report.
D.Open the FMC Task Status page, select the failed deployment task, and download the troubleshooting file (.tar.gz) generated for that deployment attempt.
AnswerD

The Task Status page retains each deployment task with a downloadable troubleshooting file that bundles the deployment logs, the configuration being pushed, and the error messages from the device. This is the standard FMC-native way to pinpoint which object failed on a specific managed device without console access or a TAC case.

Why this answer

Deployment failures on managed FTD devices are diagnosed through the FMC Task Status page, where each deployment task exposes a downloadable troubleshooting file containing the pushed configuration and the device's error output. This is the supported method for identifying the exact object that caused the failure without CLI access on the FTD.

Exam trap

The trap here is assuming the FTD CLI 'show managers' output includes deployment error details, when it only reports registration state and manager identity.

Full explanation →
102
Multi-Selecthard

Which THREE features are critical for maintaining a stable FTD cluster?

Select 3 answers
A.Individual IP addresses for every member on every network.
B.Synchronized FMC management.
C.EtherChannel (Port Channel) for data traffic.
D.External load balancer for traffic scrubbing.
E.Dedicated cluster control link.
AnswersB, C, E

Cluster stability depends on all nodes being managed consistently, so synchronised FMC management ensures uniform policy and configuration across every unit. This satisfies the stem's requirement for a critical feature, since divergent management causes inconsistent cluster behaviour and node instability.

Why this answer

Option B is correct because all members of an FTD cluster must be managed by the same FMC (or FDM in a single-device-manager scenario) so that configuration, policies, and cluster state remain synchronized across the cluster. Option C is correct because the data interfaces of clustered FTDs must be bundled into an EtherChannel (port channel) so that traffic can be load-balanced and redistributed across members while presenting a single logical interface to the network. Option E is correct because a dedicated cluster control link is required for members to exchange heartbeat, state, and control messages; without it, the cluster cannot form or maintain quorum and failover.

Option A is not required because cluster members share a single logical IP address per data interface (with individual physical/IPs only on the control link), and Option D is not a cluster requirement since FTD clustering performs its own load distribution without an external load balancer.

Full explanation →
103
MCQhard

An administrator configures an SSL Decryption Policy with a rule to 'Do Not Decrypt' financial traffic. However, the administrator also wants to ensure that the encrypted session still undergoes basic certificate validation and categorization. How does FTD handle 'Do Not Decrypt' traffic?

A.All inspection, including URL categorization and SNI extraction, is completely bypassed.
B.The FTD extracts SNI and performs URL categorization using the unencrypted Client Hello handshake.
C.The FTD converts the traffic to plaintext using a self-signed proxy certificate.
D.The FTD drops the connection because decryption is mandatory for any inspection.
AnswerB

Extracting the SNI from the unencrypted Client Hello lets FTD categorise the session without decrypting payload, satisfying the 'Do Not Decrypt' rule while still applying URL filtering. Certificate validation, however, is not performed on this traffic, so the stem's validation requirement is only partly met.

Why this answer

When an SSL policy rule is set to 'Do Not Decrypt', FTD still inspects the TLS Client Hello to extract the Server Name Indication (SNI) and uses it for URL categorization and basic certificate validation. The session remains encrypted, but metadata from the handshake is available for policy enforcement. This allows the administrator to apply URL filtering and other non-decryption inspections without breaking the encrypted flow.

Exam trap

The trap is assuming that 'Do Not Decrypt' means no inspection at all; candidates often overlook that SNI extraction and URL categorization still occur on the unencrypted handshake.

How to eliminate wrong answers

Option A is wrong because FTD does not completely bypass inspection; it still extracts SNI and performs categorization. Option C is wrong because converting traffic to plaintext requires a decrypt rule with a re-sign or known-key action, not 'Do Not Decrypt'. Option D is wrong because decryption is not mandatory for all inspection; 'Do Not Decrypt' is a valid action that allows metadata-based inspection.

Full explanation →
104
MCQmedium

A network security engineer is integrating Cisco Secure Firewall Threat Defense (FTD) with Cisco Identity Services Engine (ISE) for user identity-based policies. The engineer wants to use the Cisco Platform Exchange Grid (pxGrid) to share user identity information. Which component must be configured as a pxGrid client to receive user identity data from ISE?

A.Cisco Secure Firewall Management Center (FMC)
B.Cisco Secure Network Analytics (Stealthwatch)
C.Cisco Identity Services Engine (ISE) itself
D.Cisco Secure Firewall Threat Defense (FTD) device
AnswerA

In an FTD deployment managed by FMC, the FMC acts as the pxGrid client to receive user identity information from ISE. FMC then shares this information with the managed FTD devices. Configuring FMC as the pxGrid client is the correct approach for this integration.

Why this answer

FMC serves as the pxGrid client in an FTD deployment, receiving user identity data from ISE and distributing it to managed FTD devices. This centralized approach simplifies configuration and management. Other components like FTD or ISE do not fulfill this role.

Exam trap

The trap here is assuming that the FTD device itself connects directly to ISE via pxGrid, when in fact FMC handles the pxGrid client role in a managed deployment.

Full explanation →
105
MCQeasy

In an FTD cluster, which unit is responsible for assigning flow ownership to other units in the cluster?

A.The FMC
B.The subordinate unit
C.The master unit
D.The external load balancer
AnswerC

The master unit assigns flow ownership across the FTD cluster, directing each new connection to a specific slave for processing. This satisfies the stem's requirement for the unit responsible for distributing flows, since the master handles centralised load-balancing decisions while slaves forward the traffic themselves.

Why this answer

The master unit in an FTD cluster handles management, orchestration, and the distribution/assignment of traffic flows to subordinate units.

Full explanation →
106
MCQeasy

Which command is used on the Cisco Secure Firewall Threat Defense CLI to verify that the device is successfully communicating with the Cisco Secure Firewall Management Center?

A.show fmc status
B.show managers
C.show isc status
D.show controller connection
AnswerB

`show managers` queries the local manager registry and reports each configured Cisco Secure Firewall Management Center's registration state, IP address and heartbeat status. This directly satisfies the stem's requirement to verify live communication between the Threat Defense device and its management centre, confirming the management tunnel is up.

Why this answer

To check the registration and management connection status between FTD and FMC, the administrator uses the CLI command 'show managers'.

Full explanation →
107
MCQeasy

An administrator wants to check the status of all software processes running on an FMC appliance (such as the web server, database, and event handlers) to ensure everything is running smoothly. Which command should be run in the FMC CLI?

A.firepower-status -v
B.systemctl status all
C.show process manager
D.pmtool status
AnswerD

pmtool status queries the Process Manager, listing all software processes on the FMC appliance, including the web server, database and event handlers, with their running state. It directly satisfies the requirement to verify that every process is operating smoothly.

Why this answer

The 'pmtool status' command in the FMC CLI displays the status of all software processes managed by the Process Manager, including the web server, database, and event handlers. It is the correct command to verify that all FMC services are running properly.

Exam trap

300-710 SNCF often tests the misconception that standard Linux commands like systemctl work in the FMC CLI, when FMC uses its own pmtool for process management.

How to eliminate wrong answers

Option A is wrong because 'firepower-status -v' is not a valid FMC CLI command for checking process status. Option B is wrong because 'systemctl status all' is a Linux systemd command that is not exposed in the FMC CLI and would not show FMC-specific process states. Option C is wrong because 'show process manager' is not a valid FMC CLI command syntax; the correct tool is pmtool.

Full explanation →
108
MCQeasy

When registering a new Cisco Secure Firewall Threat Defense device to Cisco Defense Orchestrator (CDO) or Cisco FMC, what is the primary prerequisite protocol or connectivity requirement that must be established from the managed device toward the management platform?

A.An active SNMPv3 trap receiver configured on the manager pointing to the FTD.
B.Inbound SSH access from the management platform IP address to the firewall management interface.
C.An IPSec site-to-site VPN tunnel terminating on the data interfaces.
D.Outbound TCP connection on port 8305 from the FTD to the manager's IP address or registration FQDN.
AnswerD

The FTD initiates an outbound TCP connection on port 8305 to the manager's IP address or registration FQDN, which is how registration and subsequent management traffic are established. This satisfies the prerequisite that connectivity must originate from the managed device toward the management platform.

