Cisco Securing Networks with Cisco Firewalls (300-710 SNCF, CCNP Security) (300-710 SNCF) (300-710 SNCF) — Questions 151–225

Network Discovery passively maps hosts, operating systems, and user activity by analysing traffic mirrored from managed devices, satisfying the requirement to identify endpoints and associated users without inline inspection. It populates the network map and host profiles used for access control and event correlation, distinguishing it from active scanning or policy enforcement functions.

The URLs tab within an Access Control rule holds URL Filtering settings, where you select categories such as Hacking and set the action to Block with logging enabled. This satisfies the requirement to block and log within the existing Access Control Policy, rather than a separate policy type.

A SPAN or TAP port delivers a mirrored copy of production traffic, so the NGIPS analyses packets out-of-band without sitting inline. This satisfies the passive-mode constraint: no traffic traverses the appliance, so inspection cannot drop, delay, or alter production flows, while full detection and monitoring continue.

Reliable Syslog over TCP with TLS satisfies the real-time, guaranteed-delivery constraint by using connection-oriented transport with acknowledgement and retransmission, unlike UDP syslog which drops events silently. TLS encrypts the stream, meeting the secure export requirement to external analytics tools without relying on best-effort delivery.

The eStreamer protocol version is negotiated between the client SDK and the FMC's eStreamer server; a mismatch produces the 'Incompatible Protocol Version' error even when connectivity, certificates, and permissions are valid. Updating the client SDK to a release matching the FMC software version restores compatible protocol negotiation, satisfying the stem's version-compatibility constraint.

The Application Filter is used within an Access Control rule to identify applications and application categories. By selecting the social networking category and setting the action to Block, the administrator can block those applications while allowing business applications. This is the correct method for application control in FTD.

Interface objects bind the NAT rule to a defined source and destination interface pair, so translation applies only to traffic traversing that path. This scoping prevents the rule from matching unrelated traffic on other interfaces, satisfying the stem's requirement to constrain translation.

FMC integrates with ISE via pxGrid to receive user identity and session information. The pxGrid service must be enabled on ISE, and FMC must subscribe to the appropriate topic, typically session directory, to receive updates. This is the correct configuration to allow FMC to learn user identities.

HA is a device-level configuration.

A managed FTD shows a green check and 'Managed' status in Device Management, and Health Monitor populates with live CPU, memory, and interface metrics. These indicators together confirm the management tunnel and heartbeat are operational, which is required before the device can be added to an HA pair.

Stateful failover requires a dedicated failover and state link to replicate connection state between peers. If this interface lacks physical connectivity or matching configuration, units still pass traffic independently but cannot synchronise state, so failover breaks.

The 'show cluster info' and 'show cluster state' commands expose node membership, roles and synchronisation status directly from the firewall CLI. They confirm whether the data node has joined the cluster and whether configuration is in sync, isolating the failure to membership or replication.

Manual NAT permits the translated source to be a specific host or network object, giving one-to-one or many-to-one translation to a defined address. This satisfies the stem's requirement by naming a concrete translated source type available in FTD's manual NAT configuration.

Connection events are one of the three natively streamed eStreamer record types, carrying session metadata such as source and destination IP, ports, and action, which the FMC exports directly to a third-party SIEM without extra parsing.

pxGrid certificate enrolment requires the firewall to validate the ISE pxGrid node's certificate chain. In a standalone FMC deployment, if the ISE pxGrid root CA certificate is absent from the FMC trusted certificates store, validation fails and trust cannot be established.

The cluster control link carries heartbeat and health-check messages between FTD nodes, letting each unit detect peer liveness and trigger failover when a node stops responding. This satisfies the stem's requirement for the mechanism determining whether a node remains active within the cluster.

Manual NAT processes rules in order, so placing an identity rule for traffic to the internal server farm above the dynamic PAT rule ensures that server-bound traffic is not translated while internet-bound traffic is translated to the outside interface. This ordering gives precise control and satisfies both requirements in a single policy.

Setting the action to Allow with Intrusion Prevention enabled ensures that only traffic matching the rule is inspected by Snort. Other traffic that does not match this rule will be handled by subsequent rules, potentially with different inspection levels. This minimizes performance impact because only the specified subnet's traffic undergoes deep inspection. This is the correct approach to selectively apply IPS.

