300-710 SNCF Integration Practice Question
An administrator is troubleshooting an eStreamer connection between the FMC and a custom Python SIEM script. The connection is established, but no intrusion events appear in the SIEM. Which TWO potential reasons could explain why intrusion events are missing from the stream? (Choose two)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Access Control policy applied to the FTD devices does not have an Intrusion Policy assigned to inspect and generate events.
Missing intrusion events in eStreamer can result from the client script not subscribing to intrusion event types during initialization or from Access Control rules not having intrusion policies enabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SIEM script is using UDP instead of TCP for eStreamer communication.
Why it's wrong here
eStreamer operates strictly over TCP.
- ✗
The FMC eStreamer listening port was changed from 8302 to 443.
Why it's wrong here
Port 8302 cannot be changed arbitrarily.
- ✓
The Access Control policy applied to the FTD devices does not have an Intrusion Policy assigned to inspect and generate events.
Why this is correct
If intrusion inspection is set to 'None' or 'Access Control with no IPS', no intrusion events are generated for eStreamer to stream.
- ✓
The eStreamer client script failed to subscribe to intrusion event record types during the initial handshake request.
Why this is correct
eStreamer clients must explicitly request subscription to specific event types (connection, intrusion, malware) upon connecting.
- ✗
The FTD management interface IP address is blocked by an Access Control rule.
Why it's wrong here
Management traffic is handled out-of-band and is not blocked by data plane Access Control rules.
About these practice questions
Courseiva writes every 300-710 SNCF question from scratch — 478 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Cisco exam blueprint
This 300-710 SNCF practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-710 SNCF exam.