Why this answer

Managed devices initiate outbound secure communication (typically over TCP port 8305 / sftunnel) to the management platform (FMC or CDO).

Full explanation →
109
Multi-Selectmedium

An administrator is configuring port channels (EtherChannels) on Cisco Secure Firewall Threat Defense interfaces. Which TWO requirements or guidelines must be followed? (Choose two)

Select 2 answers
A.LACP (Link Aggregation Control Protocol) can be used to dynamically negotiate and manage the port channel.
B.All physical member ports assigned to a port channel must have matching speed, duplex, and mode settings.
C.Port channel interfaces cannot be assigned to security zones.
D.Port channels are restricted to passive NGIPS monitoring interfaces only.
E.Active/Standby HA pairs must have completely different port channel ID numbers on the standby unit.
AnswersA, B

Link Aggregation Control Protocol actively negotiates link bundling with the peer and monitors member state, so it can be used on Threat Defense port channels. It satisfies the requirement for a supported dynamic aggregation method rather than static configuration alone.

Why this answer

Port channels require matching channel-group configurations, identical speed/duplex/mode on member ports, and support LACP.

Full explanation →
110
MCQhard

An engineer is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. The SIEM requires that messages be reliably delivered and that the source of the messages be authenticated. The engineer enables syslog over TCP and configures a syslog server. Which additional configuration is required to meet the SIEM's authentication requirement?

A.Configure the Threat Defense device to use TCP syslog with an MD5 checksum on each message.
B.Configure the Threat Defense device to use UDP syslog with a shared secret key.
C.Configure the Threat Defense device to use TLS for syslog and install a certificate on the device that the SIEM trusts.
D.Configure the Threat Defense device to use TCP syslog and enable IPsec on the management interface.
AnswerC

Syslog over TLS provides authentication of the source through certificates and ensures confidentiality and integrity of the messages. By installing a certificate on the Threat Defense device that the SIEM trusts, the SIEM can verify that the messages originate from the authorized device. This meets the authentication requirement, whereas plain TCP syslog does not provide cryptographic authentication of the sender.

Why this answer

To meet both reliability and source authentication for syslog to a SIEM, syslog over TLS is the appropriate choice. TLS provides encryption, integrity, and certificate-based authentication of the sender. The Threat Defense device can be configured with a certificate that the SIEM trusts, allowing the SIEM to verify the origin of the messages.

Plain TCP syslog offers reliability but not authentication, while UDP and checksum-based approaches do not satisfy the authentication requirement.

Exam trap

The trap here is assuming that TCP syslog alone provides authentication because it is connection-oriented, when in fact TCP only provides reliable delivery and no cryptographic source verification.

Full explanation →
111
Multi-Selecthard

An administrator is troubleshooting an eStreamer client script failure where the connection is refused on port 8302. Which TWO potential causes should the administrator investigate? (Choose two)

Select 2 answers
A.An intermediate firewall or the FMC internal iptables firewall is blocking TCP port 8302 traffic.
B.The FTD Snort engine is out of memory.
C.The DHCP lease on the FTD data interface has expired.
D.The pxGrid certificate on ISE has expired.
E.The eStreamer service/daemon is not running or enabled on the FMC management plane.
AnswersA, E

Blocked TCP 8302 traffic directly explains the connection refusal, since eStreamer clients reach the FMC on that port. Both an intermediate firewall and the FMC's own iptables rules can drop the packets, so verifying each satisfies the stem's requirement to identify causes of the refused connection.

Why this answer

Option A is correct because eStreamer clients connect to the FMC on TCP port 8302, so a connection-refused or blocked result can come from an intermediate firewall or the FMC's own iptables rules filtering that port. Option E is correct because the eStreamer service (the eStreamer daemon on the FMC management plane) must be running and enabled; if it is stopped or disabled, nothing listens on TCP 8302 and the client receives a connection refused. Option B is not relevant because an out-of-memory Snort engine on an FTD affects inspection/event generation, not the FMC's eStreamer listener on port 8302.

Option C is not relevant because a DHCP lease expiry on an FTD data interface is a Layer 3 addressing issue unrelated to the FMC eStreamer service port. Option D is not relevant because pxGrid certificates on ISE pertain to pxGrid/ISE integration, not to the FMC eStreamer TCP 8302 service.

Full explanation →
112
Multi-Selecthard

An administrator wants to configure Access Control rules on Cisco Secure Firewall Threat Defense using identity context received from Cisco ISE via pxGrid. Which TWO criteria can be utilized in the Access Control policy rule configuration once pxGrid is fully integrated? (Choose two)

Select 2 answers
A.User names and User Groups
B.Security Group Tags (SGTs)
C.DHCP lease pool exhaustion percentages
D.OSPF neighbor adjacency states
E.MACsec encryption key lifetimes
AnswersA, B

Once pxGrid integration is active, the FMC receives ISE identity mappings, letting Access Control rules match traffic by user name and user group membership. This satisfies the requirement to enforce policy using identity context rather than IP addresses alone.

Why this answer

Option A is correct because once Cisco ISE is integrated with Cisco Secure Firewall Threat Defense via pxGrid, the firewall receives user identity mappings (user-to-IP and user-to-group) that can be referenced directly in Access Control policy rules as User and User Group conditions. Option B is correct because pxGrid also propagates Security Group Tags (SGTs) from ISE, and the Access Control policy can match traffic based on source/destination SGT values (TrustSec/SGT conditions) when the integration is fully established. Options C, D, and E are incorrect because DHCP lease pool exhaustion percentages, OSPF neighbor adjacency states, and MACsec encryption key lifetimes are not identity context delivered by pxGrid and are not selectable criteria in Access Control rule configuration; they relate to DHCP monitoring, routing protocol state, and link-layer encryption key management, respectively.

Full explanation →
113
Multi-Selecthard

An administrator is analyzing a troubleshooting scenario involving Snort inspection crashes on an FTD device. Which THREE locations or tools should the administrator check to diagnose why the Snort process restarted or crashed? (Choose three)

Select 3 answers
A.Check the Cisco Smart Software Manager portal for license expiration alerts.
B.Inspect the DHCP lease logs in /var/log/dhcpd.log.
C.Examine /var/log/messages and system log files for Out-Of-Memory (OOM) killer events targeting Snort.
D.Review Snort runtime error logs located in /var/log/snort/ or via FMC health alerts.
E.Check for core dump files generated in the crash directories using 'system support clean-core' or expert mode listing.
AnswersC, D, E

Examining /var/log/messages reveals kernel-level OOM killer events that terminate the Snort process when memory is exhausted, directly addressing the crash diagnosis. This log records the specific process killed and memory pressure at the time, confirming whether resource exhaustion, rather than a configuration fault, caused the restart.

Why this answer

Option C is correct because when the Snort process on an FTD is killed due to memory exhaustion, the Linux kernel OOM killer logs the event in /var/log/messages and other system logs, showing which process (snort) was terminated and why. Option D is correct because Snort-specific runtime errors, such as inspection engine failures or rule-related crashes, are written to the Snort logs under /var/log/snort/ and are also surfaced as health alerts in FMC, making them a primary diagnostic source. Option E is correct because when Snort crashes it can generate core dump files in the crash directories; these can be listed in expert mode or managed with the 'system support clean-core' command, and analyzing them (or their presence) helps confirm and diagnose the crash.

Option A is incorrect because Smart Software Manager license expiration would cause registration or entitlement issues, not a Snort process restart or crash. Option B is incorrect because DHCP lease logs in /var/log/dhcpd.log relate to address assignment and have no bearing on Snort inspection crashes.

Exam trap

The trap here is that candidates pick license or DHCP log options because they sound like plausible 'system' checks, but SNCF specifically tests knowledge of Snort crash forensics paths (OOM logs, /var/log/snort, core dumps).

Full explanation →
114
MCQhard

An organization integrates Cisco Secure Firewall Threat Defense with Cisco ISE via pxGrid. The security team notices that identity rules are matching incorrect users for traffic originating from shared Citrix terminal servers or Virtual Desktop Infrastructure (VDI) multi-user hosts. What mechanism must be enabled and configured to properly handle multi-user IP identity attribution on Secure Firewall?