Identical software versions are mandatory because configuration and state synchronisation between FTD HA peers relies on matching internal schema and database formats. A version mismatch prevents the active unit from replicating configuration and connection state to the standby, breaking failover. This directly satisfies the stem's requirement for successful synchronisation across both units.

Application criteria match traffic by identifying the specific application or application category, using Cisco's Next-Generation Firewall application detectors rather than port alone. This satisfies the stem's requirement for a match criterion in an Access Control Policy rule, letting you enforce policy on evasive applications that hop ports or use encryption.

Interactive Block presents a warning page requiring the user to acknowledge and continue, satisfying the stem's requirement for a warning rather than a hard block. Block would deny outright; Allow would permit silently. This action matches the "Potentially Damaging Content" category behaviour requested.

Loss of heartbeat on the failover link causes the standby unit to assume the active peer has failed, so it transitions itself to Active and takes over traffic forwarding. This split-brain risk is why a dedicated, reliable failover link is required.

Packet Tracer shows how the configuration would handle a specific flow, through routing, NAT, access control policy and Snort, without sending any packet. That makes it ideal for confirming policy allows a flow, but useless for intermittent loss, which depends on real conditions such as congestion, interface errors or an asymmetric path. Pair it with captures on the actual interfaces to see real packets.

The Task Manager records every deployment attempt and its validation messages, so it satisfies the need to view detailed failure reasons and task history. Deployment Validation Errors surface here rather than in FMC health monitors or device logs.

Port Channels aggregate multiple physical links into one logical EtherChannel, providing the bandwidth and even traffic distribution clustered Threat Defense nodes require across the switch infrastructure. The stem's scaling constraint is satisfied because the cluster's inter-node and data traffic spreads across bundled links, preventing any single uplink becoming a bottleneck.

FMC's pxGrid client import requires a PKCS#12 bundle, since this single encrypted container carries the client certificate, its matching private key, and the CA chain together. That satisfies the stem's constraint of exporting both certificate and keystore from ISE, as PEM or DER files hold no private key and cannot complete the mutual TLS handshake.

Non-Promiscuous mode makes the interface accept only frames addressed to its own MAC. Traffic forwarded by an upstream device to other destinations is therefore ignored, so the FTD cannot inspect flows not explicitly directed at it.

A network object group must contain at least one member object, such as a host, network, or range, since the group exists solely to bundle them for policy reuse. An empty group is functionally useless, making member objects the second mandatory element.

System > Licenses > Smart Licenses displays the FMC's registration status and the active feature subscriptions, including URL Filtering, Malware and IPS. This is the single GUI location where an administrator verifies which entitlements are currently enabled and consumed.

Security Zones bind one or more interfaces into a named logical group, so Access Control Policy rules reference the zone rather than individual interfaces. This satisfies the requirement for simplified, consistent policy application across the Threat Defense device's interfaces.

The Reason field records the specific policy or engine decision that produced the block, such as an access control rule or intrusion policy drop. It directly explains why the connection was denied, unlike generic action or verdict fields.

FTDv sizing determines the vCPU, memory and disk allocation needed to sustain the targeted throughput; under-provisioning causes packet drops and unsupported performance. Meeting Cisco's published sizing guidelines is therefore a prerequisite for proper operation on VMware ESXi.

Precise timestamp formatting configured in Platform Settings satisfies the SIEM parsing constraint: consistent UTC or local timestamps let the SIEM correlate events across devices and build accurate timelines during incident investigation. Without standardised time, log correlation and forensic reconstruction become unreliable.

The 'show tech-support' command generates a comprehensive troubleshooting file that includes configuration, logs, and diagnostic data. This is the standard command to collect information for TAC cases. It outputs a large amount of data that can be redirected to a file for analysis. It is specifically designed for this purpose, making it the correct choice for gathering detailed system information.

SecureX integration authenticates using a client ID and API key generated in the Security Cloud Control console. Regenerating these credentials and updating them under FMC System > Integration > SecureX restores the expired or invalid token trust.

Auto NAT, or object NAT, is defined on a single network object, here the internal subnet, and translates only that object's source address between the chosen interfaces or zones. For outbound internet access it is usually dynamic PAT to the outside interface address. It is the simplest and recommended way to do ordinary source NAT, while manual NAT is reserved for translations that depend on the destination or need precise ordering.

