Courseiva

CCNA Integration Questions

73 questions · Integration · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

A security administrator has integrated Cisco Secure Firewall Management Center (FMC) with Cisco Identity Services Engine (ISE) using pxGrid. The administrator wants to verify that the integration is working and that user identity data is being received. Which FMC feature should be used to view the learned user identities and their associated IP addresses?

A.Analysis > Connections
B.Policies > Access Control
C.Analysis > Users
D.System > Integration
AnswerC

In FMC, the Analysis > Users page displays user identity information learned from ISE via pxGrid. It shows usernames, IP addresses, and other session details. This is the correct place to verify that identity data is being received and mapped correctly.

Why this answer

FMC provides the Analysis > Users page to view user identity data learned from ISE. This page lists usernames, IP addresses, and other session details, allowing administrators to verify that the pxGrid integration is functioning correctly. Other pages like Access Control or Integration do not display this information.

Exam trap

The trap here is assuming that user identities are viewed in the Access Control policy or Integration page, when they are actually displayed in the Analysis > Users section.

Practice this question →
2
MCQmedium

An administrator is configuring third-party SIEM integration using eStreamer on the FMC. A custom client application is written to connect to the FMC eStreamer server, but the connection is immediately reset. What is the most likely cause of this issue?

A.The SIEM is using TCP port 443 instead of eStreamer default port 8305.
B.The eStreamer client certificate and pkcs12 password have not been generated and configured on the FMC.
C.Syslog facility levels are set to local0 instead of daemon.
D.pxGrid service is disabled on the FMC.
AnswerB

eStreamer enforces mutual TLS: the FMC server validates a client certificate before streaming any events. Without a generated client certificate and its pkcs12 password configured under eStreamer, the TLS handshake fails and the FMC immediately resets the connection, satisfying the stem's reset symptom.

Why this answer

Before an eStreamer client can connect to FMC, an eStreamer certificate and password must be generated on the FMC and imported into the client application.

Practice this question →
3
MCQeasy

Which protocol does Cisco Secure Firewall Threat Defense use to exchange SGT (Security Group Tag) metadata across intermediate routers that do not support inline tagging?

A.RADIUS
B.TACACS+
C.SNMPv3
D.SXP (Scalable Group Tag Exchange Protocol)
AnswerD

SXP carries SGT-to-IP mappings across network devices that cannot perform inline tagging, propagating group metadata between Cisco Secure Firewall Threat Defense and intermediate routers. This directly satisfies the stem's constraint of exchanging SGT metadata where inline tagging is unsupported.

Why this answer

SXP (Scalable Group Tag Exchange Protocol) is a protocol used to propagate SGT-to-IP mappings across network devices and firewalls that do not support inline MACsec or IPsec SGT propagation.

Practice this question →
4
Multi-Selecthard

An administrator configures Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO features help ensure that syslog messages are transmitted securely and reliably across untrusted networks? (Choose two)

Select 2 answers
A.Configuring SNMPv3 privacy and authentication parameters on the syslog server.
B.Enabling TLS encryption for syslog transmission to protect sensitive log contents in transit.
C.Configuring Reliable Syslog over TCP to enable packet retransmissions and flow control.
D.Configuring the syslog server IP as a secondary management gateway.
E.Enabling SSH tunneling on UDP port 514.
AnswersB, C

TLS encryption protects syslog payloads from interception and tampering as they traverse untrusted networks, directly satisfying the stem's secure-transmission constraint. Standard syslog sends cleartext over UDP, exposing sensitive firewall event data; wrapping the transport in TLS provides confidentiality and integrity for messages sent to the remote SIEM.

Why this answer

Option B is correct because enabling TLS encryption for syslog transmission (often implemented as syslog over TLS, typically on TCP port 6514) protects the confidentiality and integrity of log contents as they traverse untrusted networks, preventing eavesdropping or tampering. Option C is correct because Reliable Syslog over TCP uses TCP's acknowledgments, retransmissions, and flow control to ensure messages are delivered reliably, unlike fire-and-forget UDP syslog. Option A is incorrect because SNMPv3 privacy and authentication secure SNMP polling/traps, not syslog transport, and configuring it on the syslog server does not secure syslog messages.

Option D is incorrect because designating the syslog server IP as a secondary management gateway is not a valid or relevant mechanism for securing or ensuring reliable syslog delivery. Option E is incorrect because SSH tunneling does not run over UDP port 514, and standard syslog over UDP 514 is neither encrypted nor reliable.

Practice this question →
5
MCQhard

A security administrator is integrating Cisco Secure Firewall Management Center with Cisco Identity Services Engine (ISE) using pxGrid. The administrator wants to enforce identity-based policies on the Threat Defense devices. After configuring the pxGrid integration, the administrator notices that user identity information is not being populated in the FMC. The administrator verifies that the pxGrid certificate is valid and the FMC can reach ISE on port 8910. What is the most likely cause?

A.The FMC is not configured to subscribe to the correct pxGrid topics, such as Session Directory and User Identity.
B.The FMC is using the wrong certificate for pxGrid, and the ISE rejects the connection.
C.The Threat Defense devices are not configured to send user identity information to the FMC.
D.The ISE pxGrid persona is not enabled on the ISE node, and the FMC cannot authenticate.
AnswerA

In pxGrid integration, the FMC must subscribe to specific topics to receive user identity and session information. If the subscriptions are missing or incorrect, the FMC will not receive the data even if connectivity and certificates are valid. The administrator should verify that the FMC is subscribed to topics like com.cisco.ise.session and com.cisco.ise.identity. This is a common oversight during integration.

Why this answer

For pxGrid integration to populate user identity information, the FMC must subscribe to the appropriate pxGrid topics, such as Session Directory and User Identity. Without these subscriptions, the FMC will not receive the data even if the connection and certificates are valid. Verifying and enabling the correct subscriptions is essential for successful integration.

Exam trap

The trap here is focusing on certificate or connectivity issues when the real problem is often missing pxGrid topic subscriptions on the FMC.

Practice this question →
6
MCQhard

A security operations team deploys Cisco Secure Firewall Management Center and wants to share indicators of compromise with Cisco SecureX. The team also wants to see which internal endpoints have communicated with those indicators. Which integrated capability should be enabled to provide this context?

A.Enable the Cisco SecureX integration in FMC by registering the management center with the SecureX cloud and enabling eventing.
B.Configure a custom Security Intelligence feed that pulls indicators from SecureX and applies them to access control policies.
C.Deploy a Cisco Secure Network Analytics appliance and configure it to receive NetFlow from the Threat Defense devices.
D.Enable Cisco Umbrella integration on FMC and configure the DNS policy to log all domain requests to the Umbrella dashboard.
AnswerA

Registering FMC with SecureX and enabling eventing publishes security events and context to the SecureX platform, where indicators and affected endpoints can be correlated with other telemetry. This is the supported integration that provides the visibility the team wants. Without the SecureX registration, FMC events remain local to the management center.

Why this answer

The SecureX integration in FMC is enabled by registering the management center with the SecureX cloud and turning on eventing, which allows FMC security events to flow into SecureX. There, indicators of compromise can be correlated with endpoint telemetry so analysts can identify which internal hosts communicated with malicious infrastructure, delivering the visibility the security operations team requested.

Exam trap

The trap here is treating SecureX as an indicator feed source only, when the key benefit is bidirectional context that includes publishing FMC events for endpoint correlation.

Practice this question →
7
Multi-Selecthard

An administrator is troubleshooting an eStreamer connection between the FMC and a custom Python SIEM script. The connection is established, but no intrusion events appear in the SIEM. Which TWO potential reasons could explain why intrusion events are missing from the stream? (Choose two)

Select 2 answers
A.The SIEM script is using UDP instead of TCP for eStreamer communication.
B.The FMC eStreamer listening port was changed from 8302 to 443.
C.The Access Control policy applied to the FTD devices does not have an Intrusion Policy assigned to inspect and generate events.
D.The eStreamer client script failed to subscribe to intrusion event record types during the initial handshake request.
E.The FTD management interface IP address is blocked by an Access Control rule.
AnswersC, D

Without an intrusion policy bound to the access control rule, the FTD performs no intrusion inspection, so no intrusion events are generated for eStreamer to forward. The connection succeeds, but the event stream stays empty because the missing policy assignment, not transport, is the constraint.

Why this answer

Option C is correct because eStreamer only streams intrusion events that the FTD actually generates; if the Access Control policy has no Intrusion Policy assigned to the relevant rules, no intrusion inspection occurs and therefore no intrusion events exist to send to the SIEM. Option D is correct because eStreamer clients must explicitly request the event types they want during the initial handshake (the request message specifies flags for intrusion events, connection events, etc.); if the Python script omits the intrusion event record type in its subscription request, the FMC will not stream those events even though the connection is up. Option A is not correct because eStreamer uses a proprietary TCP-based protocol on port 8302, and a UDP mismatch would prevent the connection from establishing at all, not merely suppress intrusion events.

Option B is not correct because changing the listening port would also break the connection unless the client is reconfigured to match, and the scenario states the connection is established. Option E is not correct because blocking the FTD management interface IP would disrupt management connectivity, not the FMC-to-SIEM eStreamer event stream, and Access Control rules do not govern eStreamer traffic.

Practice this question →
8
MCQeasy

When configuring the integration between Cisco Secure Firewall and Cisco ISE via pxGrid, what is the primary role of Cisco ISE in this architecture?

A.To act as the primary syslog collector for firewall intrusion alerts.
B.To act as an inline packet inspection engine for Layer 7 threats.
C.To provide user identity, IP address mapping, and group context to the firewall.
D.To store and analyze raw eStreamer event streams from the firewall.
AnswerC

ISE acts as the identity source, publishing user-to-IP mappings and group memberships to the firewall over pxGrid. This lets the firewall enforce identity-based policy rather than relying solely on IP addresses, which is the integration's core purpose.

Why this answer

Cisco ISE acts as the source of truth for user identity, endpoint posture, and contextual metadata, sharing it with the firewall via pxGrid.

Practice this question →
9
MCQeasy

When configuring Cisco Secure Firewall Threat Defense to forward syslog messages to a remote SIEM receiver, which transport layer protocols are natively supported for syslog export?

A.HTTP and HTTPS only
B.UDP only
C.UDP and TCP
D.TCP and SCTP
AnswerC

UDP and TCP are both natively supported for syslog export from Cisco Secure Firewall Threat Defense, satisfying the stem's requirement for transport layer protocols. UDP provides connectionless, fire-and-forget delivery, while TCP adds reliable, connection-oriented transmission with acknowledgement, letting you choose based on SIEM reliability needs.

Why this answer

Cisco Secure Firewall Threat Defense supports both UDP and TCP (including reliable syslog over TCP) for transmitting syslog messages to external SIEMs.

Practice this question →
10
MCQeasy

When configuring Cisco ISE pxGrid integration within the Firepower Management Center, which TCP port must be open across the intermediate firewall for secure pxGrid communication?

A.TCP 389
B.TCP 8910
C.TCP 80
D.UDP 514
AnswerB

TCP 8910 is the registered pxGrid port used for secure publish-subscribe communication between Cisco ISE and the Firepower Management Center. Allowing it through the intermediate firewall satisfies the stem's requirement for pxGrid traffic, since the alternative ports serve unrelated services such as STOMP messaging or web administration.

Why this answer

Cisco ISE pxGrid typically operates over TCP port 8910 for client-server communications.

Practice this question →
11
MCQmedium

An administrator configures an eStreamer client script on a remote server to receive events from FMC. The script connects successfully and starts receiving events, but after a few hours, the connection drops and throws a timeout error. What is the most likely cause of this behavior?

A.The eStreamer service on the FMC has a hard-coded 2-hour session limit for security reasons.
B.The FMC automatically rotates the eStreamer client certificate every 4 hours.
C.The Snort inspection engine on the FTD restarts hourly to clear cache.
D.An intermediate firewall or stateful device closed the TCP port 8302 session due to inactivity timeout.
AnswerD

eStreamer uses a persistent TCP session on port 8302. Stateful devices silently drop idle TCP sessions after their inactivity timeout, causing the client's connection to fail with a timeout. The script must send keepalives or reconnect to survive these intermediate timeouts.

