Cisco Securing Networks with Cisco Firewalls (300-710 SNCF, CCNP Security) (300-710 SNCF) (300-710 SNCF) — Questions 151–225

An administrator is troubleshooting an eStreamer client script failure where the connection is refused on port 8302. Which TWO potential causes should the administrator investigate? (Choose two)

An administrator wants to configure Access Control rules on Cisco Secure Firewall Threat Defense using identity context received from Cisco ISE via pxGrid. Which TWO criteria can be utilized in the Access Control policy rule configuration once pxGrid is fully integrated? (Choose two)

An administrator is analyzing a troubleshooting scenario involving Snort inspection crashes on an FTD device. Which THREE locations or tools should the administrator check to diagnose why the Snort process restarted or crashed? (Choose three)

An organization integrates Cisco Secure Firewall Threat Defense with Cisco ISE via pxGrid. The security team notices that identity rules are matching incorrect users for traffic originating from shared Citrix terminal servers or Virtual Desktop Infrastructure (VDI) multi-user hosts. What mechanism must be enabled and configured to properly handle multi-user IP identity attribution on Secure Firewall?

An administrator is troubleshooting an eStreamer client connection between a Python script and the Cisco FMC. The script fails to authenticate. Which TWO items must be verified regarding the eStreamer client credentials? (Choose two)

An administrator successfully restores an FMC backup onto a freshly deployed FMC virtual appliance of the exact same software version. However, after the restore completes, all managed FTD devices show a status of 'Offline' or 'Config Apply Failed'. What is the most likely root cause and correct resolution?

An organization integrates Cisco Secure Firewall Threat Defense with Cisco SecureX (now Cisco Security Cloud Control / Cisco XDR) for threat intelligence and incident response. When investigating an indicator of compromise (IoC) on SecureX, an administrator triggers a block action for a malicious file hash. How is this block action enforced across the managed Secure Firewall Threat Defense devices?

An administrator is planning a third-party SIEM integration with Cisco Secure Firewall Management Center. Which TWO methods or protocols are officially supported for exporting event data from the FMC to the SIEM? (Choose two)

Which THREE items are synchronized across an FTD high availability pair?

An engineer is troubleshooting a scenario where Security Group Tags (SGTs) are not being enforced by FTD access control rules despite an active pxGrid connection between ISE and FMC. Which TWO potential causes should the engineer investigate? (Choose two)

An administrator is deploying a new Cisco Secure Firewall Threat Defense device and needs to ensure that the firewall performs layer 3 routing while keeping the existing subnet architecture completely transparent to the upstream router. Which firewall mode must be selected during initial configuration?

An FMC administrator needs to back up configuration data and event data for disaster recovery. Which backup type includes both system configurations and historical event data stored in the database?

An administrator is planning the deployment of Cisco Secure Firewall Virtual in a public cloud environment (AWS or Azure). Which TWO deployment practices are recommended for ensuring high availability and performance? (Choose two)

An administrator needs to schedule automated weekly backups of the FMC configuration and store them securely on a remote SCP server. Where is remote backup storage configured in the FMC GUI?

An engineer is configuring Cisco eStreamer to stream events from FMC to a third-party SIEM. The firewall security policy blocks incoming connections on port 8302 from the SIEM server to the FMC. Which device and interface are involved in listening for the eStreamer client connection?

An administrator is designing a logging architecture where Cisco Secure Firewall Threat Defense exports connection and intrusion events to a third-party SIEM. Which TWO design principles should be followed to ensure security and scalability? (Choose two)

During a routine backup of the FMC, the administrator wants to ensure that the generated backup file contains critical historical events, configurations, and intrusion event data so that it can be fully restored to a replacement appliance if necessary. Which backup type should be selected in the FMC?

Which TWO of the following are valid high availability modes for FTD?

A network engineer is deploying a Firepower Threat Defense (FTD) device and must configure NAT to translate an internal server IP of 10.10.10.50 to a public IP of 203.0.113.50 while preserving the original source port for inbound traffic. Which NAT type accomplishes this?

In which mode does the FTD firewall act as a Layer 3 hop and perform NAT?

An administrator is troubleshooting a policy deployment failure from the Firepower Management Center (FMC) to a managed Firepower Threat Defense (FTD) device. The deployment hangs at 33 percent with an error related to snort synchronization. Which tool should the administrator use on the FTD CLI to examine the real-time Snort rule compilation and policy application process?