A.Configuring SXP peers between the VDI hypervisor and the FMC.
B.Configuring static NAT overloading on the FTD egress interface.
C.Enabling SNMP polling on the VDI host so FMC can query active user sessions every 10 seconds.
D.Port-Based Identity mapping (or Terminal Services Agent integration) to correlate user sessions by source port in addition to IP address.
AnswerD

Terminal Services Agent (TS Agent) reports per-session source ports to the firewall, letting identity rules map each user on a shared Citrix or VDI host to the correct session rather than attributing all traffic to one IP address.

Why this answer

On multi-user hosts like Citrix or VDI, many users share a single IP address, so IP-to-user mapping alone cannot distinguish sessions. Port-Based Identity mapping (or Terminal Services Agent integration) correlates the source port of each connection with the user session on the host, allowing FTD to attribute traffic to the correct user even when the IP is shared.

Exam trap

The trap is assuming IP-to-user mapping is sufficient for identity rules, ignoring that shared-IP multi-user hosts require port-level correlation via TS Agent or Port-Based Identity.

How to eliminate wrong answers

Option A is wrong because SXP is used to propagate SGT-to-IP bindings between trust domains, not to resolve multi-user identity on a shared host. Option B is wrong because static NAT overloading is a translation technique that would actually worsen attribution by hiding users behind one address. Option C is wrong because SNMP polling does not provide per-session user-to-port mapping and is not the mechanism Cisco uses for multi-user identity on FTD.

Full explanation →
115
Multi-Selecthard

An administrator is troubleshooting an eStreamer client connection between a Python script and the Cisco FMC. The script fails to authenticate. Which TWO items must be verified regarding the eStreamer client credentials? (Choose two)

Select 2 answers
A.Verify that the PKCS#12 certificate file and password/keys used by the client script match the credentials generated on the FMC.
B.Verify that the IP address of the client host matches the authorized IP address configured during eStreamer certificate generation on the FMC.
C.Verify the FTD Active Directory domain password.
D.Check the pxGrid client approval status on the Cisco ISE server.
E.Check the SNMPv3 community string on the FTD management interface.
AnswersA, B

eStreamer authenticates clients with a PKCS#12 certificate bundle, not username and password. The script must load the exact certificate and private key exported from the FMC, and supply the matching export password; any mismatch in that file, its password, or the paired key causes the TLS handshake to fail, producing the authentication error described.

Why this answer

Option A is correct because the eStreamer client authenticates to the FMC using the PKCS#12 (.p12) certificate bundle and its associated password/private key that were generated when the eStreamer certificate was created on the FMC; if the script references a different file or an incorrect password, the TLS handshake and authentication will fail. Option B is correct because during eStreamer certificate generation on the FMC the administrator specifies the authorized client IP address (or hostname), and the FMC will reject connections from any host whose source IP does not match that binding, so the client host's IP must match the configured value. Option C is not relevant because eStreamer authentication does not use FTD Active Directory domain credentials.

Option D is not relevant because pxGrid client approval is a Cisco ISE/pxGrid concept, not part of the FMC eStreamer authentication flow. Option E is not relevant because SNMPv3 community strings apply to SNMP polling/traps on the management interface and have nothing to do with eStreamer client authentication.

Full explanation →
116
Multi-Selecthard

An administrator is planning a third-party SIEM integration with Cisco Secure Firewall Management Center. Which TWO methods or protocols are officially supported for exporting event data from the FMC to the SIEM? (Choose two)

Select 2 answers
A.eStreamer API / protocol over TCP port 8302
B.Exporting raw packet captures (PCAP) via FTP every 5 minutes
C.Syslog export (UDP or TCP/TLS) configured via FTD Platform Settings
D.Direct SQL database replication from the FMC internal PostgreSQL database over SSH
E.NetFlow v5 export from the FMC management interface
AnswersA, C

eStreamer is Cisco's supported event-export API, streaming FMC event data to a SIEM client over TCP port 8302. It satisfies the stem's requirement for an officially supported export method, delivering high-volume, structured events rather than relying on syslog alone.

Why this answer

Option A is correct because the eStreamer (Event Streamer) API is Cisco's officially supported client-server protocol for sending FMC event data to third-party SIEMs; the eStreamer server on the FMC listens on TCP port 8302 and streams events to a client installed on the SIEM host. Option C is correct because FMC supports syslog export of events, configured through FTD Platform Settings (Syslog settings), and can send syslog over UDP or TCP, including TCP with TLS encryption, to an external SIEM. Option B is not correct because exporting raw PCAP files via FTP is not an event-export integration method for SIEMs and is not an officially supported SIEM data feed.

Option D is not correct because direct SQL replication from the FMC's internal PostgreSQL database over SSH is unsupported and would violate Cisco's database access model. Option E is not correct because NetFlow export is a traffic-flow telemetry feature, not an FMC event-export method to a SIEM, and the FMC management interface does not provide NetFlow v5 export for this purpose.

Full explanation →
117
Multi-Selecthard

Which THREE items are synchronized across an FTD high availability pair?

Select 3 answers
A.NAT tables.
B.Management interface IP.
C.Connection/Session states.
D.Physical interface counters.
E.Configuration policies.
AnswersA, C, E

NAT tables are synchronised across the failover link so translated flows survive a unit switch. This satisfies the stem's synchronisation requirement, preserving address translation state and preventing existing connections from breaking during FTD high availability failover.

Why this answer

HA synchronization includes NAT tables, connection/session states, and the system configuration policies.

Full explanation →
118
Multi-Selecthard

An engineer is troubleshooting a scenario where Security Group Tags (SGTs) are not being enforced by FTD access control rules despite an active pxGrid connection between ISE and FMC. Which TWO potential causes should the engineer investigate? (Choose two)

Select 2 answers
A.The FTD management interface IP address is not registered in Active Directory.
B.The FMC eStreamer service is disabled, blocking SGT updates.
C.SXP peering or inline TrustSec header propagation is missing along the data path between the endpoint and the FTD interface.
D.Syslog facility local0 is not configured on the switch.
E.The Access Control policy rules do not have the corresponding Security Group Tags selected under the Users/SGT tab.
AnswersC, E

SGT enforcement requires the tag to survive transit, not merely reach FMC via pxGrid. Without SXP peering or inline TrustSec header propagation, the FTD interface receives untagged traffic, so access control rules matching SGTs cannot evaluate the endpoint's group.

Why this answer

Option C is correct because SGT enforcement on FTD requires that the tag actually reaches the device: either via inline TrustSec (Cisco Metadata) header propagation from the upstream switch, or via SXP peering that carries IP-to-SGT mappings to the FTD. If neither the inline tag nor an SXP-learned mapping is present on the data path, the FTD has no SGT to match even though pxGrid is up. Option E is correct because FTD access control rules must explicitly reference the SGT in the rule's source/destination (Users/SGT) condition; if no SGT object is selected in the rule, the rule cannot match tagged traffic regardless of pxGrid status.

Option A is incorrect because Active Directory registration of the FTD management IP is irrelevant to SGT propagation and enforcement. Option B is incorrect because eStreamer is a separate FMC event-streaming service for external consumers and is not the mechanism that delivers SGT mappings to FTD. Option D is incorrect because syslog facility local0 on a switch has no bearing on TrustSec tag propagation or FTD rule matching.

Full explanation →
119
Multi-Selectmedium

An administrator is planning the deployment of Cisco Secure Firewall Virtual in a public cloud environment (AWS or Azure). Which TWO deployment practices are recommended for ensuring high availability and performance? (Choose two)

Select 2 answers
A.Deploy multiple virtual network interfaces (NICs) to separate management, internal, and external traffic paths.
B.Disable Smart Licensing to avoid cloud internet egress fees.
C.Use physical serial console cables attached to the hypervisor for initial configuration.
D.Rely solely on single-NIC deployments with VLAN subinterfaces trunking all cloud traffic.
E.Select an instance type and throughput license tier that aligns with expected cloud throughput demands.
AnswersA, E

Separating management, internal and external traffic onto distinct virtual NICs prevents management-plane contention with data-plane throughput, satisfying the performance constraint. It also preserves out-of-band management reachability if a data interface fails, supporting availability. AWS and Azure both cap single-NIC bandwidth, so multiple interfaces aggregate capacity.