Why this answer

Firewalls or intermediate network devices along the path between the external eStreamer client and the FMC often have idle session timeouts (e.g., 30 minutes or 1 hour). If eStreamer traffic is quiet, the session times out. eStreamer keepalive configurations or firewall idle timeouts must be adjusted.

Practice this question →
12
Multi-Selecthard

An engineer configures Cisco Secure Firewall Threat Defense to ingest SGTs from Cisco ISE via pxGrid and wants to enforce access control based on these tags. Which TWO requirements must be met for the firewall to successfully enforce SGT-based policies? (Choose two)

Select 2 answers
A.An active eStreamer subscription for intrusion event streaming.
B.Syslog server configuration with local4 facility enabled.
C.Active Directory domain controller LDAP integration directly configured on the FTD CLI.
D.An active and healthy pxGrid connection between ISE and FMC to synchronize IP-to-SGT mappings.
E.Proper SXP peering or inline TrustSec configuration so data plane packets retain SGT metadata across the network.
AnswersD, E

SGT enforcement depends on FMC learning each endpoint's IP-to-SGT mapping, which only pxGrid publishes from ISE. Without a healthy, active pxGrid session, mappings never synchronise, so the firewall cannot resolve a source IP to its tag and policy lookups fail. This directly satisfies the stem's requirement for tag ingestion before enforcement.

Why this answer

Option D is correct because SGT-based enforcement on Cisco Secure Firewall Threat Defense depends on the FMC receiving IP-to-SGT mappings from Cisco ISE over pxGrid; without a healthy, active pxGrid session between ISE and FMC, the firewall has no tag-to-IP binding to match in access control rules. Option E is correct because the SGT metadata must actually reach the enforcement point in the data plane: either via SXP peering (to propagate SGT bindings to devices that cannot natively carry tags) or via inline TrustSec tagging, so packets retain their SGT across the network and the FTD can enforce policy on them. Option A is incorrect because eStreamer is used for exporting intrusion and connection events to external collectors, not for SGT ingestion or enforcement.

Option B is incorrect because syslog with the local4 facility is only for logging/event delivery and has no role in SGT synchronization or policy enforcement. Option C is incorrect because direct LDAP integration to Active Directory on the FTD CLI is not required for SGT-based access control; identity and SGT mapping come through ISE/pxGrid, not a direct FTD LDAP configuration.

Exam trap

The trap is confusing the roles of pxGrid (for control plane mapping) and SXP/inline (for data plane tagging), and being distracted by unrelated services like eStreamer or syslog that are not involved in SGT enforcement.

Practice this question →
13
Multi-Selecthard

An administrator is configuring Cisco Secure Firewall Threat Defense to export syslog messages to a remote SIEM. Which TWO parameters can be customized under the FTD Platform Settings syslog configuration? (Choose two)

Select 2 answers
A.The encryption algorithm used for IPsec VPN tunnels terminating on the FTD
B.The OSPF routing protocol router ID
C.The Snort inspection engine memory allocation size
D.Syslog facility levels (e.g., local0 through local7) and severity filters
E.Syslog transport protocol (UDP or TCP/Reliable Syslog with TLS encryption)
AnswersD, E

FTD Platform Settings lets you assign the syslog facility (local0–local7) so the SIEM can separate FTD events from other devices, and apply severity filters to control which messages are exported. Both parameters are customisable there, satisfying the stem's requirement for two configurable syslog options.

Why this answer

Under FTD Platform Settings > Syslog, the administrator can define the logging destination and customize how messages are sent, including the syslog facility (local0 through local7) and severity level filters that determine which messages are forwarded to the SIEM, making option D correct. The same configuration section also lets you select the transport used to reach the syslog server—UDP or TCP with Reliable Syslog (TLS encryption)—so option E is correct. Option A is wrong because IPsec tunnel encryption algorithms are configured in the VPN/IPsec settings, not in Platform Settings syslog.

Option B is wrong because the OSPF router ID is set under routing protocol configuration, not syslog. Option C is wrong because Snort inspection memory allocation is tuned in the inspection engine/advanced settings, not in the syslog configuration.

Practice this question →
14
Multi-Selecthard

An administrator is troubleshooting an eStreamer integration where the client script disconnects immediately after authentication. Upon inspecting the logs, the administrator notes an SSL certificate verification error. Which TWO areas should be checked to resolve this certificate error? (Choose two)

Select 2 answers
A.Verify the pxGrid client approval status on the Cisco ISE dashboard.
B.Verify that the FMC CA root certificate has been correctly imported into the client application's trust store.
C.Ensure that the client certificate and private key bundle generated from the FMC were correctly copied and referenced by the client script.
D.Check the FTD Platform Settings syslog server IP configuration.
E.Restart the Snort engine on the FTD device.
AnswersB, C

Importing the FMC CA root certificate into the client trust store lets the eStreamer client validate the server certificate chain presented during the TLS handshake, resolving the verification error. Without that anchor, the client aborts immediately after authentication, satisfying the stem's requirement to check certificate trust configuration.

Why this answer

The SSL certificate verification error during eStreamer authentication points to a trust or identity problem in the TLS handshake between the client and the FMC. Option B is correct because the eStreamer client must trust the FMC's server certificate; if the FMC CA root certificate is not imported into the client application's trust store, the client cannot validate the server's certificate chain and will abort the connection. Option C is correct because eStreamer mutual TLS requires the client to present the certificate and private key bundle generated from the FMC; if that bundle was not copied correctly or the script references the wrong path, the certificate exchange fails and the client disconnects immediately after authentication.

Option A is incorrect because pxGrid client approval is an ISE concept unrelated to eStreamer, which authenticates directly against the FMC. Option D is incorrect because syslog server IP configuration in FTD Platform Settings has no bearing on eStreamer TLS certificate validation. Option E is incorrect because restarting the Snort engine on the FTD does not address certificate trust or client credential issues on the eStreamer client.

Practice this question →
15
MCQmedium

An administrator needs Cisco Secure Firewall Threat Defense to send connection and intrusion events to a third-party SIEM. The SIEM vendor requires that events arrive in a structured format over a reliable transport and supports only a specific event schema. Which FMC configuration should be used to meet these requirements?

A.Export events from FMC as CSV files on a schedule and import them into the SIEM with a custom script.
B.Enable syslog forwarding from each Threat Defense device and rely on the SIEM's generic syslog parser.
C.Configure the eStreamer service on FMC and use the vendor's eStreamer client to receive events in the vendor-supported schema.
D.Configure SNMP traps on FMC and map the OIDs to SIEM fields using a management information base.
AnswerC

eStreamer is the FMC service that streams security events, including connection and intrusion data, to external clients using a structured binary protocol. Many SIEM vendors provide an eStreamer-compatible client that maps the data into their schema. This satisfies the structured format, reliable TCP transport, and vendor schema requirements in a supported way.

Why this answer

eStreamer is purpose-built to export FMC security events, including connection and intrusion data, to external consumers over a reliable TCP connection and in a structured format. Because many SIEM vendors ship an eStreamer-compatible client that understands the schema, this configuration meets the structured format, reliability, and vendor schema requirements without custom parsing or batch delays.

Exam trap

The trap here is assuming syslog is sufficient for structured SIEM ingestion, when vendor schema support and reliable transport point to eStreamer instead.

Practice this question →
16
MCQhard

An administrator is integrating Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. The connection fails during the certificate validation phase because the FMC rejects the ISE pxGrid certificate. Upon inspection, the FMC certificate store lacks the intermediate CA certificate of the PKI hierarchy used by ISE. How should the administrator resolve this?

A.Configure an SNMPv3 community string to bridge the certificate trust gap.
B.Upload the complete certificate authority chain (Root and Intermediate CA certificates) into the FMC Trusted CAs object repository.
C.Generate a self-signed certificate on the FTD CLI and assign it as the pxGrid trust anchor.
D.Disable certificate validation in the FMC pxGrid advanced configuration menu.
AnswerB

pxGrid certificate validation requires the full issuing chain; uploading the Root and Intermediate CA certificates into the FMC Trusted CAs repository lets the FMC build a path to ISE's certificate. This directly resolves the stem's stated missing-intermediate-CA constraint.

Why this answer

Mutual TLS for pxGrid requires the FMC to trust the entire certificate chain presented by ISE. The administrator must upload both the Root CA and Intermediate CA certificates of the ISE PKI to the FMC's trusted certificate store under Object Management > PKI > Trusted CAs.

Practice this question →
17
MCQeasy

An enterprise environment requires streaming connection events, intrusion events, and file events from Cisco Secure Firewall Threat Defense to a third-party SIEM. Which native protocol and feature on the firewall is designed to stream these events in real time?

A.NetFlow v9
B.Syslog over UDP
C.eStreamer
D.SNMPv3 Traps
AnswerC

eStreamer is the native Firepower API that streams connection, intrusion and file events to external clients in real time, without syslog reformatting. It directly satisfies the requirement for native real-time event streaming to a third-party SIEM.

Why this answer

The eStreamer (Event Streamer) API allows external applications and SIEM systems to stream real-time connection, intrusion, and file events from the FMC.

Practice this question →
18
MCQmedium

A network security engineer is integrating Cisco Secure Firewall Threat Defense (FTD) with Cisco Identity Services Engine (ISE) for user identity-based policies. The engineer wants to use the Cisco Platform Exchange Grid (pxGrid) to share user identity information. Which component must be configured as a pxGrid client to receive user identity data from ISE?

A.Cisco Secure Firewall Management Center (FMC)
B.Cisco Secure Network Analytics (Stealthwatch)
C.Cisco Identity Services Engine (ISE) itself
D.Cisco Secure Firewall Threat Defense (FTD) device
AnswerA

In an FTD deployment managed by FMC, the FMC acts as the pxGrid client to receive user identity information from ISE. FMC then shares this information with the managed FTD devices. Configuring FMC as the pxGrid client is the correct approach for this integration.

Why this answer

FMC serves as the pxGrid client in an FTD deployment, receiving user identity data from ISE and distributing it to managed FTD devices. This centralized approach simplifies configuration and management. Other components like FTD or ISE do not fulfill this role.

Exam trap

The trap here is assuming that the FTD device itself connects directly to ISE via pxGrid, when in fact FMC handles the pxGrid client role in a managed deployment.

Practice this question →
19
MCQeasy

Which command is used on the Cisco Secure Firewall Threat Defense CLI to verify that the device is successfully communicating with the Cisco Secure Firewall Management Center?

A.show fmc status
B.show managers
C.show isc status
D.show controller connection
AnswerB

`show managers` queries the local manager registry and reports each configured Cisco Secure Firewall Management Center's registration state, IP address and heartbeat status. This directly satisfies the stem's requirement to verify live communication between the Threat Defense device and its management centre, confirming the management tunnel is up.

Why this answer

To check the registration and management connection status between FTD and FMC, the administrator uses the CLI command 'show managers'.

Practice this question →
20
MCQhard

An engineer is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. The SIEM requires that messages be reliably delivered and that the source of the messages be authenticated. The engineer enables syslog over TCP and configures a syslog server. Which additional configuration is required to meet the SIEM's authentication requirement?

A.Configure the Threat Defense device to use TCP syslog with an MD5 checksum on each message.
B.Configure the Threat Defense device to use UDP syslog with a shared secret key.
C.Configure the Threat Defense device to use TLS for syslog and install a certificate on the device that the SIEM trusts.
D.Configure the Threat Defense device to use TCP syslog and enable IPsec on the management interface.
AnswerC

Syslog over TLS provides authentication of the source through certificates and ensures confidentiality and integrity of the messages. By installing a certificate on the Threat Defense device that the SIEM trusts, the SIEM can verify that the messages originate from the authorized device. This meets the authentication requirement, whereas plain TCP syslog does not provide cryptographic authentication of the sender.