An administrator is configuring static route tracking on a Cisco Secure Firewall Threat Defense deployment to handle link failure. If the tracked object goes down, the static route should be removed from the routing table. Where is this configuration managed when using Cisco FMC?

An administrator is preparing an upgrade plan for an FMC and its managed FTD devices. Which THREE best practices should be followed during the upgrade process to minimize downtime and avoid failure? (Choose three)

Which interface configuration mode allows the FTD to handle traffic across multiple physical links as a single logical interface?

You are configuring High Availability for two FTD devices. Which TWO conditions must be met for a successful failover state? (Choose two)

An administrator is configuring Cisco ISE pxGrid integration with Cisco Secure Firewall Management Center. Which TWO identity sources or methods supported by ISE can provide context that is subsequently consumed by FTD via pxGrid? (Choose two)

During an upgrade of an FTD device managed by FMC, the pre-checks fail because of insufficient disk space in the target upgrade partition. Which CLI command sequence should the administrator use to safely clean up previous upgrade installation files and temporary packages?

Which object type should be used to represent a group of network subnets?

Which THREE items are required to create a port channel on an FTD device?

Which TWO of the following are valid reasons to use Transparent Mode?

When considering virtual FTD deployments, which THREE factors significantly impact the performance of the instance?

Which type of FTD interface should be configured to connect to a trunk port on a switch?

Which TWO interface modes are available when configuring an intrusion prevention (NGIPS) security policy on a Cisco Secure Firewall Threat Defense device? (Choose two)

When using clustering with FTD, what is the 'Flow Owner' in the context of traffic distribution?

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a SIEM. Which TWO settings in Platform Settings determine how syslog messages are formatted and transmitted? (Choose two)

An administrator wants to create a Port object group containing TCP ports 80, 443, and 8080 on the FMC. Where is this object configured?

An enterprise integrates Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. The security team wants to ensure that when an administrator quarantines a host in Cisco SecureX, the firewall immediately drops active connections from that host without waiting for the FMC policy deployment cycle. How does SecureX achieve immediate enforcement on FTD?

Which THREE considerations must be addressed when deploying FTDv in a public cloud?

When deploying Cisco Secure Firewall Threat Defense in transparent mode, which TWO operational characteristics or restrictions apply to the deployment? (Choose two)

Which protocol is utilized by Cisco Secure Firewall Management Center and FTD devices to communicate with Cisco SecureX for cloud-delivered threat intelligence?

A security engineer is deploying a Cisco Secure Firewall Threat Defense device inline in front of a critical server farm. The goal is to inspect all incoming and outgoing traffic for intrusions without modifying the IP addressing schema of the servers. Which interface mode should be configured on the FTD device?

When troubleshooting FTD policy deployment, which THREE of the following are common reasons for a deployment to fail?

You are configuring static route tracking on an FTD device. What is the primary purpose of this configuration?

Which TWO fields are commonly used in the 'NAT Rule' editor to define the source address?

When deploying a Cisco Secure Firewall Threat Defense in transparent mode, how are the firewall interfaces configured to pass traffic between segments without routing?

An FTD device is deployed in routed mode with multiple security zones. An administrator needs to configure an Access Control rule that evaluates traffic flowing between two different security zones. How are security zones utilized in the rule?

An administrator configures Cisco Secure Firewall Threat Defense to send connection logs to a syslog server. However, the syslog server receives logs with source IP addresses belonging to the FMC management interface rather than the FTD data interface IP address. What is the correct way to ensure syslog messages are sent directly from the FTD data or management interface as intended?

Which THREE settings can be configured within a Prefilter Policy on the FMC? (Choose three)

You are troubleshooting a port channel failure on an FTD device. The port channel is 'Up/Down'. What is the most likely cause?

When deploying a Cisco Secure Firewall Threat Defense virtual appliance (FPRv) in a public cloud environment such as Microsoft Azure, which TWO architectural considerations or limitations must be accounted for? (Choose two)

An enterprise security architect is designing an architecture where Cisco Secure Firewall Threat Defense integrates with a third-party SIEM. Which THREE methods or protocols are officially supported for exporting security events and logs from the FMC/Firewall to the third-party SIEM? (Choose three)

An administrator wants to export a packet capture (.pcap file) taken on an FTD interface directly from the FMC GUI for offline analysis in Wireshark. Where should the administrator navigate?