Why this answer

Option A is correct because Cisco Secure Firewall Virtual in AWS/Azure should be deployed with multiple virtual NICs so that management, inside (internal), and outside (external) traffic are separated onto distinct interfaces, which is required for proper traffic inspection and to avoid asymmetric routing or management-plane contention. Option E is correct because cloud instances have finite bandwidth and the firewall's licensed throughput must match the instance's capabilities; selecting an instance size and the corresponding throughput license tier (e.g., FTDv5/10/16/24/32/64 tiers) ensures the firewall can actually handle the expected traffic load without dropping or throttling. Option B is wrong because Smart Licensing (or Smart Licensing Using Policy) is the required licensing mechanism and disabling it would break entitlement and support; cloud egress fees are not a valid reason to disable it.

Option C is wrong because public cloud instances do not expose physical serial console cables to the hypervisor; initial configuration is done via the cloud console, SSH, or bootstrap/user-data. Option D is wrong because single-NIC deployments with VLAN subinterfaces are not the recommended HA/performance design in public clouds, where multiple ENIs/NICs are used to separate traffic paths and support scaling.

Full explanation →
120
MCQeasy

An administrator needs to schedule automated weekly backups of the FMC configuration and store them securely on a remote SCP server. Where is remote backup storage configured in the FMC GUI?

A.Devices > Device Management > Backup
B.System > Integration > SCP Servers
C.System > Tools > Backup / Restore > Remote Storage
D.Objects > Object Management > Servers > Backup
AnswerC

Remote SCP backup destinations are defined under System > Tools > Backup / Restore, where the Remote Storage tab holds server address, path and credentials. This satisfies the requirement to schedule automated weekly backups stored securely off-box.

Why this answer

Remote backup storage for FMC is configured under System > Tools > Backup / Restore > Remote Storage. This is where you specify the SCP server details for storing backups remotely.

Exam trap

The trap is confusing device backup with FMC system backup, or looking under Objects or Devices instead of System > Tools.

How to eliminate wrong answers

Option A is wrong because Devices > Device Management > Backup is for device backups, not FMC system backups. Option B is wrong because System > Integration > SCP Servers is not a valid path for backup configuration. Option D is wrong because Objects > Object Management > Servers > Backup is for defining server objects, not for configuring backup storage.

Full explanation →
121
MCQmedium

An engineer is configuring Cisco eStreamer to stream events from FMC to a third-party SIEM. The firewall security policy blocks incoming connections on port 8302 from the SIEM server to the FMC. Which device and interface are involved in listening for the eStreamer client connection?

A.The FTD data interface listening on TCP port 8302.
B.The FTD management interface listening on UDP port 514.
C.The ISE pxGrid node listening on TCP port 8910.
D.The FMC management interface listening on TCP port 8302.
AnswerD

The eStreamer server runs on the FMC itself, binding to its management interface and listening on TCP port 8302 for client connections from the SIEM. This satisfies the stem's constraint: the SIEM initiates inbound connections to that port, so the firewall policy must permit them.

Why this answer

The eStreamer server process runs on the Cisco Secure Firewall Management Center (FMC), listening on TCP port 8302 on its management interface.

Full explanation →
122
Multi-Selecthard

An administrator is designing a logging architecture where Cisco Secure Firewall Threat Defense exports connection and intrusion events to a third-party SIEM. Which TWO design principles should be followed to ensure security and scalability? (Choose two)

Select 2 answers
A.Disable all Access Control rule logging and enable eStreamer over unencrypted TCP port 8302.
B.Rely exclusively on FMC database storage without exporting events to any SIEM.
C.Implement Reliable Syslog (TCP/TLS) to ensure encrypted transmission and prevent packet loss during network congestion.
D.Configure all logs to be exported unencrypted via UDP port 514 across the internet.
E.Configure appropriate severity filters to prevent low-priority debug events from overwhelming SIEM storage and ingestion licenses.
AnswersC, E

Reliable Syslog over TCP/TLS satisfies both the security and scalability constraints: TLS encrypts event transmission to the third-party SIEM, while TCP's acknowledgement and retransmission prevent packet loss during congestion, unlike UDP-based syslog. This preserves event integrity and completeness as export volume scales.

Why this answer

Option C is correct because Reliable Syslog using TCP with TLS provides encrypted transport and TCP's acknowledgment/retransmission mechanisms prevent event loss during congestion, which is essential when exporting connection and intrusion events to a third-party SIEM. Option E is correct because applying appropriate severity filters ensures that only relevant events (e.g., higher-severity intrusion and connection events) are forwarded, preventing low-priority debug noise from exhausting SIEM storage capacity and ingestion license limits, which directly supports scalability. Option A is wrong because disabling Access Control rule logging removes valuable connection telemetry, and eStreamer on unencrypted TCP 8302 lacks transport encryption, undermining security.

Option B is wrong because relying solely on FMC database storage defeats the purpose of a SIEM architecture and provides no third-party correlation or long-term retention. Option D is wrong because exporting logs unencrypted over UDP 514 across the internet exposes sensitive event data to interception and UDP offers no delivery guarantee, causing packet loss.

Exam trap

300-710 SNCF often tests the false economy of UDP syslog and unfiltered logging, tempting candidates to pick 'send everything' or 'use UDP 514' as simple options when the exam wants TCP/TLS reliability plus severity filtering.

Full explanation →
123
MCQeasy

During a routine backup of the FMC, the administrator wants to ensure that the generated backup file contains critical historical events, configurations, and intrusion event data so that it can be fully restored to a replacement appliance if necessary. Which backup type should be selected in the FMC?

A.Manual Backup with both System Settings and Historical Event Data checkboxes enabled
B.RAID Controller Configuration Export
C.System Configuration Backup only
D.Snort Rule Update (SRU) Snapshot Backup
AnswerA

Selecting Manual Backup with both System Settings and Historical Event Data captures configurations plus historical events and intrusion data, satisfying the requirement for a fully restorable replacement appliance. The Historical Event Data checkbox is the specific element that includes event records; System Settings alone would omit them.

Why this answer

In FMC, a Manual Backup allows you to select both 'System Settings' and 'Historical Event Data' checkboxes. Enabling both ensures that the backup includes configurations, intrusion events, and other historical data, which is necessary for a full restore to a replacement appliance. This is the only backup type that captures both system configuration and event data.

Exam trap

The trap is assuming that a 'System Configuration Backup' includes everything; candidates must remember that historical event data is separate and must be explicitly selected to be included in the backup.

How to eliminate wrong answers

Option B is wrong because RAID Controller Configuration Export is not a backup type in FMC; it refers to exporting RAID settings from the underlying hardware, not FMC data. Option C is wrong because a System Configuration Backup only includes system settings and configurations, not historical event data, so it would not meet the requirement to include intrusion event data. Option D is wrong because Snort Rule Update (SRU) Snapshot Backup is not a valid FMC backup option; SRU updates are for Snort rules, not for backing up FMC data.

Full explanation →
124
Multi-Selectmedium

Which TWO of the following are valid high availability modes for FTD?

Select 2 answers
A.Active/Active (non-clustered).
B.Failover-on-demand.
C.Active/Standby.
D.Clustering.
E.Load-Balanced Passive.
AnswersC, D

Active/Standby is a valid FTD high availability mode, pairing two appliances so one actively forwards traffic while the peer stays ready to assume the role. It satisfies the question's requirement for a legitimate HA mode, alongside Active/Active, using stateful failover over a dedicated link.

Why this answer

Option C (Active/Standby) is correct because FTD supports a stateful failover HA pair in which one unit actively passes traffic while the standby unit synchronizes connection and state information and takes over if the active unit fails. Option D (Clustering) is correct because FTD supports clustering, where multiple FTD devices are grouped into a single logical cluster to provide both high availability and increased throughput/scalability. The other options are not valid FTD HA modes: Active/Active (non-clustered) is not a supported FTD failover mode, Failover-on-demand is not an FTD HA configuration, and Load-Balanced Passive is not a recognized FTD high availability mode.