After installing the eStreamer service on the FMC, you must configure the eStreamer server to accept connections from the client's IP address. This is done by adding the client's IP to the eStreamer configuration on the FMC. Without this, the client's connection attempts will be rejected, even if the certificate is valid. This is a necessary step to establish connectivity.

Static and dynamic routing for a managed FTD is configured under Devices > Device Management, editing the device and opening the Routing tab, which exposes virtual routers, static routes and dynamic routing protocols. This satisfies the requirement to view and modify routing configuration in the FMC GUI.

FastPath bypasses Snort inspection entirely for matching traffic, satisfying the requirement to fast-path the trusted backup stream. Access Control rules instead block or allow with inspection, so FastPath is the only action that skips intrusion analysis while permitting the flow between data centres.

Security Group Tags are identity attributes delivered via pxGrid, so the FMC exposes them on the Users tab of the Access Control rule. Selecting the Contractors SGT there matches traffic by ISE-assigned identity rather than by IP address or port.

Cluster control traffic carries heartbeat and state replication, so it demands a dedicated, low-latency link isolated from data interfaces. Sharing that path with data traffic introduces latency and jitter that can trigger false failover or split-brain conditions.

The Health Monitor in FMC provides a centralized dashboard that displays the status of managed devices, including CPU, memory, interface status, and other health metrics. It collects data from all registered FTD devices and alerts on threshold violations. This is the correct tool for viewing overall health status from one location after configuration changes.

Stateful failover replicates connection state and inspection tables between the active and standby units, so established TCP sessions continue without re-establishment when failover occurs. The failover link must be a dedicated interface or the same interface with a separate VLAN. Without stateful failover, the standby unit would drop existing sessions because it lacks the state information.

SXP propagates Security Group Tags to devices that cannot read inline SGT tags, such as older switches and third-party equipment, extending enforcement across network boundaries. This satisfies the stem's integration requirement by letting Cisco Secure Firewall apply consistent group-based policy wherever traffic traverses, without relying on IP addresses.

User Defined Routes override Azure's system routes, so asymmetric or misdirected traffic between the external and internal ENIs causes the intermittent drops described. Verifying UDR entries confirms each subnet steers packets to the correct FTDv interface, satisfying the stem's requirement to check Azure-side routing configuration.

The frequency interval sets how often the tracking probe is sent to the target, expressed in seconds. It satisfies the stem's requirement by defining probe timing, whereas the timeout value governs how long the system waits before declaring the tracked object unreachable.

The sftunnel uses encrypted TLS for management.

Analysis > Connections > Events shows connection events recorded by the managed FTD, including 5-tuple details, the access control rule that permitted or blocked the flow, and associated user or application metadata. This is the FMC tool designed for reviewing active and recent connection activity during incident investigation.

ECMP hashes each flow's 5-tuple (source/destination IP, source/destination port, protocol) to one next hop, so every packet in a TCP session follows the same path and session state stays consistent across the two upstream routers.

The BVI acts as the L3 interface for the transparent firewall, allowing management traffic.

A Host Object stores a single IPv4 or IPv6 address as a named, reusable entity in FMC Object Management. It satisfies the stem's network-definition requirement because hosts are one of the native network object types, referenceable directly in access control and NAT rules.

The Management Interface carries management-plane traffic between the FTD virtual instance and its manager, so it satisfies the requirement to communicate with the FMC. Deployments register, receive policy, and send events over this dedicated interface, keeping management traffic separate from the data interfaces that handle inspected user traffic.

System > Health > Monitor > Alert Responses defines automated actions triggered by health monitor alerts, including email notifications. Configuring the response here satisfies the requirement for automatic emails whenever a critical health alert fires on any managed device.

Three missed heartbeats trigger a failover: the standby assumes the Active role, since the primary is presumed failed. This satisfies the HA requirement that traffic continues uninterrupted when the primary stops responding, with the standby taking over within the configured hello and hold-time thresholds.

Fast Path bypasses further inspection of the tunnel while still applying prefilter rules, matching the requirement to completely skip inspection for trusted GRE backup traffic. It differs from Trust, which passes traffic to the snort inspection engine, so Fast Path delivers the needed performance.

LACP dynamically negotiates which interfaces join the EtherChannel and continuously monitors member links via its control protocol, detecting failures and removing failed links from the bundle. This satisfies the stem's requirement for automated negotiation and failure detection, unlike static EtherChannel modes such as "on", which provide neither.

