Cisco Securing Networks with Cisco Firewalls (300-710 SNCF, CCNP Security) (300-710 SNCF) (300-710 SNCF) — Questions 376–450

You are troubleshooting high CPU utilization on an FTD device. Which tool should you use to identify which specific process (e.g., snort) is consuming the most resources?

An administrator is troubleshooting asymmetric routing issues across an FTD firewall using the FMC connection events and FTD CLI. The administrator wants to disable TCP state bypass or adjust TCP normalization settings to allow non-synchronized SYN packets through for a specific application. Where are TCP normalization and stateful inspection parameters configured for FTD?

An administrator is managing object configurations on the FMC. Which TWO of the following are valid object types that can be created under Object Management? (Choose two)

You are configuring an active/standby High Availability pair for Cisco Secure Firewall Threat Defense using FMC. You need to configure port channels for the data interfaces to increase bandwidth and redundancy. Which guideline must be followed regarding port channels in an HA deployment?

Which menu in the FMC allows you to view the list of managed FTD devices?

Which option in the Access Control Policy rule allows you to define a specific application, such as 'Facebook', to be blocked?

An administrator is preparing to upgrade a high-availability (HA) pair of Firepower Threat Defense devices managed by an FMC. Before initiating the upgrade task via the FMC upgrade tool, which preliminary action is mandatory to ensure a seamless process and prevent split-brain conditions?

An administrator configures a security intelligence feed in the FMC to block known malicious IP addresses. Where are Security Intelligence feeds and lists applied in the FMC configuration?

An administrator is investigating an issue where connection events are failing to reach the FMC from a managed FTD. Which THREE daemons or logs on the FTD and FMC should be checked to troubleshoot event transport and communication issues? (Choose three)

An engineer is troubleshooting a newly deployed FTD device where syslog messages are not reaching the external syslog server. Which tool on the FTD CLI can the engineer use to verify if the syslog generation and transmission process is attempting to send packets out the management or data interface?

An administrator notices that the Firepower Management Center (FMC) health monitor shows a critical warning regarding high disk utilization on the /var partition. Which built-in utility or action should the administrator perform first to safely free up disk space without disrupting critical database integrity?

An engineer suspects that asymmetric routing is causing packets to be dropped by the FTD firewall. Which command should the engineer run on the FTD CLI to check for dropped packets and view drop reasons in real time?

When configuring Cisco Secure Firewall Threat Defense integration with Cisco Threat Response (SecureX Threat Response) for automated threat hunting and mitigation, which THREE components or steps are required? (Choose three.)

An administrator is troubleshooting an SSL Decryption policy where encrypted connections are failing. The FMC logs indicate that clients are rejecting the FTD's re-signed certificate because it is not trusted. What configuration step is missing?

You are deploying a Cisco Secure Firewall Threat Defense in an existing core network as an out-of-band intrusion prevention system. Which NGIPS deployment mode should you configure to ensure the firewall performs deep packet inspection and generates alerts without dropping any production traffic in the event of a device failure or high load?

Which THREE items are included in an FMC backup archive?

In the FMC, what is the purpose of the 'Network Discovery Policy'?

Which TWO protocols or mechanisms are used to integrate Cisco Identity Services Engine (ISE) with Cisco Secure Firewall Threat Defense? (Choose two)

When integrating Cisco Secure Firewall with Cisco SecureX, which component acts as the local orchestrator and liaison that relays threat intelligence and response actions between the managed FTD devices and the SecureX cloud?

An administrator is integrating Cisco Secure Firewall Threat Defense with Cisco Identity Services Engine (ISE) using Platform Exchange Services (pxGrid). Which service must be enabled and running on the ISE nodes for pxGrid communication to succeed?

An administrator wants to verify the NTP synchronization status and time offset on a managed FTD device from the FMC GUI. Where can this health and system information be viewed?

An administrator is configuring the Cisco eStreamer client on a Linux-based SIEM collector to connect to the FMC. After copying the generated certificate files to the client, the connection attempt fails with an error indicating that the client certificate is untrusted. What is the most likely reason for this failure?