Full explanation →
125
MCQeasy

In which mode does the FTD firewall act as a Layer 3 hop and perform NAT?

A.Passive mode
B.Inline mode
C.Routed mode
D.Transparent mode
AnswerC

Routed mode makes the FTD a Layer 3 hop, with each interface on a distinct IP subnet, so it forwards between networks and applies NAT translation. Transparent mode bridges at Layer 2 without NAT, and passive mode only monitors, so routed mode satisfies both constraints.

Why this answer

Routed mode is the standard deployment mode where the FTD operates as a Layer 3 device and supports NAT and routing protocols.

Full explanation →
126
MCQhard

An administrator is configuring static route tracking on a Cisco Secure Firewall Threat Defense deployment to handle link failure. If the tracked object goes down, the static route should be removed from the routing table. Where is this configuration managed when using Cisco FMC?

A.Under Devices > Device Management > Routing > Static Route, by editing the route and selecting a Monitor Track object.
B.Under Policies > Access Control > Routing Policies, by enabling SLA tracking hooks.
C.Under System > Configuration > High Availability > Route Tracking.
D.Under Objects > Object Management > SIEM > Route Track.
AnswerA

Editing the static route under Devices > Device Management > Routing > Static Route lets you attach a Track object, so the route is withdrawn from the routing table when the tracked object goes down. This satisfies the stem's requirement that link failure removes the route, and FMC pushes the tracked static route configuration to the managed threat defence device.

Why this answer

In Cisco FMC, static route tracking is configured by editing the static route itself under Devices > Device Management > Routing > Static Route, then selecting a Monitor Track object (SLA monitor) in the route's Track field. When the tracked object goes down, the route is removed from the routing table, enabling failover to a backup route. This is the only supported workflow for route tracking in FTD managed by FMC.

Exam trap

The trap here is confusing FMC's routing configuration location with policy or object menus; candidates often look under Access Control or Object Management instead of the device's Routing tab where static routes and their Track bindings actually live.

How to eliminate wrong answers

Option B is wrong because Access Control Policies govern traffic inspection and filtering, not routing table behavior, and there is no 'SLA tracking hooks' feature in ACP. Option C is wrong because System > Configuration > High Availability deals with failover and clustering settings, not per-route tracking. Option D is wrong because there is no 'SIEM > Route Track' object type in FMC Object Management; Monitor Track objects are SLA monitors, not SIEM artifacts.

Full explanation →
127
Multi-Selecthard

An administrator is preparing an upgrade plan for an FMC and its managed FTD devices. Which THREE best practices should be followed during the upgrade process to minimize downtime and avoid failure? (Choose three)

Select 3 answers
A.Take a complete backup of the FMC and export device configurations prior to starting the upgrade.
B.Always upgrade the FMC to the target version before upgrading any managed FTD devices.
C.Run the pre-upgrade checker script/package on the devices to identify potential blockers.
D.Factory reset all FTD devices immediately after pushing the upgrade package.
E.Disable the sftunnel service permanently during the upgrade to prevent packet inspection.
AnswersA, B, C

Capturing a full FMC backup plus exported FTD configurations before upgrading preserves the ability to roll back if the upgrade fails, directly satisfying the stem's requirement to avoid failure and minimise downtime. Cisco recommends this as a prerequisite step, since configuration loss without a restore point would extend an outage considerably.

Why this answer

Option A is correct because taking a full FMC backup and exporting FTD configurations before any upgrade provides a rollback point if the upgrade fails or corrupts data, which is essential for minimizing downtime. Option B is correct because Cisco's upgrade best practice requires the FMC to be upgraded to the target version first, since a newer FMC can manage older FTD versions but an older FMC cannot manage newer FTD devices, avoiding management incompatibility. Option C is correct because running the pre-upgrade checker (e.g., via the FTD CLI or the FMC upgrade readiness check) identifies blockers such as unsupported configurations, insufficient disk space, or deprecated features before the upgrade begins.

Option D is incorrect because factory resetting FTD devices after pushing an upgrade would erase the configuration and cause an outage, not minimize downtime. Option E is incorrect because the sftunnel is the management tunnel between FMC and FTD; disabling it permanently would break management and prevent the FMC from pushing the upgrade or policies, and it is not a valid upgrade practice.

Exam trap

The trap is selecting options that sound plausible but are harmful, such as factory resetting devices or disabling management services. Candidates must distinguish between necessary preparatory steps and actions that would disrupt operations.

Full explanation →
128
MCQeasy

Which interface configuration mode allows the FTD to handle traffic across multiple physical links as a single logical interface?

A.Redundant Interface
B.Bridge Group
C.Sub-interface
D.Port Channel
AnswerD

Port Channel aggregates multiple physical links into one logical interface, using EtherChannel to load-balance traffic and provide link redundancy. This satisfies the requirement for handling traffic across several physical links as a single logical interface.

Why this answer

A Port Channel (EtherChannel) aggregates multiple physical interfaces into a single logical interface, providing increased bandwidth, load balancing, and link redundancy. On Cisco Secure Firewall Threat Defense, port channels are configured in routed or transparent mode and use LACP or static mode to bundle links. This is the only interface mode listed that combines multiple physical links into one logical interface for traffic handling.

Exam trap

The trap is confusing 'redundant interface' with 'port channel' — both involve multiple physical links, but only port channel aggregates them into one logical interface for active/active traffic, while redundant is active/standby failover.

How to eliminate wrong answers

Option A is wrong because a Redundant Interface pairs two physical interfaces where only one is active at a time (active/standby), not a single logical interface carrying traffic across both links simultaneously. Option B is wrong because a Bridge Group is a transparent-mode construct that groups interfaces at Layer 2 for bridging, not for aggregating bandwidth across multiple physical links as one logical routed interface. Option C is wrong because a Sub-interface is a logical VLAN-tagged interface carved from a single physical interface (or port channel), not an aggregation of multiple physical links.

Full explanation →
129
Multi-Selecthard

An administrator is configuring Cisco ISE pxGrid integration with Cisco Secure Firewall Management Center. Which TWO identity sources or methods supported by ISE can provide context that is subsequently consumed by FTD via pxGrid? (Choose two)

Select 2 answers
A.Raw NetFlow v5 packet streams exported directly from core routers to the FMC
B.Guest WebAuth portal authentications
C.Active Directory / LDAP authentications via 802.1X or RADIUS
D.Local FTD administrator CLI login sessions
E.DHCP server static lease table text files imported manually into FMC
AnswersB, C

Guest WebAuth portal authentications supply identity context through ISE's guest services, where sponsor-approved or self-registered guest credentials are validated and published to pxGrid. This satisfies the stem's requirement for an ISE-supported identity source feeding FTD context, since guest sessions generate user-to-IP mappings that Secure Firewall Management Center consumes for policy enforcement.

Why this answer

Options B and C are correct because Cisco ISE pxGrid publishes identity and session context that it has learned from its own authentication and authorization services. Guest WebAuth portal authentications (B) are processed by ISE's guest services, so the resulting user identity, endpoint, and session attributes are available to be shared over pxGrid and consumed by FTD for identity-based policy. Active Directory / LDAP authentications via 802.1X or RADIUS (C) are core ISE identity sources; when users or machines authenticate through ISE against AD/LDAP, ISE maps that identity to the session and publishes it via pxGrid to FMC/FTD.

The other options do not belong: raw NetFlow v5 streams from routers (A) are traffic telemetry, not an ISE-supported identity source, and FMC does not ingest them as pxGrid identity context. Local FTD administrator CLI logins (D) are device-management events on the firewall itself, not ISE-authenticated user sessions. Manually imported DHCP static lease text files (E) are not an ISE pxGrid identity source and are not a supported method for providing ISE context to FTD.

Full explanation →
130
MCQmedium

Which object type should be used to represent a group of network subnets?

A.Host
B.Range
C.Port Group
D.Network Group
AnswerD

A Network Group object in Cisco Secure Firewall Management Center represents a collection of network subnets, satisfying the requirement to group subnets as a single reusable object. Unlike individual host or range objects, it aggregates multiple subnet entries, letting policies reference them collectively rather than listing each subnet separately.