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslogs to a third-party SIEM. To ensure confidentiality of sensitive log data traversing untrusted network segments, how should the syslog export be configured?

An FTD device is dropping packets unexpectedly. An engineer runs a packet tracer via the FTD diagnostic CLI using 'system support diagnostic-cli' and enters the command: 'packet-tracer input inside tcp 192.168.1.50 12345 10.0.0.5 80'. The output shows a drop at the 'Access-Rule' phase with the action 'DROP'. What does this indicate?

An administrator is configuring Cisco Identity Services Engine (ISE) integration with Cisco Secure Firewall Threat Defense using TrustSec. Which protocol is primarily utilized to exchange Security Group Tags (SGTs) and SGs to IP mappings directly between the ISE policy service node and the firewall?

An administrator is configuring Cisco Secure Firewall Threat Defense to send connection and intrusion events to a third-party SIEM. Which protocol and port are natively supported by the eStreamer client integration for streaming events from the firewall?

An engineer is troubleshooting a packet capture configuration on an FTD device managed by FMC. Which THREE statements regarding FTD packet capture behavior and limitations are correct? (Choose three)

Which THREE configuration settings must be verified on the FMC when troubleshooting syslog export issues to a third-party SIEM receiver? (Choose three)

What is the purpose of 'Network Discovery' in FMC?

An FMC administrator is configuring a URL Filtering policy. They want to block URLs categorized as 'Hacking' while logging the event. Where is this configured within the Access Control Policy?

When configuring an NGIPS appliance in passive mode, how does the system handle traffic flow to ensure monitoring without impacting the production network?

An administrator wants to ensure that all security event logs from Cisco Secure Firewall Threat Defense are exported reliably and in real time to external security analytics tools. Which TWO deployment and configuration practices should be implemented? (Choose two)

An administrator is troubleshooting an eStreamer integration where custom Python client scripts fail to receive events from the FMC. The administrator verifies that network connectivity, certificates, and user permissions are correct. Upon running the client script in verbose mode, the error indicates an 'Incompatible Protocol Version' between the client SDK and the FMC. How is this resolved?

You are configuring a NAT rule for a web server located in a DMZ. You want to translate the destination IP from a public address to the private DMZ address. Which NAT type is used?

An administrator is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) in Microsoft Azure. The architecture calls for a 3-NIC deployment (Management, Inside, and Outside). After deployment, asymmetric routing issues are observed because Azure Load Balancer is forwarding return traffic directly back to a different backend instance. What configuration must be applied to prevent asymmetric drops?

An administrator is preparing to deploy Cisco Secure Firewall Threat Defense in passive NGIPS mode connected to a Catalyst switch. Which TWO configuration steps on the switch and firewall are necessary for successful packet inspection? (Choose two)

An administrator wants to ensure that packet captures taken on an FTD can be analyzed easily. Which TWO ways can packet capture files (.pcap) be retrieved from the FMC? (Choose two)

An administrator is configuring manual NAT and needs to specify an interface pair (Source Interface and Destination Interface). Why is defining interface objects important in manual NAT rules?

How do you enable 'High Availability' (HA) for an FTD pair managed by FMC?

An administrator is configuring Access Control Policy rules on the FMC. The default action for unmatched traffic is currently set to Block. The requirement is changed so that unmatched traffic should pass through the FTD without inspection. Where is this setting modified?

An engineer is troubleshooting a stateful failover issue in a Cisco Secure Firewall Threat Defense Active/Standby high availability pair. The firewall units are passing data traffic, but failover state synchronization fails. Which dedicated interface must be verified for correct physical connectivity and configuration?

An engineer is troubleshooting a Cisco Secure Firewall Threat Defense clustering deployment where configuration synchronization between the control node and a data node has failed. Which THREE diagnostic steps or log sources should the engineer check? (Choose three)

Which component in Cisco Secure Firewall architecture is responsible for generating Security Intelligence feeds and synchronizing them with Cisco SecureX threat intelligence?

When configuring manual NAT on an FTD device, which THREE options are available for configuring the Translated Source? (Choose three)

Which TWO details are typically required when establishing a pxGrid connection between Cisco ISE and the Firepower Management Center? (Choose two)