Why this answer

To meet both reliability and source authentication for syslog to a SIEM, syslog over TLS is the appropriate choice. TLS provides encryption, integrity, and certificate-based authentication of the sender. The Threat Defense device can be configured with a certificate that the SIEM trusts, allowing the SIEM to verify the origin of the messages.

Plain TCP syslog offers reliability but not authentication, while UDP and checksum-based approaches do not satisfy the authentication requirement.

Exam trap

The trap here is assuming that TCP syslog alone provides authentication because it is connection-oriented, when in fact TCP only provides reliable delivery and no cryptographic source verification.

Practice this question →
21
Multi-Selecthard

An administrator is troubleshooting an eStreamer client script failure where the connection is refused on port 8302. Which TWO potential causes should the administrator investigate? (Choose two)

Select 2 answers
A.An intermediate firewall or the FMC internal iptables firewall is blocking TCP port 8302 traffic.
B.The FTD Snort engine is out of memory.
C.The DHCP lease on the FTD data interface has expired.
D.The pxGrid certificate on ISE has expired.
E.The eStreamer service/daemon is not running or enabled on the FMC management plane.
AnswersA, E

Blocked TCP 8302 traffic directly explains the connection refusal, since eStreamer clients reach the FMC on that port. Both an intermediate firewall and the FMC's own iptables rules can drop the packets, so verifying each satisfies the stem's requirement to identify causes of the refused connection.

Why this answer

Option A is correct because eStreamer clients connect to the FMC on TCP port 8302, so a connection-refused or blocked result can come from an intermediate firewall or the FMC's own iptables rules filtering that port. Option E is correct because the eStreamer service (the eStreamer daemon on the FMC management plane) must be running and enabled; if it is stopped or disabled, nothing listens on TCP 8302 and the client receives a connection refused. Option B is not relevant because an out-of-memory Snort engine on an FTD affects inspection/event generation, not the FMC's eStreamer listener on port 8302.

Option C is not relevant because a DHCP lease expiry on an FTD data interface is a Layer 3 addressing issue unrelated to the FMC eStreamer service port. Option D is not relevant because pxGrid certificates on ISE pertain to pxGrid/ISE integration, not to the FMC eStreamer TCP 8302 service.

Practice this question →
22
Multi-Selecthard

An administrator wants to configure Access Control rules on Cisco Secure Firewall Threat Defense using identity context received from Cisco ISE via pxGrid. Which TWO criteria can be utilized in the Access Control policy rule configuration once pxGrid is fully integrated? (Choose two)

Select 2 answers
A.User names and User Groups
B.Security Group Tags (SGTs)
C.DHCP lease pool exhaustion percentages
D.OSPF neighbor adjacency states
E.MACsec encryption key lifetimes
AnswersA, B

Once pxGrid integration is active, the FMC receives ISE identity mappings, letting Access Control rules match traffic by user name and user group membership. This satisfies the requirement to enforce policy using identity context rather than IP addresses alone.

Why this answer

Option A is correct because once Cisco ISE is integrated with Cisco Secure Firewall Threat Defense via pxGrid, the firewall receives user identity mappings (user-to-IP and user-to-group) that can be referenced directly in Access Control policy rules as User and User Group conditions. Option B is correct because pxGrid also propagates Security Group Tags (SGTs) from ISE, and the Access Control policy can match traffic based on source/destination SGT values (TrustSec/SGT conditions) when the integration is fully established. Options C, D, and E are incorrect because DHCP lease pool exhaustion percentages, OSPF neighbor adjacency states, and MACsec encryption key lifetimes are not identity context delivered by pxGrid and are not selectable criteria in Access Control rule configuration; they relate to DHCP monitoring, routing protocol state, and link-layer encryption key management, respectively.

Practice this question →
23
MCQhard

An organization integrates Cisco Secure Firewall Threat Defense with Cisco ISE via pxGrid. The security team notices that identity rules are matching incorrect users for traffic originating from shared Citrix terminal servers or Virtual Desktop Infrastructure (VDI) multi-user hosts. What mechanism must be enabled and configured to properly handle multi-user IP identity attribution on Secure Firewall?

A.Configuring SXP peers between the VDI hypervisor and the FMC.
B.Configuring static NAT overloading on the FTD egress interface.
C.Enabling SNMP polling on the VDI host so FMC can query active user sessions every 10 seconds.
D.Port-Based Identity mapping (or Terminal Services Agent integration) to correlate user sessions by source port in addition to IP address.
AnswerD

Terminal Services Agent (TS Agent) reports per-session source ports to the firewall, letting identity rules map each user on a shared Citrix or VDI host to the correct session rather than attributing all traffic to one IP address.

Why this answer

On multi-user hosts like Citrix or VDI, many users share a single IP address, so IP-to-user mapping alone cannot distinguish sessions. Port-Based Identity mapping (or Terminal Services Agent integration) correlates the source port of each connection with the user session on the host, allowing FTD to attribute traffic to the correct user even when the IP is shared.

Exam trap

The trap is assuming IP-to-user mapping is sufficient for identity rules, ignoring that shared-IP multi-user hosts require port-level correlation via TS Agent or Port-Based Identity.

How to eliminate wrong answers

Option A is wrong because SXP is used to propagate SGT-to-IP bindings between trust domains, not to resolve multi-user identity on a shared host. Option B is wrong because static NAT overloading is a translation technique that would actually worsen attribution by hiding users behind one address. Option C is wrong because SNMP polling does not provide per-session user-to-port mapping and is not the mechanism Cisco uses for multi-user identity on FTD.

Practice this question →
24
Multi-Selecthard

An administrator is troubleshooting an eStreamer client connection between a Python script and the Cisco FMC. The script fails to authenticate. Which TWO items must be verified regarding the eStreamer client credentials? (Choose two)

Select 2 answers
A.Verify that the PKCS#12 certificate file and password/keys used by the client script match the credentials generated on the FMC.
B.Verify that the IP address of the client host matches the authorized IP address configured during eStreamer certificate generation on the FMC.
C.Verify the FTD Active Directory domain password.
D.Check the pxGrid client approval status on the Cisco ISE server.
E.Check the SNMPv3 community string on the FTD management interface.
AnswersA, B

eStreamer authenticates clients with a PKCS#12 certificate bundle, not username and password. The script must load the exact certificate and private key exported from the FMC, and supply the matching export password; any mismatch in that file, its password, or the paired key causes the TLS handshake to fail, producing the authentication error described.

Why this answer

Option A is correct because the eStreamer client authenticates to the FMC using the PKCS#12 (.p12) certificate bundle and its associated password/private key that were generated when the eStreamer certificate was created on the FMC; if the script references a different file or an incorrect password, the TLS handshake and authentication will fail. Option B is correct because during eStreamer certificate generation on the FMC the administrator specifies the authorized client IP address (or hostname), and the FMC will reject connections from any host whose source IP does not match that binding, so the client host's IP must match the configured value. Option C is not relevant because eStreamer authentication does not use FTD Active Directory domain credentials.

Option D is not relevant because pxGrid client approval is a Cisco ISE/pxGrid concept, not part of the FMC eStreamer authentication flow. Option E is not relevant because SNMPv3 community strings apply to SNMP polling/traps on the management interface and have nothing to do with eStreamer client authentication.

Practice this question →
25
Multi-Selecthard

An administrator is planning a third-party SIEM integration with Cisco Secure Firewall Management Center. Which TWO methods or protocols are officially supported for exporting event data from the FMC to the SIEM? (Choose two)

Select 2 answers
A.eStreamer API / protocol over TCP port 8302
B.Exporting raw packet captures (PCAP) via FTP every 5 minutes
C.Syslog export (UDP or TCP/TLS) configured via FTD Platform Settings
D.Direct SQL database replication from the FMC internal PostgreSQL database over SSH
E.NetFlow v5 export from the FMC management interface
AnswersA, C

eStreamer is Cisco's supported event-export API, streaming FMC event data to a SIEM client over TCP port 8302. It satisfies the stem's requirement for an officially supported export method, delivering high-volume, structured events rather than relying on syslog alone.

Why this answer

Option A is correct because the eStreamer (Event Streamer) API is Cisco's officially supported client-server protocol for sending FMC event data to third-party SIEMs; the eStreamer server on the FMC listens on TCP port 8302 and streams events to a client installed on the SIEM host. Option C is correct because FMC supports syslog export of events, configured through FTD Platform Settings (Syslog settings), and can send syslog over UDP or TCP, including TCP with TLS encryption, to an external SIEM. Option B is not correct because exporting raw PCAP files via FTP is not an event-export integration method for SIEMs and is not an officially supported SIEM data feed.

Option D is not correct because direct SQL replication from the FMC's internal PostgreSQL database over SSH is unsupported and would violate Cisco's database access model. Option E is not correct because NetFlow export is a traffic-flow telemetry feature, not an FMC event-export method to a SIEM, and the FMC management interface does not provide NetFlow v5 export for this purpose.

Practice this question →
26
Multi-Selecthard

An engineer is troubleshooting a scenario where Security Group Tags (SGTs) are not being enforced by FTD access control rules despite an active pxGrid connection between ISE and FMC. Which TWO potential causes should the engineer investigate? (Choose two)

Select 2 answers
A.The FTD management interface IP address is not registered in Active Directory.
B.The FMC eStreamer service is disabled, blocking SGT updates.
C.SXP peering or inline TrustSec header propagation is missing along the data path between the endpoint and the FTD interface.
D.Syslog facility local0 is not configured on the switch.
E.The Access Control policy rules do not have the corresponding Security Group Tags selected under the Users/SGT tab.
AnswersC, E

SGT enforcement requires the tag to survive transit, not merely reach FMC via pxGrid. Without SXP peering or inline TrustSec header propagation, the FTD interface receives untagged traffic, so access control rules matching SGTs cannot evaluate the endpoint's group.

Why this answer

Option C is correct because SGT enforcement on FTD requires that the tag actually reaches the device: either via inline TrustSec (Cisco Metadata) header propagation from the upstream switch, or via SXP peering that carries IP-to-SGT mappings to the FTD. If neither the inline tag nor an SXP-learned mapping is present on the data path, the FTD has no SGT to match even though pxGrid is up. Option E is correct because FTD access control rules must explicitly reference the SGT in the rule's source/destination (Users/SGT) condition; if no SGT object is selected in the rule, the rule cannot match tagged traffic regardless of pxGrid status.

Option A is incorrect because Active Directory registration of the FTD management IP is irrelevant to SGT propagation and enforcement. Option B is incorrect because eStreamer is a separate FMC event-streaming service for external consumers and is not the mechanism that delivers SGT mappings to FTD. Option D is incorrect because syslog facility local0 on a switch has no bearing on TrustSec tag propagation or FTD rule matching.

Practice this question →
27
MCQmedium

An engineer is configuring Cisco eStreamer to stream events from FMC to a third-party SIEM. The firewall security policy blocks incoming connections on port 8302 from the SIEM server to the FMC. Which device and interface are involved in listening for the eStreamer client connection?

A.The FTD data interface listening on TCP port 8302.
B.The FTD management interface listening on UDP port 514.
C.The ISE pxGrid node listening on TCP port 8910.
D.The FMC management interface listening on TCP port 8302.
AnswerD

The eStreamer server runs on the FMC itself, binding to its management interface and listening on TCP port 8302 for client connections from the SIEM. This satisfies the stem's constraint: the SIEM initiates inbound connections to that port, so the firewall policy must permit them.

Why this answer

The eStreamer server process runs on the Cisco Secure Firewall Management Center (FMC), listening on TCP port 8302 on its management interface.