Why this answer

A Network Group object allows you to aggregate multiple network subnets into a single object for policy efficiency.

Full explanation →
131
Multi-Selecteasy

Which THREE items are required to create a port channel on an FTD device?

Select 3 answers
A.A static route to the port channel
B.LACP configuration
C.Two or more physical interfaces
D.A physical bypass module
E.A logical Port-Channel interface
AnswersB, C, E

LACP negotiates the aggregation between devices.

Why this answer

To create a port channel on an FTD device, you must configure LACP (option B), which is the link aggregation protocol used to negotiate and bundle the member links, and you need two or more physical interfaces (option C) to serve as the members of the EtherChannel. You also must create a logical Port-Channel interface (option E), which is the aggregated interface that receives the IP configuration and is referenced by policies and routing, with the physical interfaces assigned to it. A static route to the port channel (option A) is not required to build the port channel itself; routing is configured separately after the interface exists.

A physical bypass module (option D) is a hardware fail-to-wire feature unrelated to forming a port channel and is not a prerequisite.

Full explanation →
132
Multi-Selectmedium

Which TWO of the following are valid reasons to use Transparent Mode?

Select 2 answers
A.To increase throughput by ignoring L3 headers.
B.To act as a Layer 3 gateway.
C.To enable dynamic routing.
D.Simplified L2 insertion.
E.Network address transparency.
AnswersD, E

Transparent Mode lets FTD sit inline as a bump-in-the-wire without re-addressing the existing network, so it can be inserted into an L2 segment without changing IP routing or topology, satisfying the simplified L2 insertion reason.

Why this answer

Option D is correct because Transparent Mode lets a firewall be inserted into an existing Layer 2 segment without requiring any IP addressing or routing changes, so deployment is a simple drop-in at the L2 level. Option E is correct because in Transparent Mode the device forwards traffic without acting as a router or NAT boundary, preserving the original source and destination IP addresses so the network remains address-transparent. Options A, B, and C are not valid reasons: Transparent Mode still inspects L3/L4 headers rather than ignoring them, it explicitly does not act as a Layer 3 gateway, and it does not provide dynamic routing, which requires an L3 interface and routing protocols.

Exam trap

300-710 SNCF often tests the confusion between transparent mode and routed mode capabilities, tempting candidates to select dynamic routing or Layer 3 gateway functions as benefits of transparent mode when those are routed-mode features.

Full explanation →
133
Multi-Selecthard

When considering virtual FTD deployments, which THREE factors significantly impact the performance of the instance?

Select 3 answers
A.The number of configured Access Control Rules
B.The amount of provisioned RAM
C.The number of active management sessions
D.The type of virtual network adapter
E.Number of allocated CPU cores
AnswersB, D, E

RAM governs the size of connection and translation tables the FTD can hold, plus Snort inspection memory. Under-provisioning causes table exhaustion and dropped flows, so provisioned RAM directly caps throughput and concurrent-session capacity in virtual deployments.

Why this answer

Option B is correct because the amount of provisioned RAM directly determines how much memory the virtual FTD can use for connection tables, Snort/Snort 3 inspection buffers, and other runtime data structures; insufficient RAM causes packet drops and degraded throughput. Option D is correct because the virtual network adapter type (for example, VMXNET3 versus E1000, or SR-IOV versus paravirtualized) determines whether traffic is offloaded to hardware, how many queues are available, and how much CPU overhead is incurred per packet, all of which strongly affect instance performance. Option E is correct because the number of allocated CPU cores governs how many Snort inspection instances and other processes can run in parallel, directly scaling inspection throughput and the ability to handle concurrent flows.

Option A is not correct because the number of configured Access Control Rules is a configuration/policy factor that affects rule lookup efficiency only marginally and is not one of the primary resource factors that determine virtual FTD instance performance. Option C is not correct because the number of active management sessions consumes only a small amount of control-plane resources and does not significantly impact the data-plane performance of the virtual FTD instance.

Exam trap

300-710 SNCF often tests whether candidates confuse policy complexity (number of ACP rules) with actual resource-driven performance — the trap is selecting 'number of Access Control Rules' as a performance factor instead of the true resource dimensions (RAM, vNIC type, CPU cores).

Full explanation →
134
MCQeasy

Which type of FTD interface should be configured to connect to a trunk port on a switch?

A.Physical interface without a VLAN ID.
B.Management interface.
C.Port channel interface.
D.Sub-interface with a VLAN tag.
AnswerD

A trunk port carries multiple VLANs tagged with 802.1Q headers, so the FTD must terminate those tags on a sub-interface. Each sub-interface maps a VLAN tag to a logical interface, letting one physical port serve several VLANs, which a plain physical interface cannot.

Why this answer

A sub-interface, when assigned a specific VLAN ID, is used to process traffic on a trunked link.

Full explanation →
135
MCQmedium

An administrator is configuring a NAT policy on FMC for an FTD device. The requirement is to translate the source IP address of internal users to a single public IP address when accessing the Internet, while preserving the source port. Which NAT type should be used?

A.Static NAT
B.Static PAT
C.Dynamic PAT
D.Dynamic NAT
AnswerC

Dynamic PAT, also known as NAT overload, translates multiple internal IP addresses to a single public IP address while using unique source ports to distinguish sessions. This meets the requirement of using one public IP and preserving the source port (by translating it to a unique port). It is the correct choice for allowing many internal users to share one public IP.

Why this answer

Dynamic PAT (NAT overload) allows multiple internal hosts to share a single public IP address by translating both the source IP and source port. This is the standard method for outbound Internet access from a private network. Static NAT and Static PAT are used for inbound access or one-to-one mappings, and Dynamic NAT without PAT does not allow multiple hosts to share one IP.

Exam trap

The trap here is confusing Dynamic NAT with Dynamic PAT; Dynamic NAT uses a pool of addresses and does not allow multiple hosts to share a single IP without port translation.

Full explanation →
136
MCQhard

When using clustering with FTD, what is the 'Flow Owner' in the context of traffic distribution?

A.The master unit that manages the configuration.
B.The unit that maintains the connection state for a specific flow.
C.Any unit that has the highest CPU availability.
D.The unit that performs the SSL decryption for the flow.
AnswerB

In FTD clustering, the flow owner is the single unit that holds and maintains the connection state for a given flow, ensuring stateful inspection consistency. Other units forward that flow's packets to it, satisfying the traffic distribution definition.

Why this answer

In FTD clustering, the Flow Owner is the unit that owns and maintains the connection state (session table entry) for a specific flow. All packets of that flow are forwarded to the Flow Owner, which performs stateful inspection and maintains the connection. This ensures stateful failover and consistent policy enforcement across the cluster, since only one unit owns the flow at a time.

Exam trap

The trap is assuming the master unit owns all flows or that flow ownership is dynamic based on CPU — candidates who don't know the 5-tuple hash/load-balancing mechanism pick the master or CPU-based distractors.

How to eliminate wrong answers

Option A is wrong because the master unit manages configuration and cluster control, but it does not own every flow — flow ownership is distributed across units for load balancing. Option C is wrong because flow ownership is not based on CPU availability; it is determined by a hash of the flow's 5-tuple (or a load-balancing algorithm) at the time the flow is established. Option D is wrong because SSL decryption is a feature applied by the Flow Owner if the policy requires it, but it is not the definition of Flow Owner — any unit can be a Flow Owner regardless of decryption.

Full explanation →
137
MCQeasy

An administrator wants to create a Port object group containing TCP ports 80, 443, and 8080 on the FMC. Where is this object configured?

A.Policies > Access Control > Ports
B.Devices > Device Management > Object Explorer
C.Objects > Object Management > Ports
D.System > Configuration > Port Groups
AnswerC

Port object groups are created under Objects > Object Management > Ports in the FMC, where individual TCP and UDP ports are defined and grouped. This location satisfies the requirement to build a group containing TCP ports 80, 443 and 8080.

Why this answer

Port object groups and individual ports are created under Objects > Object Management > Ports.

Full explanation →
138
Multi-Selecthard

Which THREE considerations must be addressed when deploying FTDv in a public cloud?