An administrator configures pxGrid integration between Cisco ISE and Cisco Secure Firewall Management Center. The administrator wants to verify that the pxGrid service on ISE is actively responding and publishing topics. Which tool or interface on ISE should be used to check pxGrid node status?

Which THREE actions can be performed by an SSL Decryption Policy?

An administrator wants to generate a health report on the FMC to present hardware utilization trends over the past 30 days. Which section of the FMC GUI provides pre-built health reports and metric tracking?

An administrator is configuring an Identity Policy with Active Directory integration. The requirement is to ensure that users who fail primary AD authentication are assigned to a restricted guest VLAN using ISE integration. Which component in the FMC architecture handles this user-to-group association?

Which THREE components are necessary to implement passive identity monitoring in an FMC-managed Firepower system?

An administrator is planning an upgrade of an FMC managing multiple FTD devices across various software versions. Which THREE factors must be validated according to Cisco compatibility guidelines before proceeding? (Choose three)

An administrator is configuring Cisco SecureX threat intelligence integration with Cisco Secure Firewall Threat Defense via the FMC. Which TWO actions can be performed directly through the SecureX integration? (Choose two)

Which THREE criteria can be used to match traffic within an Access Control rule on the FMC? (Choose three)

An engineer needs to troubleshoot an intermittent connectivity issue between a secured zone and the internet through a Firepower Threat Defense (FTD) managed by FMC. The engineer wants to capture traffic hitting a specific Access Control rule without overwhelming the system. Which packet capture configuration is most appropriate?

When analyzing performance issues, which THREE metrics should an administrator monitor in the FMC Health Monitor?

An engineer needs to troubleshoot high CPU usage on an FTD device caused by Snort. Which THREE actions or features can be adjusted or implemented to mitigate Snort CPU load? (Choose three)

You are deploying a high-availability pair of Firepower Threat Defense (FTD) units. Which TWO requirements must be met to ensure stateful failover functions correctly?

You are troubleshooting high availability. The units are connected, but the failover link shows as 'Down'. What is the most likely cause?

An enterprise network design incorporates Equal-Cost Multi-Path (ECMP) routing across two Cisco Secure Firewall Threat Defense units functioning independently in routed mode. What is the primary benefit of enabling ECMP on the firewalls?

When deploying an FTD cluster, which component is responsible for distributing traffic across the members of the cluster?

Which protocol is natively used by Cisco Secure Firewall Management Center to stream connection and intrusion events to external SIEM systems in real time?

An administrator is planning an Active/Standby High Availability deployment for two Cisco Secure Firewall Threat Defense devices managed by FMC. Which THREE prerequisites must be satisfied before configuring the HA pair? (Choose three)

An engineer is configuring dynamic routing using OSPF on a Cisco Secure Firewall Threat Defense device managed by FMC. Which TWO configuration steps are required to establish an OSPF adjacency? (Choose two)

Which FTD command-line tool is primarily used to check interface status and physical link state?

You are deploying a Cisco Firepower Threat Defense (FTD) unit in transparent mode. Which requirement must be met for the device to process traffic correctly in this mode?

You have a large number of NAT rules. How does the FTD process them?

An administrator wants to group multiple existing port objects (e.g., TCP 80, TCP 443, TCP 8080) into a single object for use in Access Control Policy rules. Which object container should be created?

Which type of events can be exported from Cisco Secure Firewall Management Center to a SIEM using the eStreamer protocol?

You are defining an Access Control Policy rule to allow traffic. If you want to log the connection at the end of the flow only if it matches the rule, which Logging setting is appropriate?

A security engineer is integrating Cisco Secure Firewall with a third-party SIEM using eStreamer. The SIEM vendor's connector documentation requires the eStreamer event types to be parsed correctly. Which file format or protocol encoding does eStreamer use to transmit event records over TCP port 8305?