Practice this question →
28
Multi-Selecthard

An administrator is designing a logging architecture where Cisco Secure Firewall Threat Defense exports connection and intrusion events to a third-party SIEM. Which TWO design principles should be followed to ensure security and scalability? (Choose two)

Select 2 answers
A.Disable all Access Control rule logging and enable eStreamer over unencrypted TCP port 8302.
B.Rely exclusively on FMC database storage without exporting events to any SIEM.
C.Implement Reliable Syslog (TCP/TLS) to ensure encrypted transmission and prevent packet loss during network congestion.
D.Configure all logs to be exported unencrypted via UDP port 514 across the internet.
E.Configure appropriate severity filters to prevent low-priority debug events from overwhelming SIEM storage and ingestion licenses.
AnswersC, E

Reliable Syslog over TCP/TLS satisfies both the security and scalability constraints: TLS encrypts event transmission to the third-party SIEM, while TCP's acknowledgement and retransmission prevent packet loss during congestion, unlike UDP-based syslog. This preserves event integrity and completeness as export volume scales.

Why this answer

Option C is correct because Reliable Syslog using TCP with TLS provides encrypted transport and TCP's acknowledgment/retransmission mechanisms prevent event loss during congestion, which is essential when exporting connection and intrusion events to a third-party SIEM. Option E is correct because applying appropriate severity filters ensures that only relevant events (e.g., higher-severity intrusion and connection events) are forwarded, preventing low-priority debug noise from exhausting SIEM storage capacity and ingestion license limits, which directly supports scalability. Option A is wrong because disabling Access Control rule logging removes valuable connection telemetry, and eStreamer on unencrypted TCP 8302 lacks transport encryption, undermining security.

Option B is wrong because relying solely on FMC database storage defeats the purpose of a SIEM architecture and provides no third-party correlation or long-term retention. Option D is wrong because exporting logs unencrypted over UDP 514 across the internet exposes sensitive event data to interception and UDP offers no delivery guarantee, causing packet loss.

Exam trap

300-710 SNCF often tests the false economy of UDP syslog and unfiltered logging, tempting candidates to pick 'send everything' or 'use UDP 514' as simple options when the exam wants TCP/TLS reliability plus severity filtering.

Practice this question →
29
Multi-Selecthard

An administrator is configuring Cisco ISE pxGrid integration with Cisco Secure Firewall Management Center. Which TWO identity sources or methods supported by ISE can provide context that is subsequently consumed by FTD via pxGrid? (Choose two)

Select 2 answers
A.Raw NetFlow v5 packet streams exported directly from core routers to the FMC
B.Guest WebAuth portal authentications
C.Active Directory / LDAP authentications via 802.1X or RADIUS
D.Local FTD administrator CLI login sessions
E.DHCP server static lease table text files imported manually into FMC
AnswersB, C

Guest WebAuth portal authentications supply identity context through ISE's guest services, where sponsor-approved or self-registered guest credentials are validated and published to pxGrid. This satisfies the stem's requirement for an ISE-supported identity source feeding FTD context, since guest sessions generate user-to-IP mappings that Secure Firewall Management Center consumes for policy enforcement.

Why this answer

Options B and C are correct because Cisco ISE pxGrid publishes identity and session context that it has learned from its own authentication and authorization services. Guest WebAuth portal authentications (B) are processed by ISE's guest services, so the resulting user identity, endpoint, and session attributes are available to be shared over pxGrid and consumed by FTD for identity-based policy. Active Directory / LDAP authentications via 802.1X or RADIUS (C) are core ISE identity sources; when users or machines authenticate through ISE against AD/LDAP, ISE maps that identity to the session and publishes it via pxGrid to FMC/FTD.

The other options do not belong: raw NetFlow v5 streams from routers (A) are traffic telemetry, not an ISE-supported identity source, and FMC does not ingest them as pxGrid identity context. Local FTD administrator CLI logins (D) are device-management events on the firewall itself, not ISE-authenticated user sessions. Manually imported DHCP static lease text files (E) are not an ISE pxGrid identity source and are not a supported method for providing ISE context to FTD.

Practice this question →
30
MCQeasy

Which protocol is utilized by Cisco Secure Firewall Management Center and FTD devices to communicate with Cisco SecureX for cloud-delivered threat intelligence?

A.SNMPv2c
B.HTTPS (REST API over port 443)
C.TFTP
D.Syslog over UDP 514
AnswerB

SecureX integration relies on outbound HTTPS REST API calls over port 443, allowing FMC and FTD to query cloud-delivered threat intelligence without inbound firewall openings. This satisfies the stem's requirement for the communication protocol, since the SecureX cloud service exposes only TLS-secured REST endpoints, not syslog or NetFlow channels.

Why this answer

Cisco SecureX and cloud services communicate with Cisco Secure Firewall Management Center using REST APIs over HTTPS (port 443).

Practice this question →
31
Multi-Selecthard

An enterprise security architect is designing an architecture where Cisco Secure Firewall Threat Defense integrates with a third-party SIEM. Which THREE methods or protocols are officially supported for exporting security events and logs from the FMC/Firewall to the third-party SIEM? (Choose three)

Select 3 answers
A.Direct SQL database replication from the FMC internal PostgreSQL database to the SIEM
B.Cisco SecureX / REST APIs for programmatic event retrieval
C.Syslog (UDP/TCP/TLS) forwarding from Platform Settings
D.SNMPv1 trap forwarding of full packet payloads
E.eStreamer API for custom client integrations
AnswersB, C, E

REST APIs, including Cisco SecureX, let a SIEM pull events programmatically over HTTPS rather than relying on pushed streams. This satisfies the requirement for an officially supported export method, complementing syslog and eStreamer for event retrieval.

Why this answer

Option B is correct because the FMC exposes documented REST APIs (and Cisco SecureX/Threat Response integrations) that allow programmatic retrieval of events, alerts, and metadata for third-party SIEM consumption. Option C is correct because syslog forwarding is configured under Platform Settings on the FMC/Firewall, supporting UDP, TCP, and TLS transports to send connection, intrusion, and audit events to external collectors. Option E is correct because eStreamer is Cisco's officially supported event-streaming API that lets custom clients receive real-time event data from the FMC for SIEM integration.

Option A is not supported: direct SQL replication against the FMC's internal PostgreSQL database is neither documented nor permitted, and would break support. Option D is not supported: SNMPv1 traps are used for health/status alerting, not for forwarding full packet payloads or complete security event logs.

Practice this question →
32
MCQmedium

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslogs to a third-party SIEM. To ensure confidentiality of sensitive log data traversing untrusted network segments, how should the syslog export be configured?

A.Configure Reliable Syslog utilizing TCP with TLS encryption under Platform Settings > Syslog.
B.Configure HTTPS POST requests in the eStreamer client configuration.
C.Enable Secure Shell (SSH) port forwarding for UDP port 514.
D.Tunnel all UDP syslog packets inside an IPsec VPN tunnel terminated on the FMC management interface.
AnswerA

Reliable Syslog over TCP with TLS encrypts log payloads in transit, satisfying the stem's confidentiality requirement across untrusted segments. Plain UDP syslog would expose sensitive data, so enabling TLS under Platform Settings > Syslog is the correct mechanism.

Why this answer

To secure syslog transmission, administrators configure Reliable Syslog, which uses TLS encryption over TCP (typically on TCP port 6514) between the FTD and the SIEM syslog collector.

Practice this question →
33
MCQeasy

An administrator is configuring Cisco Secure Firewall Threat Defense to send connection and intrusion events to a third-party SIEM. Which protocol and port are natively supported by the eStreamer client integration for streaming events from the firewall?

A.TCP port 514 using standard Syslog
B.TCP port 9997 using Splunk Forwarder protocol
C.UDP port 443 using HTTPS
D.TCP port 8302 using the eStreamer API
AnswerD

TCP port 8302 carries eStreamer's proprietary binary event stream, which the third-party SIEM consumes via the eStreamer client API rather than syslog. This satisfies the stem's requirement for native streaming of connection and intrusion events, since eStreamer is Cisco Secure Firewall Threat Defense's purpose-built event export mechanism.

Why this answer

The Cisco eStreamer (Event Streamer) daemon on Secure Firewall Threat Defense communicates with external clients over TCP port 8302, using a securely negotiated SSL/TLS connection.

Practice this question →
34
Multi-Selectmedium

Which THREE configuration settings must be verified on the FMC when troubleshooting syslog export issues to a third-party SIEM receiver? (Choose three)

Select 3 answers
A.Syslog server IP address and port configuration in Platform Settings
B.pxGrid client approval status in Cisco ISE
C.Protocol selection (UDP, TCP, or TLS) matching the SIEM collector capability
D.eStreamer client certificate validity
E.Access Control rule logging options enabled to log at beginning or end of connection
AnswersA, C, E

Platform Settings defines the destination syslog server IP and port that the FMC uses for event export, so verifying these confirms the SIEM receiver is reachable at the expected address. If the IP or port is wrong, or the port mismatches the receiver's listener, syslog messages never arrive, directly satisfying the stem's export-failure constraint.

Why this answer

Option A is correct because the syslog server IP address and port must be configured under Platform Settings > Syslog on the FMC; if the destination host or port is wrong or missing, no events will reach the third-party SIEM receiver. Option C is correct because the transport protocol selected on the FMC (UDP, TCP, or TLS) must match what the SIEM collector is listening for and can decode; a mismatch such as sending UDP to a TCP/TLS-only collector silently drops the events. Option E is correct because Access Control rule logging must be enabled with the appropriate log action (log at beginning and/or end of connection) for connection events to be generated and forwarded to syslog; without logging enabled on the relevant rules, there is nothing to export.

Option B does not belong because pxGrid client approval in Cisco ISE relates to pxGrid-based identity and context sharing, not to FMC syslog export to a SIEM. Option D does not belong because eStreamer uses its own client certificate and is a separate event-streaming mechanism from syslog export, so its certificate validity is irrelevant to troubleshooting syslog delivery.

Practice this question →
35
Multi-Selecthard

An administrator wants to ensure that all security event logs from Cisco Secure Firewall Threat Defense are exported reliably and in real time to external security analytics tools. Which TWO deployment and configuration practices should be implemented? (Choose two)

Select 2 answers
A.Rely solely on local FTD disk storage and export logs via manual SCP once a week.
B.Configure Reliable Syslog (TCP with TLS) in FTD Platform Settings to ensure encrypted and guaranteed log delivery.
C.Disable the Snort engine to prevent log buffer congestion.
D.Configure eStreamer on the FMC to stream intrusion, connection, and malware events to a SIEM collector.
E.Configure SNMPv1 traps to poll event counters every 60 seconds.
AnswersB, D

Reliable Syslog over TCP with TLS satisfies the real-time, guaranteed-delivery constraint by using connection-oriented transport with acknowledgement and retransmission, unlike UDP syslog which drops events silently. TLS encrypts the stream, meeting the secure export requirement to external analytics tools without relying on best-effort delivery.

Why this answer

Option B is correct because configuring Reliable Syslog in FTD Platform Settings uses TCP with TLS (port 6514 by default) to provide encrypted, connection-oriented, acknowledged delivery of syslog events, which prevents log loss and satisfies the requirement for reliable, real-time export to external analytics tools. Option D is correct because eStreamer on the FMC streams intrusion, connection, malware, and other security events in near real time to a SIEM collector over a persistent TLS connection, which is the Cisco-recommended method for feeding external security analytics platforms. Option A is wrong because local disk storage with weekly manual SCP exports is neither real-time nor reliable, and risks losing events if the disk fills or the device fails.

Option C is wrong because disabling the Snort engine would stop intrusion event generation entirely and does not address log transport. Option E is wrong because SNMPv1 traps only carry event counters and are unencrypted, unacknowledged, and not designed for streaming detailed security event logs.

Practice this question →
36
MCQhard

An administrator is troubleshooting an eStreamer integration where custom Python client scripts fail to receive events from the FMC. The administrator verifies that network connectivity, certificates, and user permissions are correct. Upon running the client script in verbose mode, the error indicates an 'Incompatible Protocol Version' between the client SDK and the FMC. How is this resolved?