Select 3 answers
A.Integration with cloud route tables for failover.
B.VPC security group constraints.
C.Cloud-specific instance sizing.
D.Hardware bypass capabilities.
E.Clustering using local control links.
AnswersA, B, C

In public clouds, FTDv cannot rely on traditional Layer 2 failover, so it must integrate with cloud route tables to redirect traffic during failover. This satisfies the stem's requirement by addressing the routing mechanism needed for HA in that environment.

Why this answer

When deploying FTDv in a public cloud, integration with cloud route tables for failover (A) is required because FTDv cannot use traditional Layer 2 failover mechanisms; instead, failover is achieved by manipulating cloud provider route tables to redirect traffic to the standby instance. VPC security group constraints (B) must be addressed because security groups act as stateful virtual firewalls at the instance level and can block the management, data, and failover traffic that FTDv requires, so rules must be carefully configured. Cloud-specific instance sizing (C) is also essential because FTDv performance depends on the selected cloud instance type's CPU, memory, and network bandwidth, and supported instance sizes differ from on-premises hardware models.

Hardware bypass capabilities (D) do not apply because public cloud instances have no physical network interface cards or hardware bypass pairs. Clustering using local control links (E) is not applicable because FTDv clustering in public clouds uses cloud-native constructs and does not rely on dedicated local control-link interfaces as on physical appliances.

Full explanation →
139
MCQeasy

Which protocol is utilized by Cisco Secure Firewall Management Center and FTD devices to communicate with Cisco SecureX for cloud-delivered threat intelligence?

A.SNMPv2c
B.HTTPS (REST API over port 443)
C.TFTP
D.Syslog over UDP 514
AnswerB

SecureX integration relies on outbound HTTPS REST API calls over port 443, allowing FMC and FTD to query cloud-delivered threat intelligence without inbound firewall openings. This satisfies the stem's requirement for the communication protocol, since the SecureX cloud service exposes only TLS-secured REST endpoints, not syslog or NetFlow channels.

Why this answer

Cisco SecureX and cloud services communicate with Cisco Secure Firewall Management Center using REST APIs over HTTPS (port 443).

Full explanation →
140
MCQeasy

You are configuring static route tracking on an FTD device. What is the primary purpose of this configuration?

A.To load-balance traffic across ISPs.
B.To increase the throughput of the interface.
C.To dynamically adjust the MTU of the link.
D.To ensure traffic is only routed through a verified path.
AnswerD

Static route tracking monitors a specified target with ICMP probes, withdrawing the route from the routing table when that target becomes unreachable. This satisfies the stem's requirement by ensuring traffic only follows a path verified as live, rather than blackholing packets through a failed next hop.

Why this answer

Static route tracking allows the firewall to monitor the availability of a path using ICMP or other probes and remove the route from the routing table if the probe fails.

Full explanation →
141
MCQeasy

When deploying a Cisco Secure Firewall Threat Defense in transparent mode, how are the firewall interfaces configured to pass traffic between segments without routing?

A.Interfaces are grouped into a Bridge Virtual Interface (BVI) bridge group that acts as a Layer 2 bridge.
B.Interfaces are configured with dynamic NAT overload to translate Layer 2 MAC addresses into Layer 3 IPs.
C.The firewall acts as an 802.1Q trunk port where all VLANs are terminated on a single subinterface.
D.Each physical interface is assigned a distinct IP address in the same subnet.
AnswerA

Transparent mode uses a Bridge Virtual Interface grouping two interfaces into a bridge group, forwarding frames at Layer 2 without altering IP headers or performing routing; this lets the firewall sit inline between segments on the same subnet.

Why this answer

In transparent mode, the firewall bridges traffic between interfaces using a Bridge Virtual Interface (BVI). The BVI is assigned an IP address for management and Layer 3 functions, while the physical interfaces belong to the bridge group.

Full explanation →
142
MCQhard

An FTD device is deployed in routed mode with multiple security zones. An administrator needs to configure an Access Control rule that evaluates traffic flowing between two different security zones. How are security zones utilized in the rule?

A.Security zones replace IP address objects entirely in all rule configurations.
B.Security zones are used exclusively in NAT translation rules.
C.Security zones are selected under the Zones tab of an Access Control rule as Source and Destination.
D.Security zones are assigned globally in device platform settings, not in access rules.
AnswerC

Within an Access Control rule, security zones are chosen on the Zones tab, specifying which source and destination zones the rule matches. This lets the administrator evaluate traffic flowing between two different zones, satisfying the inter-zone inspection requirement.

Why this answer

In FMC, an Access Control rule includes a Zones tab where you select the source and destination security zones (interface groups) that the rule should match. Traffic flowing between two different security zones is matched by specifying those zones as Source and Destination in the rule, allowing zone-based policy enforcement.

Exam trap

SNCF often tests the misconception that security zones replace IP objects or are only for NAT, causing candidates to overlook that zones are selected as Source/Destination match criteria within Access Control rules.

How to eliminate wrong answers

Option A is wrong because security zones do not replace IP address objects; they are used alongside them as additional match criteria, and IP-based rules remain fully supported. Option B is wrong because security zones are used in Access Control rules (and other policies), not exclusively in NAT rules. Option D is wrong because security zones are not assigned globally in device platform settings; they are defined as interface objects and referenced within access control rules.

Full explanation →
143
Multi-Selecthard

Which THREE settings can be configured within a Prefilter Policy on the FMC? (Choose three)

Select 3 answers
A.Intrusion Policy signature tuning
B.FastPath action to bypass Snort inspection
C.Default Action for unmatched traffic (Analyze or FastPath)
D.Security Intelligence block lists
E.Tunnel rule handling (e.g., GRE, IPsec)
AnswersB, C, E

FastPath is a prefilter action that bypasses Snort inspection entirely for matching traffic, offloading it from the detection engine. This differs from access control rules, which pass traffic through Snort; FastPath is unique to the prefilter layer.

Why this answer

Option B is correct because a Prefilter Policy's central purpose is to let early-pass traffic skip deep inspection, and the FastPath action explicitly bypasses Snort so matching flows are forwarded without intrusion or file analysis. Option C is correct because every Prefilter Policy defines a Default Action applied to traffic that matches no prefilter rule, and that default is chosen as either Analyze (send to Snort for full inspection) or FastPath (bypass Snort). Option E is correct because Prefilter Policies include tunnel handling settings that let you analyze or fastpath tunneled traffic such as GRE and IPsec, including inspecting the outer or inner flow.

Option A is not part of a Prefilter Policy: Intrusion Policy signature tuning is configured in the Intrusion Policy itself, which the Prefilter Policy only references via the Analyze action. Option D is also not a Prefilter setting: Security Intelligence block lists are configured in the Access Control Policy's Security Intelligence tab, not in the Prefilter Policy.

Exam trap

The trap is mixing up Prefilter Policy settings with Access Control Policy settings. Candidates might think that any traffic-handling feature is part of Prefilter, but Intrusion Policy and Security Intelligence are separate.

Full explanation →
144
MCQmedium

You are troubleshooting a port channel failure on an FTD device. The port channel is 'Up/Down'. What is the most likely cause?

A.Insufficient license.
B.The FTD is in transparent mode.
C.Mismatched LACP configuration.
D.Physical cable damage.
AnswerC

An Up/Down port channel means the interface is administratively up but the bundle is not operational. Mismatched LACP settings between member links prevent the channel from forming, leaving the aggregate down while physical ports remain up.

Why this answer

An 'Up/Down' status for a port channel usually indicates that LACP negotiation is failing between the FTD and the connected switch.

Full explanation →
145
Multi-Selecthard

An enterprise security architect is designing an architecture where Cisco Secure Firewall Threat Defense integrates with a third-party SIEM. Which THREE methods or protocols are officially supported for exporting security events and logs from the FMC/Firewall to the third-party SIEM? (Choose three)

Select 3 answers
A.Direct SQL database replication from the FMC internal PostgreSQL database to the SIEM
B.Cisco SecureX / REST APIs for programmatic event retrieval
C.Syslog (UDP/TCP/TLS) forwarding from Platform Settings
D.SNMPv1 trap forwarding of full packet payloads
E.eStreamer API for custom client integrations
AnswersB, C, E

REST APIs, including Cisco SecureX, let a SIEM pull events programmatically over HTTPS rather than relying on pushed streams. This satisfies the requirement for an officially supported export method, complementing syslog and eStreamer for event retrieval.