The Packet Capture tool in FMC allows administrators to capture packets on FTD data interfaces. It provides a GUI-based way to define capture parameters, start and stop captures, and download the resulting pcap file for analysis. This is the correct tool for capturing data plane traffic on FTD managed by FMC.

The crypto ACL in a policy-based VPN defines the interesting traffic that is encrypted and sent through the tunnel. On FTD managed by FMC, the protected networks are configured in the VPN topology and must match on both peers. If they do not match, traffic will not be encrypted or decrypted correctly, causing the tunnel to drop traffic.

An SLA Monitor object defines the ICMP echo reachability check that static route tracking polls; the route's tracked object references it, so failure of the primary ISP's monitored address withdraws the route and traffic fails over to the secondary ISP.

This option generates a connection event at the start and another at the end of each connection, providing full visibility. It is useful for detailed analysis and compliance. The other options do not provide both start and end logging, which is required to capture the entire connection lifecycle.

Identity policies are bound to access control policies on the FMC; the ACP then applies them to matching traffic. The captive portal authentication and Active Directory realm selection therefore take effect only through that access control policy association, not at the device or platform level.

Fail Open with hardware bypass lets traffic continue passing through the inline pair if the device loses power or panics. The bypass-capable network module physically bridges the interfaces, satisfying the requirement for uninterrupted flow during failure.

SecureX cloud integration is authenticated by API credentials generated in the SecureX console and entered on the FMC; these keys authorise the FMC to register with and query the cloud service, satisfying the integration requirement.

A Security Zone groups multiple physical interfaces into one logical unit, letting you assign and reuse policy against that zone rather than per interface. This satisfies the stem's requirement for grouping interfaces for policy assignment within FMC.

SecureX Threat Intelligence triggers mitigation through pxGrid, which Cisco ISE uses to apply Adaptive Network Control quarantine policies to the endpoint. FMC simultaneously enforces blocking of associated traffic flows. This satisfies the stem's requirement for coordinated, automated endpoint quarantine across SecureX, FMC and ISE without manual intervention.

A subdomain entry lets the FQDN object match hosts beneath a parent domain, such as mail.example.com, which the FQDN field accepts as a valid value alongside single domain names and wildcards. This satisfies the question's requirement for a valid FQDN field option.

A registration key authenticates the FTD to the FMC during initial registration, satisfying the requirement for a secure management channel. Without it, the FMC cannot establish the management connection needed to configure and monitor the device. The key must be generated on the FMC and entered on the FTD within the timeout window.

Email notification lets the FMC send health alert messages to configured recipients through a mail relay, satisfying the requirement for a configurable alert notification method. It delivers alert details directly to administrators' inboxes, enabling prompt awareness of health events without requiring a separate monitoring console.

Restoring a backup replaces the target FMC's entire configuration and database, satisfying the stem's requirement that restore operations overwrite existing data rather than merge it. This full replacement mechanism distinguishes restore from selective import, ensuring the appliance returns to the exact captured state.

Stateful failover requires identical software versions on both peers; a differing FTD maintenance patch causes the control-link state mismatch, blocking HA formation. Matching releases across the pair is a documented prerequisite for the HA state machine to synchronise.

Routed mode makes each interface a distinct Layer 3 hop, so every interface needs its own subnet and serves as the default gateway for hosts on that segment. This satisfies the multi-zone requirement, since zones are separated by IP subnets rather than VLANs or bridge groups.

Dynamic PAT translates many internal addresses to one public IP using unique source ports, matching the /24-to-single-address requirement. Static NAT would need one public address per host, and dynamic NAT without PAT requires a pool.

Core dumps capture the exact memory state at the moment the Snort inspection engine crashed, which is the primary forensic artifact Cisco TAC requires to trace the faulting code path. Without them, TAC cannot diagnose the crash root cause.

A valid IPv4 static route needs the destination network and mask to identify the target, plus either a next-hop IP or egress interface to forward matched traffic. FDM rejects routes lacking these, so this combination satisfies the strict parameter requirement.

A SPAN stream carries 802.1Q tags intact, but the passive interface must be configured to recognise those VLAN IDs. Without matching subinterfaces or VLAN configuration, tagged frames are discarded before Snort inspects them, so no events are generated for those VLANs.