Cisco Securing Networks with Cisco Firewalls (300-710 SNCF, CCNP Security) (300-710 SNCF) (300-710 SNCF) — Questions 226–300

Which THREE types of events can be streamed natively from Cisco Secure Firewall using the eStreamer API to a third-party SIEM or custom application? (Choose three)

An administrator configures pxGrid integration between Cisco ISE and Cisco Secure Firewall Threat Defense. During the certificate enrollment process, the firewall fails to trust the ISE pxGrid node. What is the most likely root cause of this failure in a standalone FMC deployment?

Which component in an FTD cluster handles the 'Health Check' process to determine if a node is still active?

An FTD device managed by FMC is experiencing high CPU utilization attributed to the Snort inspection engine. The administrator wants to identify which specific intrusion rules or access control rules are consuming the most resources. Which tool or report should the administrator use?

Which of the following must be identical on both units of an FTD high availability pair to ensure successful synchronization?

An administrator is troubleshooting a Cisco Secure Firewall Threat Defense high availability deployment where MAC address persistence is causing intermittent packet drops after a failover event. What is the role of MAC address persistence in an HA setup?

Which THREE criteria can be used to match traffic in an Access Control Policy rule?

A security engineer is creating an Access Control Policy (ACP) in FMC. The policy must block all traffic matching specific URL categories while allowing standard web browsing. However, the administrator wants users to receive a warning page before continuing to pages categorized as "Potentially Damaging Content" rather than a hard block. Which action should the engineer assign to the URL category in the ACP Rules tab?

In an FTD high availability pair, what happens to the standby unit if it loses the heartbeat signal on the failover link?

An engineer needs to troubleshoot intermittent packet loss between an FTD inside interface and a destination server. The engineer runs the 'packet-tracer' command on the FTD CLI. What limitation must the engineer keep in mind regarding packet-tracer?

An administrator sets up Cisco ISE and Secure Firewall integration. The firewall successfully learns user identities from ISE pxGrid, but when users roam to a new IP address, the firewall continues to apply the old IP-to-user mapping for several minutes. What is the best way to resolve this synchronization lag?

An administrator is troubleshooting a scenario where configuration deployment from FMC to an FTD device fails with a 'Deployment Validation Error'. Where can the administrator view the detailed validation messages and deployment task history?

An enterprise is deploying a high-availability cluster of Cisco Secure Firewall Threat Defense devices to scale performance. Which requirement must be met regarding the physical switch infrastructure connecting the cluster nodes?

An administrator configures pxGrid integration between Cisco ISE and Secure Firewall Management Center. During the pxGrid certificate generation on ISE, the administrator must export the client certificate and keystore. What format must the client keystore be in when importing it into the FMC to establish the pxGrid trust relationship?

An enterprise environment uses Cisco SecureX (now Cisco Security Cloud Control / Cisco XDR) integrated with Cisco Secure Firewall. An incident responder wants to use SecureX threat intelligence to automatically quarantine a compromised host whose IP address was identified by the firewall. Which component acts as the secure relay for API requests between SecureX and an on-premises FMC?

What is the consequence of configuring an FTD interface with 'Non-Promiscuous' mode in a virtualized deployment?

Which TWO items must be defined to create a fully functional Network Object group in FMC?

When troubleshooting FTD high memory or CPU usage, an administrator can gather diagnostic data directly from the appliance. Which THREE commands can be executed on the FTD CLI to analyze resource utilization? (Choose three.)

An engineer has deployed a Cisco Secure Firewall Threat Defense in transparent firewall mode. Users on the inside segment report they cannot reach a server on the outside segment. The engineer verifies that the BVI (Bridge Virtual Interface) has an IP address in the same subnet as the internal hosts and default gateway. What is a likely reason for traffic being dropped?

An administrator needs to verify the license status and active feature subscriptions (such as URL Filtering, Malware, and IPS) on an FMC. Where should the administrator check this information in the FMC GUI?

When deploying a Cisco Secure Firewall Threat Defense device, what is the purpose of configuring Security Zones?

An administrator is preparing to troubleshoot a complex routing and NAT issue on an FTD device using packet tracer. Which TWO statements regarding the FTD packet tracer tool are correct? (Choose two.)

You are analyzing connection events and notice a block action. Which field in the connection event details best explains why the connection was dropped by the policy?