A.Downgrade the FMC software to match the legacy eStreamer client library.
B.Update the eStreamer client SDK on the third-party SIEM to a version compatible with the current FMC software release.
C.Switch from eStreamer to legacy SNMP traps.
D.Modify the eStreamer version registry key in the FMC expert shell configuration file.
AnswerB

The eStreamer protocol version is negotiated between the client SDK and the FMC's eStreamer server; a mismatch produces the 'Incompatible Protocol Version' error even when connectivity, certificates, and permissions are valid. Updating the client SDK to a release matching the FMC software version restores compatible protocol negotiation, satisfying the stem's version-compatibility constraint.

Why this answer

Cisco FMC updates frequently include eStreamer protocol version upgrades. If an older third-party SIEM client SDK is used with a newly upgraded FMC, the client SDK must be updated to match or support the eStreamer protocol version running on the FMC.

Practice this question →
37
MCQmedium

A security team uses Cisco Secure Firewall Management Center (FMC) to manage several Cisco Secure Firewall Threat Defense (FTD) devices. They need to integrate with Cisco Identity Services Engine (ISE) to enforce identity-based access policies. The ISE deployment uses a standalone node with pxGrid enabled. After configuring the pxGrid client on FMC, the administrator notices that user identity data is not being populated in FMC. Which action should be taken to allow FMC to receive identity information from ISE?

A.Configure a TrustSec SXP connection between FMC and ISE.
B.Add FMC as a RADIUS client on ISE and configure RADIUS accounting.
C.Enable the pxGrid service on ISE and subscribe FMC to the session directory topic.
D.Configure a syslog source on ISE to send identity events to FMC.
AnswerC

FMC integrates with ISE via pxGrid to receive user identity and session information. The pxGrid service must be enabled on ISE, and FMC must subscribe to the appropriate topic, typically session directory, to receive updates. This is the correct configuration to allow FMC to learn user identities.

Why this answer

The integration between FMC and ISE relies on pxGrid to share user identity and session data. Enabling pxGrid on ISE and subscribing FMC to the session directory topic allows FMC to receive real-time updates about user sessions, which can then be used in access control policies. Other methods like syslog, RADIUS, or SXP do not provide the necessary identity context.

Exam trap

The trap here is confusing identity sharing mechanisms, such as RADIUS or SXP, with the pxGrid protocol that is specifically used for FMC-ISE integration.

Practice this question →
38
Multi-Selectmedium

Which THREE types of events can be streamed natively from Cisco Secure Firewall using the eStreamer API to a third-party SIEM or custom application? (Choose three)

Select 3 answers
A.Connection events
B.FMC hardware temperature sensor telemetry logs
C.File events
D.CLI administrator command audit logs
E.Intrusion events
AnswersA, C, E

Connection events are one of the three natively streamed eStreamer record types, carrying session metadata such as source and destination IP, ports, and action, which the FMC exports directly to a third-party SIEM without extra parsing.

Why this answer

The eStreamer API is Cisco Secure Firewall's native event-streaming interface that pushes specific event categories to external SIEMs or custom applications. Option A (Connection events) is correct because connection/flow records are one of the core event types eStreamer exports, providing session details such as source/destination IP, ports, and bytes. Option C (File events) is correct because file and malware events generated by file policy (including file disposition and trajectory data) are streamed via eStreamer.

Option E (Intrusion events) is correct because IPS/intrusion events from Snort-based inspection are a primary eStreamer event class. Option B is not correct because hardware temperature sensor telemetry is not an eStreamer event type; it is health monitoring data surfaced in FMC, not streamed through eStreamer. Option D is not correct because CLI administrator command audit logs are not part of the eStreamer event stream; administrative audit records are handled through FMC audit logging rather than eStreamer.

Practice this question →
39
MCQhard

An administrator configures pxGrid integration between Cisco ISE and Cisco Secure Firewall Threat Defense. During the certificate enrollment process, the firewall fails to trust the ISE pxGrid node. What is the most likely root cause of this failure in a standalone FMC deployment?

A.The SXP secret password does not match between ISE and the firewall.
B.The pxGrid subscriber profile on ISE was not approved within 24 hours.
C.The ISE pxGrid root CA certificate is not imported into the FMC trusted certificates store.
D.RADIUS shared secrets are mismatched on the Policy Service Nodes.
AnswerC

pxGrid certificate enrolment requires the firewall to validate the ISE pxGrid node's certificate chain. In a standalone FMC deployment, if the ISE pxGrid root CA certificate is absent from the FMC trusted certificates store, validation fails and trust cannot be established.

Why this answer

For pxGrid communication to establish successfully, the ISE pxGrid node certificate and FMC/Firewall pxGrid certificate must be signed by a mutually trusted Certificate Authority (CA), and the CA root certificate must be imported into the FMC trusted certificates store.

Practice this question →
40
MCQhard

An administrator configures pxGrid integration between Cisco ISE and Secure Firewall Management Center. During the pxGrid certificate generation on ISE, the administrator must export the client certificate and keystore. What format must the client keystore be in when importing it into the FMC to establish the pxGrid trust relationship?

A.Plaintext DER binary format without private keys.
B.PKCS#12 (.pfx/.p12) bundle containing the client certificate, private key, and CA certificate.
C.Microsoft Exchange Web Services (EWS) XML format.
D.Java KeyStore (.jks) format exclusively.
AnswerB

FMC's pxGrid client import requires a PKCS#12 bundle, since this single encrypted container carries the client certificate, its matching private key, and the CA chain together. That satisfies the stem's constraint of exporting both certificate and keystore from ISE, as PEM or DER files hold no private key and cannot complete the mutual TLS handshake.

Why this answer

The pxGrid client keystore must be a PKCS#12 (.pfx/.p12) bundle because FMC needs the client certificate, its matching private key, and the CA certificate together in one password-protected container to authenticate to the ISE pxGrid controller. ISE's pxGrid certificate generation workflow explicitly produces a .p12 file for download, and FMC's pxGrid client import expects exactly that bundle. Without the private key and CA chain in the same file, the TLS mutual-authentication handshake with ISE cannot complete.

Exam trap

300-710 SNCF often tests whether candidates confuse certificate export formats, tempting them to pick DER or JKS when the pxGrid/FMC workflow specifically requires a PKCS#12 bundle that includes the private key and CA chain.

How to eliminate wrong answers

Option A is wrong because a plaintext DER file without private keys contains only a public certificate and cannot perform the client-side TLS authentication pxGrid requires. Option C is wrong because EWS XML is a Microsoft Exchange messaging format with no role in certificate storage or pxGrid trust. Option D is wrong because FMC does not import Java KeyStore (.jks) files for pxGrid; JKS is a Java-specific keystore format, whereas Cisco's pxGrid integration documentation specifies PKCS#12.

Practice this question →
41
Multi-Selecthard

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO fields or parameters can be included in the syslog output to facilitate incident investigation and event parsing by the SIEM? (Choose two)

Select 2 answers
A.Full memory core dump binary attachments
B.Precise timestamp formatting (UTC or local time) configured in Platform Settings
C.FMC administrator SSH private keys
D.Firewall device name or identifier in the syslog header
E.Raw packet captures (PCAP) of dropped connections embedded in syslog text
AnswersB, D

Precise timestamp formatting configured in Platform Settings satisfies the SIEM parsing constraint: consistent UTC or local timestamps let the SIEM correlate events across devices and build accurate timelines during incident investigation. Without standardised time, log correlation and forensic reconstruction become unreliable.

Why this answer

Option B is correct because the syslog timestamp format (UTC or local time) is configurable under Platform Settings > Syslog in FTD, and consistent, precise timestamps are essential for correlating events across the SIEM and establishing accurate incident timelines. Option D is correct because including the firewall device name or identifier in the syslog header lets the SIEM attribute each event to its originating sensor, which is critical in multi-device deployments for parsing, filtering, and investigation. The remaining options are not valid syslog fields: a full memory core dump (A) is a diagnostic binary artifact, not syslog content; FMC administrator SSH private keys (C) are credentials that must never be transmitted in logs; and raw PCAP data (E) is captured separately via packet capture tools and cannot be embedded as text in syslog messages.

Practice this question →
42
MCQmedium

An administrator is setting up Cisco SecureX threat intelligence integration with Cisco Secure Firewall Management Center. The test connection fails with a 'Token Expired or Invalid' error. What is the correct procedure to re-establish trust and authentication between the FMC and SecureX?

A.Log into the FTD CLI and execute the 'clear securex-token' command.
B.Generate a new client ID and API key from the Cisco SecureX (Security Cloud Control) console and update the integration credentials in FMC System > Integration > SecureX.
C.Reinstall the Snort rule updates package on the FMC.
D.Reboot the FMC appliance to regenerate the internal device certificate.
AnswerB

SecureX integration authenticates using a client ID and API key generated in the Security Cloud Control console. Regenerating these credentials and updating them under FMC System > Integration > SecureX restores the expired or invalid token trust.

Why this answer

To resolve API token or cloud registration expirations for SecureX, the administrator must re-register the FMC with SecureX by generating a new API key / integration credential from the SecureX/Security Cloud Control portal and pasting it into the FMC System > Integration > SecureX settings.

Practice this question →
43
Multi-Selectmedium

An administrator is integrating Cisco Secure Firewall Management Center with a third-party SIEM using eStreamer. The administrator needs to ensure that the eStreamer client can receive events from the FMC. Which two actions are required to configure eStreamer on the FMC? (Choose two.)

Select 2 answers
A.Configure a syslog server object on the FMC and set it to forward events to the eStreamer client.
B.Configure the eStreamer service on the FMC to allow connections from the client's IP address.
C.Generate a client certificate on the FMC for the eStreamer client and configure the client to use it.
D.Enable the eStreamer service on the Threat Defense devices and configure them to forward events to the FMC.
E.Install the eStreamer service on the FMC and start it.
AnswersB, C

After installing the eStreamer service on the FMC, you must configure the eStreamer server to accept connections from the client's IP address. This is done by adding the client's IP to the eStreamer configuration on the FMC. Without this, the client's connection attempts will be rejected, even if the certificate is valid. This is a necessary step to establish connectivity.

Why this answer

To enable an eStreamer client to receive events from the FMC, you must generate a client certificate on the FMC and configure the client to use it, and you must allow the client's IP address in the eStreamer configuration. These two actions establish secure authentication and network access, allowing the client to connect and receive event streams.

Exam trap

The trap here is assuming that eStreamer runs on the Threat Defense devices or that syslog configuration is involved, when in fact eStreamer is an FMC service requiring certificate and IP-based access.

Practice this question →
44
MCQhard

An administrator integrates Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. After successful registration, the administrator wants to create an Access Control policy rule that blocks traffic from users in the 'Contractors' Security Group Tag. Where in the FMC rule creation wizard should the administrator configure this condition?

A.In the Access Control Rule, navigate to the Users tab and select the desired Security Group Tag.
B.In Objects > Object Management > Access Control > SGT Objects.
C.In the Platform Settings policy under Identity Sources.
D.In the Access Control Rule, navigate to the Networks tab and select Security Groups.
AnswerA

Security Group Tags are identity attributes delivered via pxGrid, so the FMC exposes them on the Users tab of the Access Control rule. Selecting the Contractors SGT there matches traffic by ISE-assigned identity rather than by IP address or port.

Why this answer

In FMC Access Control policies, user and tag-based criteria are added under the 'Users' tab of the rule configuration, where Security Group Tags learned via pxGrid can be selected.

Practice this question →
45
Multi-Selectmedium

Which TWO benefits are gained by integrating Cisco Secure Firewall with Cisco Identity Services Engine (ISE) using TrustSec SGTs? (Choose two)

Select 2 answers
A.Propagation of security tags across network boundaries via SXP for consistent enforcement
B.Policy creation based on user roles and group membership rather than dynamic IP addresses
C.Automatic remediation of endpoint malware infections via direct quarantine commands sent from the firewall to Active Directory
D.Replacement of traditional routing protocols with TrustSec matrix routing
E.Elimination of the need for access control rules on the firewall
AnswersA, B

SXP propagates Security Group Tags to devices that cannot read inline SGT tags, such as older switches and third-party equipment, extending enforcement across network boundaries. This satisfies the stem's integration requirement by letting Cisco Secure Firewall apply consistent group-based policy wherever traffic traverses, without relying on IP addresses.