Why this answer

Option B is correct because the FMC exposes documented REST APIs (and Cisco SecureX/Threat Response integrations) that allow programmatic retrieval of events, alerts, and metadata for third-party SIEM consumption. Option C is correct because syslog forwarding is configured under Platform Settings on the FMC/Firewall, supporting UDP, TCP, and TLS transports to send connection, intrusion, and audit events to external collectors. Option E is correct because eStreamer is Cisco's officially supported event-streaming API that lets custom clients receive real-time event data from the FMC for SIEM integration.

Option A is not supported: direct SQL replication against the FMC's internal PostgreSQL database is neither documented nor permitted, and would break support. Option D is not supported: SNMPv1 traps are used for health/status alerting, not for forwarding full packet payloads or complete security event logs.

Full explanation →
146
MCQeasy

An administrator wants to export a packet capture (.pcap file) taken on an FTD interface directly from the FMC GUI for offline analysis in Wireshark. Where should the administrator navigate?

A.System > Tools > Packet Export
B.Policies > Access Control > Advanced > Packet Capture
C.Analysis > Captures or Devices > Device Management > Packet Capture
D.Objects > Object Management > Captures
AnswerC

Captured packets are retrieved from Analysis > Captures, where the .pcap can be downloaded for Wireshark. The Devices > Device Management > Packet Capture path only configures capture parameters, so the Analysis route satisfies the stem's requirement to export the file directly from the FMC GUI.

Why this answer

To export a packet capture (.pcap) taken on an FTD interface from the FMC GUI, the administrator navigates to Analysis > Captures or Devices > Device Management > Packet Capture. These locations provide access to captures stored on the FTD, allowing download of the .pcap file for offline analysis in Wireshark.

Exam trap

300-710 SNCF often tests FMC GUI navigation paths — candidates confuse where packet captures are exported (Analysis > Captures or Device Management) with unrelated menus like System > Tools or Objects > Object Management.

How to eliminate wrong answers

Option A is wrong because System > Tools > Packet Export does not exist in the FMC GUI — there is no such menu path. Option B is wrong because Policies > Access Control > Advanced > Packet Capture is not where captures are exported; access control policies may reference captures but do not provide the export function. Option D is wrong because Objects > Object Management > Captures is not a valid path — object management handles reusable objects, not packet capture files.

Full explanation →
147
MCQmedium

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslogs to a third-party SIEM. To ensure confidentiality of sensitive log data traversing untrusted network segments, how should the syslog export be configured?

A.Configure Reliable Syslog utilizing TCP with TLS encryption under Platform Settings > Syslog.
B.Configure HTTPS POST requests in the eStreamer client configuration.
C.Enable Secure Shell (SSH) port forwarding for UDP port 514.
D.Tunnel all UDP syslog packets inside an IPsec VPN tunnel terminated on the FMC management interface.
AnswerA

Reliable Syslog over TCP with TLS encrypts log payloads in transit, satisfying the stem's confidentiality requirement across untrusted segments. Plain UDP syslog would expose sensitive data, so enabling TLS under Platform Settings > Syslog is the correct mechanism.

Why this answer

To secure syslog transmission, administrators configure Reliable Syslog, which uses TLS encryption over TCP (typically on TCP port 6514) between the FTD and the SIEM syslog collector.

Full explanation →
148
MCQmedium

An FTD device is dropping packets unexpectedly. An engineer runs a packet tracer via the FTD diagnostic CLI using 'system support diagnostic-cli' and enters the command: 'packet-tracer input inside tcp 192.168.1.50 12345 10.0.0.5 80'. The output shows a drop at the 'Access-Rule' phase with the action 'DROP'. What does this indicate?

A.The NAT translation table lacks a dynamic PAT port allocation for the source IP.
B.An Access Control Policy rule matched the connection parameters and was configured with an action of Block or Block with reset.
C.The FTD routing table does not have a valid route back to the source IP 192.168.1.50.
D.The SSL decryption policy failed to validate the server certificate for 10.0.0.5.
AnswerB

The packet-tracer output shows the connection was evaluated against the Access Control policy and matched a rule whose action blocks it. The Access-Rule phase drop therefore indicates an explicit Block or Block with reset action, not a default or prefilter drop.

Why this answer

In FTD packet-tracer output, the 'Access-Rule' phase evaluates the connection against the Access Control Policy. A DROP action at this phase means an ACP rule matched the 5-tuple and was configured with Block or Block with Reset, so the packet is denied before further inspection. This is the definitive indicator that policy, not routing or NAT, caused the drop.

Exam trap

The trap is that candidates attribute any drop to routing or NAT, but packet-tracer's phase label precisely identifies which pipeline stage caused the drop, and Access-Rule unambiguously means policy.

How to eliminate wrong answers

Option A is wrong because NAT failures appear in the 'NAT' or 'Route' phase of packet-tracer, not the Access-Rule phase, and would show a different drop reason. Option C is wrong because a missing return route would surface in the 'Route' phase as 'no route to destination' or similar, not at Access-Rule. Option D is wrong because SSL decryption failures appear in the 'SSL' or 'Decrypt' phase and would reference certificate validation, not an access rule drop.

Full explanation →
149
MCQeasy

An administrator is configuring Cisco Secure Firewall Threat Defense to send connection and intrusion events to a third-party SIEM. Which protocol and port are natively supported by the eStreamer client integration for streaming events from the firewall?

A.TCP port 514 using standard Syslog
B.TCP port 9997 using Splunk Forwarder protocol
C.UDP port 443 using HTTPS
D.TCP port 8302 using the eStreamer API
AnswerD

TCP port 8302 carries eStreamer's proprietary binary event stream, which the third-party SIEM consumes via the eStreamer client API rather than syslog. This satisfies the stem's requirement for native streaming of connection and intrusion events, since eStreamer is Cisco Secure Firewall Threat Defense's purpose-built event export mechanism.

Why this answer

The Cisco eStreamer (Event Streamer) daemon on Secure Firewall Threat Defense communicates with external clients over TCP port 8302, using a securely negotiated SSL/TLS connection.

Full explanation →
150
Multi-Selectmedium

Which THREE configuration settings must be verified on the FMC when troubleshooting syslog export issues to a third-party SIEM receiver? (Choose three)

Select 3 answers
A.Syslog server IP address and port configuration in Platform Settings
B.pxGrid client approval status in Cisco ISE
C.Protocol selection (UDP, TCP, or TLS) matching the SIEM collector capability
D.eStreamer client certificate validity
E.Access Control rule logging options enabled to log at beginning or end of connection
AnswersA, C, E

Platform Settings defines the destination syslog server IP and port that the FMC uses for event export, so verifying these confirms the SIEM receiver is reachable at the expected address. If the IP or port is wrong, or the port mismatches the receiver's listener, syslog messages never arrive, directly satisfying the stem's export-failure constraint.

Why this answer

Option A is correct because the syslog server IP address and port must be configured under Platform Settings > Syslog on the FMC; if the destination host or port is wrong or missing, no events will reach the third-party SIEM receiver. Option C is correct because the transport protocol selected on the FMC (UDP, TCP, or TLS) must match what the SIEM collector is listening for and can decode; a mismatch such as sending UDP to a TCP/TLS-only collector silently drops the events. Option E is correct because Access Control rule logging must be enabled with the appropriate log action (log at beginning and/or end of connection) for connection events to be generated and forwarded to syslog; without logging enabled on the relevant rules, there is nothing to export.

Option B does not belong because pxGrid client approval in Cisco ISE relates to pxGrid-based identity and context sharing, not to FMC syslog export to a SIEM. Option D does not belong because eStreamer uses its own client certificate and is a separate event-streaming mechanism from syslog export, so its certificate validity is irrelevant to troubleshooting syslog delivery.

Full explanation →
Page 1

Page 2 of 5

Page 3

All pages

12345

Practice 300-710 SNCF by domain

Target a specific domain to shore up weak areas.

ConfigurationDeploymentManagement And TroubleshootingIntegration
See all domains with question counts →