An enterprise is deploying Cisco Secure Firewall Threat Defense virtual appliances on-premises using VMware ESXi. Which THREE prerequisites or hypervisor configurations are required for proper operation? (Choose three)

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO fields or parameters can be included in the syslog output to facilitate incident investigation and event parsing by the SIEM? (Choose two)

An engineer configures Cisco Secure Firewall Threat Defense to ingest context from Cisco ISE using pxGrid. The integration status on the FMC shows 'Connected', but when inspecting user identities via the FTD CLI using 'show user-identity user', no active users appear. Which CLI command should the engineer use to troubleshoot the pxGrid session feed specifically at the FTD process level?

When planning an FTD high availability deployment, which TWO requirements are critical for the link between the two firewalls?

An administrator is setting up Cisco SecureX threat intelligence integration with Cisco Secure Firewall Management Center. The test connection fails with a 'Token Expired or Invalid' error. What is the correct procedure to re-establish trust and authentication between the FMC and SecureX?

An administrator is configuring a Network Address Translation (NAT) rule on a Cisco FMC managed Threat Defense device. The requirement is to translate the source IP address of traffic coming from the inside zone going to the outside zone, but only for a specific internal subnet. Which NAT type must the administrator select in the FMC NAT rule configuration?

An engineer is setting up a Cisco Secure Firewall Threat Defense cluster. Which TWO statements accurately describe the architecture and behavior of FTD clustering? (Choose two)

An administrator needs to troubleshoot a routing issue on an FTD device managed by FMC. Where in the FMC GUI should the administrator navigate to view and modify static and dynamic routing configurations for the device?

An administrator wants to create a Prefilter policy to fast-path (bypass Snort inspection for) a trusted backup stream between two data centers. Which action type should be selected in the Prefilter rule?

When configuring an FTD cluster, what is the maximum number of nodes supported in a single cluster?

An administrator integrates Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. After successful registration, the administrator wants to create an Access Control policy rule that blocks traffic from users in the 'Contractors' Security Group Tag. Where in the FMC rule creation wizard should the administrator configure this condition?

You are deploying a Cisco Secure Firewall Threat Defense cluster in a data center environment. Which deployment requirement must be strictly followed regarding the control link and data interfaces?

Which TWO benefits are gained by integrating Cisco Secure Firewall with Cisco Identity Services Engine (ISE) using TrustSec SGTs? (Choose two)

An engineer is troubleshooting a Cisco Secure Firewall Threat Defense virtual appliance deployed in Microsoft Azure. Connectivity tests show intermittent packet drops. Which THREE troubleshooting steps or configurations should be verified in Azure and FTDv? (Choose three)

When utilizing static route tracking, what value represents the frequency of the tracking probe?

Which protocol is used by the FTD to communicate with the FMC for management traffic?

An administrator is deploying Cisco Secure Firewall Threat Defense Virtual (FTDv) in an enterprise cloud environment (such as AWS or Azure). Which THREE considerations are unique to cloud-based firewall deployments compared to physical hardware deployments? (Choose three)

An administrator is configuring Equal-Cost Multi-Path (ECMP) routing on a Cisco Secure Firewall Threat Defense deployment to balance traffic across two upstream next-hop routers. How does the firewall select the specific path for a given TCP flow?

You are deploying a Cisco Firepower Threat Defense (FTD) device in transparent mode. Which requirement must be met to allow traffic flow through the firewall?

Which THREE of the following are supported methods for FTD failover mechanism?

When deploying FTD in a virtual environment on AWS, which feature allows the firewall to handle high-bandwidth traffic by distributing it across multiple interfaces using ECMP?

An administrator needs to define network objects in the FMC Object Management menu. Which THREE object types are natively supported for network definition? (Choose three)

An administrator configures an SSL Decryption Policy on the FMC to decrypt inbound HTTPS traffic destined for an internal web server. The administrator imports the private key and server certificate into the FMC. Which decryption action must be selected to allow the FTD to decrypt this traffic using the server's private key?

You are deploying FTD in a cloud environment. What is the primary purpose of the 'Management Interface' when launching the virtual instance?

An administrator wants to configure automated email notifications from the FMC whenever a critical health monitor alert occurs on any managed device. Where should this be configured in the FMC GUI?

An administrator is configuring a Manual NAT rule in the FMC for an internal server that needs to be accessed from the outside zone. The internal IP is 192.168.1.50, and it must be translated to a public IP 203.0.113.10. Which TWO configuration parameters must be specified when defining this Manual NAT rule? (Choose two)

You are deploying a Cisco FTD High Availability pair. During the synchronization process, what occurs when the standby unit fails to receive three consecutive heartbeat hellos from the primary?