Why this answer

Option A is correct because integrating Cisco Secure Firewall with ISE via TrustSec uses SXP (SGT Exchange Protocol) to propagate Security Group Tags (SGTs) across network boundaries, allowing consistent policy enforcement even where inline tagging is not supported. Option B is correct because ISE supplies identity and group information (user roles, AD group membership) that maps to SGTs, so firewall rules can be written against security group tags instead of volatile IP addresses. Option C is incorrect because the firewall does not send quarantine commands directly to Active Directory; remediation is typically handled by ISE/pxGrid and endpoint tools, not AD.

Option D is incorrect because TrustSec is a segmentation/policy framework and does not replace routing protocols such as OSPF or BGP. Option E is incorrect because access control rules are still required on the firewall; SGTs enrich and simplify them rather than eliminating them.

Practice this question →
46
Multi-Selecthard

An administrator integrates Cisco Secure Firewall with Cisco SecureX. Which TWO components or settings are required on the FMC to establish and maintain this cloud integration? (Choose two)

Select 2 answers
A.Valid API integration keys / credentials generated from the Cisco SecureX cloud management console and pasted into the FMC.
B.An active eStreamer daemon listening on TCP port 8302 for SecureX incoming connection polls.
C.A direct SSH tunnel between the FTD data plane and the SecureX cloud.
D.An active pxGrid session client on every managed FTD device.
E.Outbound HTTPS (TCP port 443) connectivity from the FMC management interface to the SecureX cloud endpoints.
AnswersA, E

SecureX cloud integration is authenticated by API credentials generated in the SecureX console and entered on the FMC; these keys authorise the FMC to register with and query the cloud service, satisfying the integration requirement.

Why this answer

Option A is correct because integrating the FMC with Cisco SecureX requires generating API credentials (client ID and secret / API key) in the SecureX cloud portal and entering them on the FMC under the SecureX/Cloud Services registration, which authenticates the FMC to the cloud service. Option E is correct because the FMC management interface must reach the SecureX cloud endpoints over outbound HTTPS on TCP 443 for registration, token exchange, and ongoing telemetry/health updates. Option B is incorrect: eStreamer (TCP 8302) is a legacy event-streaming service used by other integrations, not the mechanism SecureX uses to poll the FMC.

Option C is incorrect because SecureX integration uses REST APIs over HTTPS, not a direct SSH tunnel to the FTD data plane. Option D is incorrect because pxGrid is an ISE-based identity sharing framework and is not required on each managed FTD for SecureX cloud integration.

Practice this question →
47
MCQhard

An enterprise integrates Cisco Secure Firewall with Cisco SecureX. The security team wants to leverage SecureX Threat Intelligence to automatically quarantine endpoints that exhibit malicious behavior. How does the integration coordinate this mitigation action across SecureX, FMC, and ISE?

A.SecureX directly accesses the FTD data plane via SSH to shut down the physical switchport.
B.SecureX instructs Cisco ISE via API/pxGrid to apply an Adaptive Network Control (ANC) quarantine policy to the endpoint, while FMC blocks associated traffic flows.
C.The FTD continuously polls SecureX and reconfigures its VLAN database using VTP.
D.ISE sends a DHCP release packet to the endpoint through the FTD inspection engine.
AnswerB

SecureX Threat Intelligence triggers mitigation through pxGrid, which Cisco ISE uses to apply Adaptive Network Control quarantine policies to the endpoint. FMC simultaneously enforces blocking of associated traffic flows. This satisfies the stem's requirement for coordinated, automated endpoint quarantine across SecureX, FMC and ISE without manual intervention.

Why this answer

SecureX orchestrates threat response by triggering an API call to ISE (via pxGrid/ANC) to dynamically apply an Adaptive Network Control (ANC) quarantine policy or to FMC to block the IP, isolating the compromised endpoint.

Practice this question →
48
Multi-Selecthard

An administrator configures Cisco Secure Firewall Threat Defense to integrate with Cisco ISE via pxGrid. Which TWO operational benefits are provided by this integration for firewall policy enforcement? (Choose two)

Select 2 answers
A.Automatic generation of FTD intrusion detection signatures.
B.Real-time streaming of raw PCAP files to third-party SIEM platforms.
C.Direct management of FMC appliance administrator passwords.
D.Consumption of Security Group Tags (SGTs) for tag-based microsegmentation and access filtering.
E.Enforcement of Access Control policies based on user identity, username, and user group membership.
AnswersD, E

Consuming Security Group Tags lets the firewall enforce policy on identity-derived tags rather than IP addresses, satisfying the requirement for dynamic, tag-based microsegmentation. pxGrid streams SGT-to-IP mappings from Cisco ISE, so the Threat Defense appliance applies access filtering that follows workloads as addresses change.

Why this answer

The pxGrid integration between Cisco Secure Firewall Threat Defense (FTD) and Cisco ISE enables the firewall to subscribe to ISE's identity and context data, so option E is correct: FTD can enforce Access Control policies using user identity, username, and user group membership learned via pxGrid (identity-based firewall rules). Option D is also correct because pxGrid can deliver Security Group Tags (SGTs) from ISE, allowing FTD to perform tag-based microsegmentation and access filtering using SGT values in its rules. Option A is not provided by pxGrid integration; IDS/IPS signatures are delivered through Cisco Talos signature updates, not ISE.

Option B is incorrect because pxGrid does not stream raw PCAP files to SIEMs; it shares contextual session/identity data, and PCAP export is a separate FTD/FMC capability. Option C is incorrect because FMC administrator password management is not an ISE pxGrid function; ISE integration is about identity and group context, not managing FMC admin credentials.

Practice this question →
49
Multi-Selecthard

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages. Which TWO options can be included in the syslog message header or content to assist SIEM correlation and analysis? (Choose two)

Select 2 answers
A.Device name or firewall identifier in the syslog header
B.FMC administrator password hash for auditing
C.Full Active Directory database file attachments
D.Precise timestamp formatting (UTC or local time) configured in Platform Settings
E.Raw PCAP binary dumps appended to every syslog packet
AnswersA, D

Including the device name or firewall identifier in the syslog header lets the SIEM attribute each message to its originating firewall, which is essential for correlation when multiple Threat Defense devices forward events to a central collector.

Why this answer

Option A is correct because the syslog header generated by Cisco Secure Firewall Threat Defense includes the device name or firewall identifier (the configured hostname), which lets a SIEM attribute each event to a specific sensor and correlate events across multiple firewalls. Option D is correct because Platform Settings on the FMC allow you to configure the syslog timestamp format (e.g., UTC or local time) and message severity, and a precise, consistent timestamp is essential for ordering and correlating events in a SIEM. Option B is not valid because exporting an FMC administrator password hash has no correlation value and would be a serious security exposure.

Option C is not valid because syslog messages are lightweight event records and cannot carry a full Active Directory database file. Option E is not valid because syslog is a text-based protocol and does not append raw PCAP binary dumps to every message; packet capture is handled separately.

Practice this question →
50
MCQhard

An organization uses Cisco Secure Firewall Threat Defense and integrates with Cisco ISE for identity policies. The security team notices that identity rules are intermittently failing because the FTD cache of IP-to-user mappings is being flushed unexpectedly. Upon investigation, what condition on FTD or ISE typically causes the purging of active user identity maps?

A.A mismatch in the NTP time synchronization greater than 5 minutes between the FTD and the FMC.
B.Exceeding the FMC database storage limit for event logging.
C.Receipt of an accounting stop message from the authenticator or an explicit session termination event from ISE pxGrid.
D.Automatic daily rotation of the FMC administrator password.
AnswerC

Accounting stop or pxGrid session termination signals the user session has ended, so FTD removes the stale IP-to-user binding. This satisfies the stem's purging condition, explaining why active identity maps disappear intermittently when ISE reports session teardown.

Why this answer

User identity mappings on FTD can be purged or invalidated due to RADIUS accounting stop messages, explicit pxGrid session termination notices from ISE (such as logoff or re-authentication timeouts), or when the maximum session idle timer expires on the firewall identity policy configuration.

Practice this question →
51
Multi-Selectmedium

Which TWO actions must be performed on Cisco ISE when setting up pxGrid integration with Cisco Secure Firewall Management Center (FMC)? (Choose two.)

Select 2 answers
A.Enable TrustSec SGT propagation via NetFlow v9 on all ISE interfaces.
B.Approve the certificate for the FMC client within the Cisco ISE pxGrid services administration interface.
C.Configure SNMPv3 traps on ISE to forward user IP mappings to the FMC.
D.Configure a RADIUS shared secret on the FMC platform settings page.
E.Enable the pxGrid service on the appropriate Cisco ISE Policy Service Nodes or Administration nodes.
AnswersB, E

pxGrid requires mutual certificate trust, so the FMC client certificate must be approved in the ISE pxGrid services administration interface before the integration works. Without this approval, ISE rejects the FMC's pxGrid connection during the handshake, satisfying the stem's setup requirement.

Why this answer

Option B is correct because pxGrid uses mutual certificate-based authentication, so after the FMC registers as a pxGrid client, its client certificate must be approved in the ISE pxGrid Services administration interface before the FMC can subscribe to or publish pxGrid topics. Option E is correct because the pxGrid persona/service must be explicitly enabled on the ISE nodes (Policy Service Nodes or the Administration node) that will participate in the integration; otherwise the pxGrid controller and pub/sub services are not active and FMC cannot connect. Options A, C, and D are not required: pxGrid does not rely on TrustSec SGT propagation via NetFlow v9, SNMPv3 traps are not used to forward user-IP mappings to FMC, and RADIUS shared secrets belong to RADIUS authentication (e.g., for user or device authentication) rather than to the pxGrid integration itself.

Practice this question →
52
Multi-Selecthard

An engineer is troubleshooting Cisco SecureX threat intelligence integration with Cisco Secure Firewall Management Center. The firewall is failing to receive updated indicators of compromise. Which TWO troubleshooting steps should the engineer perform? (Choose two)

Select 2 answers
A.Verify that outbound HTTPS (port 443) connectivity from the FMC management interface to the SecureX cloud is unobstructed.
B.Re-register the FTD with the FMC using a new registration key.
C.Check the FMC integration settings and re-authenticate or regenerate the SecureX API integration credentials if expired.
D.Run 'show threat-response debug' on the FTD CLI.
E.Restart the pxGrid service on the FTD command line.
AnswersA, C

SecureX threat intelligence reaches the FMC over outbound HTTPS from its management interface, so blocked port 443 traffic directly halts indicator updates. Verifying that path satisfies the stem's requirement to restore IoC delivery, since the FMC initiates these cloud requests itself rather than receiving inbound pushes.

Why this answer

Option A is correct because SecureX threat intelligence is delivered to FMC over the cloud, so the FMC management interface must have outbound HTTPS (TCP 443) access to the SecureX cloud; blocked or filtered 443 traffic prevents IoC updates from being received. Option C is correct because the FMC-to-SecureX integration relies on API credentials/tokens that can expire or be revoked, so re-authenticating or regenerating the SecureX API integration credentials restores the subscription and allows updated indicators to flow. Option B is not relevant because FTD registration with FMC is a device-management function and does not affect the SecureX cloud intelligence feed.

Option D is not applicable because 'show threat-response debug' is not a valid FTD command for diagnosing SecureX IoC delivery. Option E is incorrect because pxGrid is an ISE/identity service, not an FTD CLI service used for SecureX threat intelligence retrieval.

Practice this question →
53
MCQhard

An organization mandates that all integration traffic between Cisco Firepower Management Center and Cisco SecureX must be inspected. Which cloud connection mechanism does FMC use to communicate with SecureX threat intelligence and telemetry?