An administrator notices that the FMC dashboard indicates a yellow health status for an FTD device. Where should the administrator navigate to identify the specific process or service that is failing?

How do you identify which Access Control Rule triggered a specific connection log?

You are troubleshooting a connectivity issue. The traffic is being dropped by a Prefilter rule. What is the characteristic of traffic handled by a Prefilter policy?

In an FTD cluster, what happens if the cluster control link fails?

An administrator configures Cisco Secure Firewall Management Center to integrate with Cisco Threat Response / SecureX. After completing the configuration, threat intelligence indicators are not updating on the firewall. Where can the administrator check the synchronization status and API communication logs between FMC and SecureX on the FMC CLI?

When editing an Access Control Rule, which action allows you to drop traffic while simultaneously sending a TCP RST to the client?

When a packet capture is running on the FTD, where can you download the resulting .pcap file for analysis in Wireshark?

An engineer is troubleshooting a Cisco ISE and Secure Firewall pxGrid integration. The administrator notices that user group memberships are not populating correctly on the FTD, even though IP-to-user mappings are visible. What is the most likely reason user group information is missing?

An administrator configures a Cisco Secure Firewall Threat Defense cluster. During normal operations, a data node experiences a critical hardware failure. What happens to the active connections currently processed by that specific failed data node?

You are restoring an FMC backup to a new appliance. Which of the following conditions must be met for a successful restore?

An administrator is integrating Cisco Secure Firewall Threat Defense with Cisco Threat Response (now Cisco SecureX threat intelligence). Which mechanism does the firewall use to automatically receive dynamic indicators of compromise (IoCs) and perform retrospective security analysis?

You are deploying an FTD in a cloud environment and need to ensure high availability. Which technology is typically used to manage the virtual IP failover?

What is the result of assigning a 'Trust' action to a rule in an Access Control Policy?

Which of the following is a limitation when deploying an FTD in transparent mode?

Which TWO of the following are required when configuring a static route with tracking?

An administrator is setting up FTD HA. Which of the following is true regarding the configuration synchronization between the primary and secondary units?

You are configuring an NGIPS mode deployment on an FTD device. You need to ensure that the FTD can drop malicious traffic in real-time. Which mode must you select?

An administrator is performing health monitoring on an FMC appliance. Which TWO health monitors are available out-of-the-box in the FMC Health Monitor dashboard to track system resource utilization? (Choose two)

An administrator needs to create a custom Application filter object in the FMC to easily select cloud storage applications in Access Control rules. Where are application filters created?

You are configuring identity-based access control rules on Cisco Secure Firewall Threat Defense using user groups imported from Cisco ISE via pxGrid. Users report that they are not matching the identity rule, although their IP address is correctly mapped to their username in the FMC Active Sessions table. What is the root cause?

An administrator is troubleshooting a Cisco Secure Firewall Threat Defense and Cisco ISE pxGrid integration where user-to-IP mappings are not being received by the FTD. Which TWO troubleshooting steps should the administrator perform on the FTD or FMC CLI to diagnose the issue? (Choose two)

What occurs when an 'Interactive Block' action is used in an Access Control rule?

Which menu path in the Cisco Secure Firewall Management Center (FMC) is used to configure the connection to Cisco Threat Response or Cisco SecureX?

An administrator is troubleshooting a policy deployment failure between an FMC and an FTD. Which THREE log files on the FTD contain relevant information regarding policy application and deployment tasks? (Choose three)

Which TWO methods can be used to gather diagnostic information for a Cisco TAC case from an FTD device?

Which TWO of the following are benefits of using a Port Channel on an FTD?

An administrator needs to configure Quality of Service (QoS) on a Cisco Firepower Threat Defense device via FMC to limit peer-to-peer traffic bandwidth. Where must the QoS policy be applied for it to take effect on traffic traversing the firewall?

An administrator is troubleshooting a VPN tunnel termination issue on an FTD device. To check IPsec Phase 1 and Phase 2 security associations (SAs) and real-time crypto debugging messages, which command should be executed on the FTD diagnostic CLI?