An organization integrates Cisco Secure Firewall with Cisco SecureX. Which THREE actions or capabilities can be executed as part of this integration? (Choose three)

An administrator needs to send Cisco Secure Firewall Threat Defense audit logs and security logs to an external syslog server. Which configuration object in the FMC Platform Settings must be modified to define the destination IP address, transport protocol, and port?

You are deploying an FTD in AWS. What is the correct way to handle the internal IP addresses of the FTD instances in an HA pair?

An administrator is configuring a Prefilter Policy in FMC to optimize performance on a Cisco Firepower Threat Defense device. The requirement is to completely bypass inspection for a trusted high-speed data backup tunnel between two datacenters using GRE encapsulation. Which prefilter rule action should be selected?

When configuring a Port Channel on an FTD, what is the primary benefit of using LACP (Link Aggregation Control Protocol)?

A security analyst configures syslog integration on Cisco Secure Firewall Threat Defense to forward critical security events to a Splunk SIEM. Which configuration step must be performed within the Firepower Management Center (FMC) to ensure these logs include the user identity and SGT mapping?

An FTD device is failing to register with the FMC. The administrator confirms connectivity via ping. Which CLI command should the administrator run on the FTD to verify the registration status and the shared secret handshake?

An administrator needs to configure Active Authentication using a captive portal on an FTD device. Which firewall feature must be properly configured and running to present the authentication prompt to users?

You need to implement static route tracking on an FTD to ensure traffic fails over to a secondary ISP. Which object is used to define the reachability check?

You are configuring a Cisco Secure Firewall Threat Defense deployment in an AWS environment. Which specific component is required to handle automated failover and route table updates when deploying a clustered or high-availability pair across multiple Availability Zones?

An administrator wants to decrypt inbound HTTPS traffic destined for a public web server behind a Firepower Threat Defense device. Which type of SSL/TLS decryption policy must be configured on the FMC?

An administrator is integrating Cisco Secure Firewall Threat Defense with Cisco Identity Services Engine (ISE) using pxGrid. During the initial connection phase, the Secure Firewall is stuck in a 'Connecting' state and fails to download user-to-IP mapping. Where should the administrator check the pxGrid client status and troubleshoot the registration certificate handshake on the Secure Firewall CLI?

Which tool in the FMC allows you to view the real-time flow of packets being processed by the Snort engine for troubleshooting purposes?

An administrator configures an Identity Policy on the FMC to authenticate users via Active Directory using captive portal. Where is the Identity Policy applied within the Firepower configuration hierarchy?

An administrator is configuring an inline interface pair on a Cisco Secure Firewall Threat Defense device using Cisco FMC. The business requires that if the firewall experiences a power failure or kernel panic, traffic must continue to flow uninterrupted through the network segment. Which action should the administrator take?

An administrator integrates Cisco Secure Firewall with Cisco SecureX. Which TWO components or settings are required on the FMC to establish and maintain this cloud integration? (Choose two)

An administrator is configuring third-party SIEM integration using eStreamer. Which TWO actions must be completed on the FMC to generate the necessary client integration files? (Choose two)

Which feature in FMC allows you to group multiple physical interfaces into a single logical zone for policy assignment?

An enterprise integrates Cisco Secure Firewall with Cisco SecureX. The security team wants to leverage SecureX Threat Intelligence to automatically quarantine endpoints that exhibit malicious behavior. How does the integration coordinate this mitigation action across SecureX, FMC, and ISE?

When configuring an FQDN object, which THREE options are valid for the FQDN field?

Which TWO components must be configured to manage an FTD via the FMC?

An administrator is setting up health monitoring alerts on the FMC. Which TWO notification methods can be configured when a health alert is triggered? (Choose two)

An administrator is performing a backup and restore operation on an FMC appliance. Which THREE statements are correct regarding the FMC restore process? (Choose three)

An administrator is troubleshooting a Stateful High Availability (HA) pair of Cisco Secure Firewall 4100 series devices managed by FMC. The units are failing to form an HA state, and logs indicate a state mismatch on the control link. Which underlying cause is most likely preventing the HA synchronization?

An engineer is deploying Cisco Secure Firewall Threat Defense in a complex multi-zone routed environment. Which THREE design considerations apply when implementing routed mode interfaces? (Choose three)