A.Direct syslog forwarding over TCP 6514 to the SecureX collector.
B.Outbound HTTPS REST API communication to Cisco SecureX cloud endpoints.
C.Inbound SSH tunneling initiated by the SecureX cloud connector.
D.Bidirectional IPSec VPN tunnel established automatically between FMC and SecureX cloud cluster.
AnswerB

FMC initiates outbound HTTPS REST API calls to Cisco SecureX cloud endpoints; no inbound listener or persistent tunnel is required. This satisfies the mandate that integration traffic be inspected, since the firewall can decrypt and examine that outbound TLS flow.

Why this answer

FMC connects outbound to Cisco SecureX using HTTPS (TCP port 443) via public cloud APIs and messaging fabric.

Practice this question →
54
Multi-Selecthard

An administrator integrates Cisco Secure Firewall Management Center with Cisco SecureX. Which TWO benefits and features are unlocked by this cloud integration? (Choose two)

Select 2 answers
A.Replacement of the FMC PostgreSQL database with a cloud-hosted data warehouse.
B.Direct hardware provisioning and zero-touch booting of physical FTD appliances via SecureX.
C.Cross-product pivoting and investigation capabilities from security events to network flows.
D.Automatic generation of TACACS+ administrator credentials for FTD CLI access.
E.Centralized threat intelligence synchronization and automated indicator blocking across managed FTD sensors.
AnswersC, E

SecureX integration lets analysts pivot from an FMC security event directly into associated network flows and other Cisco product telemetry, enriching investigation context. This cross-product pivoting satisfies the scenario's requirement for unified threat investigation across the integrated security ecosystem.

Why this answer

Option C is correct because integrating FMC with Cisco SecureX enables cross-product pivoting and investigation: security events seen in FMC can be enriched and pivoted into related network flows and telemetry from other Cisco security products through SecureX threat response, accelerating investigation and response. Option E is correct because the integration synchronizes threat intelligence (for example, from Cisco Talos and other sources) into FMC and enables automated blocking of malicious indicators such as IPs, domains, and file hashes across managed FTD sensors via access control and intrusion policies. Option A is incorrect because SecureX does not replace the FMC's on-box PostgreSQL database with a cloud-hosted data warehouse; FMC retains its local configuration and event database.

Option B is incorrect because SecureX does not perform direct hardware provisioning or zero-touch booting of physical FTD appliances; those tasks rely on mechanisms like FTD zero-touch provisioning with a cloud-delivered manager or on-premises FMC. Option D is incorrect because SecureX does not automatically generate TACACS+ administrator credentials for FTD CLI access; TACACS+ authentication is configured separately on FMC/FTD and the TACACS+ server.

Practice this question →
55
Multi-Selecthard

An administrator is configuring third-party SIEM integration using syslog on Cisco Secure Firewall Threat Defense. Which TWO configuration practices are recommended to ensure optimal log management and troubleshooting? (Choose two)

Select 2 answers
A.Disable connection teardown logging to reduce log volume.
B.Configure all FTD devices to use UDP port 514 without severity filters.
C.Configure severity filtering to prevent excessive, low-priority debug logs from overwhelming the SIEM ingestion capacity.
D.Export raw PCAP files via syslog instead of text logs.
E.Use Reliable Syslog over TCP with TLS encryption where confidentiality and guaranteed delivery are required.
AnswersC, E

Severity filtering directly addresses the SIEM ingestion constraint by suppressing low-priority debug events before they leave Threat Defense, so only actionable syslog messages reach the collector. This preserves ingestion capacity and keeps troubleshooting signal clear, satisfying the stem's requirement for optimal log management.

Why this answer

Option C is correct because configuring severity filtering on the FTD syslog settings ensures that only events at or above the desired severity level are sent, preventing low-priority debug or informational messages from consuming SIEM ingestion bandwidth and storage. Option E is correct because Reliable Syslog over TCP with TLS (often configured via the 'logging host' command with the 'secure' or TCP/TLS options) provides guaranteed message delivery and encryption, which is recommended when confidentiality and reliable delivery to the third-party SIEM are required. Option A is not recommended because disabling connection teardown logging removes valuable session-end data (bytes, duration, close reason) that SIEMs rely on for traffic analysis and correlation.

Option B is not recommended because using UDP port 514 without severity filters is unreliable (no delivery guarantee) and allows excessive low-priority logs to flood the SIEM. Option D is not recommended because syslog transports text-based event messages, not raw PCAP files; PCAP export requires a different mechanism such as file transfer or eStreamer.

Practice this question →
56
MCQmedium

An administrator is configuring third-party SIEM integration using eStreamer. The external client application encounters a TLS handshake failure when attempting to connect to the FMC eStreamer port. What is the standard troubleshooting step to resolve certificate validation issues between an external eStreamer client and the FMC?

A.Disable SSL/TLS verification in the FMC Platform Settings under the eStreamer daemon parameters.
B.Restart the Snort inspection engine on all managed FTD devices.
C.Generate a new pkcs12 client certificate bundle from the FMC eStreamer configuration menu and import it into the client application store.
D.Change the eStreamer listening port from 8302 to 443 in the FMC System Preferences.
AnswerC

The eStreamer client must present a certificate the FMC trusts. Regenerating the pkcs12 bundle from the FMC eStreamer configuration menu and importing it into the client's certificate store restores mutual TLS validation, resolving the handshake failure caused by a mismatched or expired client certificate.

Why this answer

When setting up an external eStreamer client, the administrator must generate a PKCS#12 (.pfx or .pem) client certificate bundle and copy the corresponding CA certificate to the client host so that mutual TLS authentication succeeds.

Practice this question →
57
Multi-Selecthard

An enterprise integrates Cisco Secure Firewall Threat Defense with Cisco ISE via pxGrid. The security team notices that user identity mapping is intermittent for wireless clients roaming across different access points. Which TWO factors should be verified to ensure robust identity continuity during wireless roaming? (Choose two)

Select 2 answers
A.Disable the Snort engine during wireless handover events.
B.Ensure that ISE session updates and RADIUS accounting interim updates are properly configured on the wireless controllers.
C.Verify that pxGrid session publishing is active and subscriptions are maintained without disconnects.
D.Ensure the FTD is configured as an SXP speaker for wireless SSIDs.
E.Configure static ARP entries for all wireless client MAC addresses on the FTD.
AnswersB, C

RADIUS accounting interim updates and ISE session updates refresh the client's current network location as it roams between access points. Without timely interim accounting, ISE retains stale session data, so pxGrid publishes outdated mappings and identity continuity breaks during roaming.

Why this answer

Option B is correct because robust identity continuity during wireless roaming depends on ISE receiving timely session updates; RADIUS accounting interim updates (RFC 2869 Acct-Interim-Interval) from the wireless controllers keep ISE's session directory current as clients move between access points, so pxGrid can publish accurate user-to-IP mappings. Option C is correct because the FTD consumes identity data from ISE over pxGrid, so the pxGrid session directory must be actively publishing sessions and the FTD's subscriptions must remain established without disconnects; if the pxGrid connection drops or subscriptions lapse, identity mappings become intermittent. Option A is wrong because disabling the Snort engine would impair threat inspection and has no bearing on identity mapping.

Option D is wrong because SXP is a separate IP-to-user mapping propagation protocol and is not required for pxGrid-based ISE-to-FTD identity integration. Option E is wrong because static ARP entries do not provide user identity information and would not resolve intermittent identity mapping.

Practice this question →
58
Multi-Selecteasy

Which TWO protocols or mechanisms are used to integrate Cisco Identity Services Engine (ISE) with Cisco Secure Firewall Threat Defense? (Choose two)

Select 2 answers
A.NetFlow v5
B.SXP
C.pxGrid
D.LDAP direct bind
E.SNMPv1
AnswersB, C

SXP (SGT Exchange Protocol) carries Security Group Tags from Cisco Identity Services Engine to Cisco Secure Firewall Threat Defense, enabling identity-based policy enforcement where the firewall cannot query ISE directly. This satisfies the stem's requirement for a supported ISE-to-Threat Defense integration mechanism.

Why this answer

Cisco ISE integrates with Secure Firewall using pxGrid (for identity/context sharing) and SXP (for SGT tag and IP mapping propagation).

Practice this question →
59
MCQeasy

When integrating Cisco Secure Firewall with Cisco SecureX, which component acts as the local orchestrator and liaison that relays threat intelligence and response actions between the managed FTD devices and the SecureX cloud?

A.Cisco Secure Firewall Management Center (FMC)
B.The Snort inspection engine running on each FTD
C.The Cisco Defense Orchestrator (CDO) local proxy
D.Cisco Identity Services Engine (ISE)
AnswerA

Cisco Secure Firewall Management Center (FMC) is the local orchestrator that registers with the SecureX cloud, receives threat intelligence, and relays it to managed FTD devices. It also forwards response actions back to SecureX, satisfying the stem's requirement for a liaison between on-premises FTDs and the cloud.

Why this answer

The Cisco Secure Firewall Management Center (FMC) acts as the central management point and cloud connector for SecureX integrations across all managed FTD sensors.

Practice this question →
60
MCQeasy

An administrator is integrating Cisco Secure Firewall Threat Defense with Cisco Identity Services Engine (ISE) using Platform Exchange Services (pxGrid). Which service must be enabled and running on the ISE nodes for pxGrid communication to succeed?

A.IPAM Synchronization Service
B.RADIUS Accounting Service
C.Cisco pxGrid Service
D.TACACS+ Authentication Service
AnswerC

The Cisco pxGrid Service on ISE provides the publish-subscribe framework that FMC uses to receive session, identity and endpoint context. Enabling it on the ISE nodes lets the FTD subscribe to identity topics, satisfying the pxGrid communication requirement in the stem.

Why this answer

pxGrid must be enabled on the designated ISE nodes so that Cisco Secure Firewall Threat Defense can subscribe to user identity and session updates.

Practice this question →
61
Multi-Selecthard

An administrator is configuring Cisco SecureX threat intelligence integration with Cisco Secure Firewall Threat Defense via the FMC. Which TWO actions can be performed directly through the SecureX integration? (Choose two)

Select 2 answers
A.Real-time firmware updates pushed from the SecureX cloud console to the managed firewalls.
B.Replacement of local FMC policy administration with cloud-only RBAC management.
C.Automatic synchronization of dynamic Indicators of Compromise (IoCs) to block malicious traffic.
D.Investigation pivoting in Cisco Threat Response based on observables found in firewall connection events.
E.Direct deployment of Snort 3 custom intrusion rules compiled locally on the SecureX cloud platform.
AnswersC, D

The integration automatically synchronises dynamic IoCs from SecureX threat intelligence into FMC, where they populate block lists applied to Threat Defense policies. This satisfies the scenario's need to block malicious traffic without manual indicator entry.

Why this answer

SecureX integration allows sharing indicators of compromise (IoCs) for automated blocking/alerting and pivoting to Threat Response for investigation.

Practice this question →
62
MCQhard

An engineer is troubleshooting an integration between Cisco Secure Firewall Management Center and Cisco Identity Services Engine (ISE) using pxGrid. The FMC shows the pxGrid connection as 'Connected', but user identity information is not being populated in the FMC. Which action should the engineer take first to resolve the issue?

A.Verify that the FTD devices are registered with ISE.
B.Verify that the FMC is subscribed to the correct pxGrid topics in ISE.
C.Check the FMC's certificate expiration date.
D.Restart the pxGrid service on ISE.
AnswerB

For the FMC to receive user identity information, it must be subscribed to the appropriate pxGrid topics, such as the session directory. Even if the connection is 'Connected', without the correct subscriptions, the FMC will not receive identity data. Checking subscriptions is the first logical step.

Why this answer

When the pxGrid connection is 'Connected' but identity data is not populated, the most likely cause is that the FMC is not subscribed to the necessary pxGrid topics in ISE. The FMC must subscribe to topics like session directory to receive user identity updates. Verifying subscriptions is the correct first troubleshooting step.

Exam trap

The trap here is assuming that a 'Connected' status means everything is working, when actually subscriptions must also be configured for data to flow.

Practice this question →
63
MCQeasy

Which protocol is natively used by Cisco Secure Firewall Management Center to stream connection and intrusion events to external SIEM systems in real time?

A.HTTP SOAP
B.TFTP
C.NetFlow v9
D.eStreamer
AnswerD

eStreamer is Cisco's native, binary event-streaming protocol; the Management Center pushes connection, intrusion and malware events to a client on the SIEM host in real time, satisfying the low-latency requirement. Unlike syslog, it carries structured records and supports event types syslog cannot, making it the purpose-built mechanism here.

Why this answer

eStreamer is Cisco's proprietary protocol and API used for streaming security events from FMC to SIEMs.

Practice this question →
64
MCQeasy

Which type of events can be exported from Cisco Secure Firewall Management Center to a SIEM using the eStreamer protocol?

A.FMC administrator login CLI keystrokes only
B.Raw packet captures (PCAP) of every inspected flow
C.Routing table updates from OSPF and BGP protocols
D.Connection, intrusion, and malware/file events
AnswerD

eStreamer exports connection, intrusion, and malware/file events, giving the SIEM the full correlation set. It does not carry the other event categories, so this trio is precisely what the protocol forwards to satisfy the integration requirement.

Why this answer

eStreamer supports exporting connection events, intrusion events, malware events, and host/identity data from the FMC database.

Practice this question →
65
MCQhard

A security engineer is integrating Cisco Secure Firewall with a third-party SIEM using eStreamer. The SIEM vendor's connector documentation requires the eStreamer event types to be parsed correctly. Which file format or protocol encoding does eStreamer use to transmit event records over TCP port 8305?

A.JSON over HTTPS REST API
B.XML-formatted SOAP messages
C.Syslog-formatted plain text over TLS
D.Compressed binary-encoded records over a custom TCP session
AnswerD

eStreamer transmits events as compressed binary-encoded records over a proprietary TCP session on port 8305, not as syslog, JSON or plain text. The SIEM connector must decode this binary format to parse event types correctly.

Why this answer

eStreamer transmits serialized binary event records over a secured TCP connection.

Practice this question →
66
MCQhard

An engineer is troubleshooting a Cisco ISE and Secure Firewall pxGrid integration. The administrator notices that user group memberships are not populating correctly on the FTD, even though IP-to-user mappings are visible. What is the most likely reason user group information is missing?

A.ISE is not configured to include user group attributes in pxGrid publication feeds, or the FMC requires direct LDAP/AD integration to resolve user group hierarchies.
B.The FMC eStreamer service is blocking group attribute propagation.
C.User groups can only be resolved via RADIUS accounting attributes, making pxGrid fundamentally incompatible with user group filtering.
D.The FTD Snort engine must be configured with a local flat file containing all user group names.
AnswerA

pxGrid publishes user-to-IP mappings, but group hierarchy resolution depends on ISE including group attributes in its feeds or FMC querying LDAP/AD directly. Without that, group memberships stay empty even though IP-to-user mappings appear, matching the stem's symptom.

Why this answer

While pxGrid shares IP-to-user mappings, user group attribute resolution often relies on Active Directory integration or LDAP directory configurations mapped within ISE or synchronized via Active Directory Agent / ISE Active Directory attribute retrieval. If ISE is not configured to publish user group attributes over pxGrid or if the FMC lacks AD LDAP integration to resolve the groups, group-based rules will fail.

Practice this question →
67
MCQeasy

Which menu path in the Cisco Secure Firewall Management Center (FMC) is used to configure the connection to Cisco Threat Response or Cisco SecureX?

A.System > Integration > SecureX
B.Devices > Device Management > Threat Intelligence
C.Objects > Object Management > Cloud Services
D.Policies > Access Control > Security Intelligence
AnswerA

System > Integration > SecureX is the correct path because FMC centralises cloud-service connectors under System > Integration, where the SecureX/Threat Response client registration, Cisco SecureX sign-on and device enrolment are configured. This satisfies the stem's requirement for the menu used to establish the Cisco SecureX or Threat Response connection.

Why this answer

Integration with Cisco SecureX (Threat Response) is configured under System > Integration on the FMC interface.

Practice this question →
68
MCQeasy

An administrator wants to stream security events, connection events, and intrusion events from Cisco Secure Firewall Management Center (FMC) to a third-party SIEM platform. Which built-in protocol and feature on the FMC should be configured to export these events in real-time?

A.pxGrid
B.NETCONF
C.eStreamer
D.RADIUS Accounting
AnswerC

eStreamer is FMC's native event-streaming API, delivering security, connection and intrusion events to third-party SIEM clients in real time over a persistent TLS connection. It satisfies the stem's requirement for a built-in FMC protocol exporting these event types, unlike syslog, which lacks structured intrusion event fields.

Why this answer

eStreamer is the FMC's built-in event streaming service that pushes intrusion, connection, security, and malware events to external clients (such as third-party SIEMs) in real time over a proprietary TCP-based protocol on port 8302. It is purpose-built for high-volume event export from the FMC and is the documented integration path for SIEM platforms like Splunk, QRadar, and ArcSight.

Exam trap

The trap here is confusing Cisco's identity/context-sharing protocols (pxGrid, SXP) with the FMC's dedicated event-export mechanism, causing candidates to pick pxGrid because it 'sounds like the integration protocol.'

How to eliminate wrong answers

Option A is wrong because pxGrid is Cisco's identity/context-sharing fabric used for ISE-to-FMC user identity and SGT exchange, not for streaming FMC event data to a SIEM. Option B is wrong because NETCONF is a configuration-management protocol (RFC 6241) used to programmatically configure devices, not to export security telemetry. Option D is wrong because RADIUS Accounting carries session start/stop and byte-count records for AAA, not firewall event streams.

Practice this question →
69
MCQhard

An enterprise integrates Cisco Secure Firewall Management Center with Cisco ISE using pxGrid for identity-based access control. The security team notices that user identity mapping works for domain users authenticating via 802.1X, but guest users connecting through a WebAuth portal do not have their user-to-IP mappings populated on the FTD. What is the root cause of this issue?

A.FMC requires an active eStreamer connection to ingest guest identities because pxGrid only supports Active Directory domain accounts.
B.Guest users must manually log into a captive portal hosted on the FTD data plane before ISE can share their identity.
C.The FTD identity policy must be configured with a RADIUS server group instead of pxGrid to support guest VLANs.
D.The pxGrid connection on ISE is not subscribed to the guest session topic, or guest session publishing is disabled in ISE deployment settings.
AnswerD

pxGrid delivers identity mappings only for topics the FMC subscribes to. Guest WebAuth sessions publish on a separate guest session topic; without that subscription or with guest publishing disabled in ISE, guest user-to-IP mappings never reach FTD.

Why this answer

Guest users authenticated via WebAuth on ISE may not have active pxGrid session directory notifications if the guest profile or ISE profiler service is not configured to publish guest sessions, or if the pxGrid node is not subscribed to guest session topics (such as 'Session Directory' guest events).

Practice this question →
70
MCQmedium

A security team wants Cisco Secure Firewall Threat Defense to block traffic to domains that appear on a third-party threat feed before users connect. The feed is published as a plain-text list of malicious domains over HTTPS and changes frequently. Which integration method should be used to populate a DNS Block List on the Firewall Management Center?

A.Configure an External Block List with a URL source type pointing to the threat feed and assign it to a DNS policy.
B.Import the feed as a Network object group and apply it to an access control rule with a Block action.
C.Create a File Blocking policy that references the threat feed's object group and deploy it to the Threat Defense devices.
D.Enable Security Intelligence feeds and subscribe to the Cisco Talos domain reputation feed only.
AnswerA

External Block List supports a URL source type, where FMC periodically retrieves the plain-text list and populates the DNS block list without manual updates. Assigning the object to a DNS policy causes Threat Defense to block DNS queries for those domains, satisfying the requirement to block before users connect. This is the purpose-built integration for dynamic feed consumption.

Why this answer

The External Block List feature in FMC was designed to consume dynamic, externally hosted lists, including plain-text domain lists retrieved over HTTPS on a schedule. Because the list is bound to a DNS policy, the Threat Defense device can block resolution of the listed domains before any connection is attempted, which is exactly what the team needs for a frequently changing third-party feed without manual object updates.

Exam trap

The trap here is assuming any object type can import a domain list, when only the External Block List URL source mechanism is built to pull a plain-text domain feed automatically.

Practice this question →
71
Multi-Selecthard

An administrator is setting up Cisco ISE pxGrid integration with Cisco Secure Firewall Management Center. Which TWO configuration steps must be performed on the Cisco ISE side to ensure successful integration? (Choose two)

Select 2 answers
A.Configure an eStreamer server instance on the ISE policy service node.
B.Enable SNMPv2c traps on the ISE administration node.
C.Export the ISE TACACS+ shared secret to the FTD CLI.
D.Approve the FMC client registration request in the Cisco ISE pxGrid client management settings.
E.Enable the pxGrid service on the designated Cisco ISE node personas.
AnswersD, E

pxGrid requires explicit client approval: the FMC's registration request must be approved in Cisco ISE's pxGrid client management before the connection is trusted. Approving it satisfies the requirement to complete the necessary Cisco ISE-side configuration step for successful integration.

Why this answer

Option D is correct because pxGrid uses mutual certificate-based authentication, and when FMC first connects as a pxGrid client, its registration request must be approved by an ISE administrator under Administration > pxGrid Services > Client Management before the client can subscribe to or publish on the pxGrid bus. Option E is correct because the pxGrid persona is not enabled by default; the administrator must enable the pxGrid service on the appropriate ISE node (typically the PAN/MnT or a dedicated pxGrid node) under Administration > System > Deployment so the node can host the pxGrid controller and accept client connections. Option A is wrong because eStreamer is a Firepower/FSMC-side event-streaming service, not an ISE policy service node component.

Option B is wrong because SNMPv2c traps are for monitoring/alerting and play no role in pxGrid integration. Option C is wrong because TACACS+ shared secrets are for device administration authentication, not for pxGrid, which relies on certificates rather than a shared secret.

Practice this question →
72
MCQhard

An engineer is troubleshooting a mutual TLS connection failure between Cisco ISE pxGrid and the FMC. The openssl command on the FMC reveals a 'certificate verify failed' error. What is the underlying reason for this error?

A.The NTP clock skew between FMC and ISE exceeds 60 seconds, causing token expiration.
B.The pxGrid shared secret key contains unsupported special characters.
C.The peer certificate has been signed by a Certificate Authority whose root certificate is missing from the local trust store.
D.TCP port 8910 is blocked by an intermediate stateful firewall.
AnswerC

Mutual TLS requires each side to validate the peer's certificate chain up to a trusted root. The 'certificate verify failed' error means the FMC cannot build that chain because the issuing Certificate Authority's root certificate is absent from its local trust store, so validation aborts.

Why this answer

A 'certificate verify failed' error indicates that the client or server certificate was signed by a CA that is not present in the truststore of the peer verifying it.

Practice this question →
73
MCQeasy

When configuring syslog export from Cisco Secure Firewall Threat Defense using Firepower Management Center, which alert format should you choose to ensure standard SIEM ingestion parsers can easily read the event headers?

A.IETF (RFC 5424) format
B.SNMP v2c Trap format
C.Legacy ASA native text format
D.NetFlow v9 structured records
AnswerA

RFC 5424 defines a structured syslog header with version, timestamp, hostname, app-name, and structured-data fields. Choosing the IETF format gives Firepower Management Center events that standard SIEM parsers recognise natively, satisfying the requirement for easy header ingestion without custom parsing.

Why this answer

Syslog messages exported from Secure Firewall Threat Defense can be formatted using BSD (RFC 3164) or IETF (RFC 5424) formats. RFC 5424 is the standard IETF structured format widely supported by modern SIEMs.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Integration questions.

Start 20-question session