Knowledge + Practice

CCNA Management And Troubleshooting Questions

60 questions · Management And Troubleshooting topic · All types, answers revealed

Practice these questions Exam hub All questions

1

MCQmedium

An administrator needs to determine if the FMC has enough disk space to hold a new software upgrade image. Which menu should they check?

A.Devices > Device Management > System

B.Policies > Settings

C.System > Health > Monitor

D.System > Configuration > Disk

E.System > Updates > Disk Space

AnswerC

System > Health > Monitor displays disk usage and other appliance health metrics, letting the administrator confirm whether sufficient free space exists for the upgrade image. This is the FMC location exposing storage consumption before initiating the software update.

Why this answer

FMC displays disk space and other appliance health metrics under System > Health > Monitor, where the administrator can view disk utilization for the FMC and managed devices. This is the correct menu to confirm whether enough disk space exists for a new software upgrade image.

Exam trap

The trap is looking for a dedicated 'Disk' menu under System or Updates; SNCF tests that disk space is monitored through System > Health > Monitor, not a configuration menu.

How to eliminate wrong answers

Option A is wrong because Devices > Device Management > System shows device-level system settings, not FMC disk space metrics. Option B is wrong because Policies > Settings contains policy configuration options, not health or disk monitoring. Option D is wrong because System > Configuration > Disk is not a valid FMC menu path.

Option E is wrong because System > Updates > Disk Space is not a real FMC menu; updates are handled under System > Updates but disk space is viewed via Health Monitor.

Practice this question →

2

MCQmedium

An engineer has modified several access control rules and object groups on the FMC. Before deploying these changes to the FTD, the engineer wants to review all pending changes to ensure no unauthorized modifications are included. Where in the FMC GUI should the engineer go to view pending deployment changes?

A.Objects > Object Management > Diff Viewer

B.Analysis > Audit > Pending

C.System > Updates > Pending Changes

D.Deploy > Deployment (or clicking the Deploy icon in the top header)

AnswerD

The Deploy menu's Deployment page lists all pending policy and object changes staged on the FMC before they are pushed to managed FTD devices. Reviewing it lets the engineer audit unauthorised modifications prior to deployment, matching the requirement to inspect pending changes.

Why this answer

To view pending deployment changes, the engineer should go to Deploy > Deployment (or click the Deploy icon in the top header). This shows a list of all pending changes across policies and objects, allowing review before deployment.

Exam trap

The trap is looking for a dedicated 'pending changes' menu under Analysis or System; the correct location is the Deploy menu, which is often overlooked.

How to eliminate wrong answers

Option A is wrong because Objects > Object Management > Diff Viewer does not exist; there is no such menu. Option B is wrong because Analysis > Audit > Pending is not a valid path; audit logs are under Analysis > Audit but not for pending changes. Option C is wrong because System > Updates > Pending Changes is not a valid path; system updates are for software updates, not configuration changes.

Practice this question →

3

MCQmedium

An administrator needs to restore an FMC configuration backup onto a replacement hardware appliance. Which of the following conditions must be met for the backup restoration to succeed successfully?

A.Smart Licensing must be disabled on the target appliance prior to importing the backup.

B.The target FMC must be running a newer major software version than the backup file.

C.The target appliance hardware model must be different to allow schema remapping.

D.The target FMC must run the exact same software version and patch level as the source appliance.

AnswerD

FMC configuration backups are version-specific: the restore process validates the backup against the appliance's software build, and mismatched versions or patch levels cause restoration to fail or corrupt the configuration database. Matching the source's exact version and patch level is therefore a mandatory precondition.

Why this answer

FMC backup restoration requires that the target appliance run the exact same software version and patch level as the source appliance that produced the backup. The backup archive contains version-specific database schemas and configuration structures, so a mismatch in version or patch level will cause the restore to fail or produce an inconsistent configuration. Cisco documentation explicitly states this as a prerequisite for successful restoration.

Exam trap

The trap is assuming that a newer version can restore an older backup due to backward compatibility — candidates pick 'newer major version' thinking upgrades are safe, but FMC requires an exact version and patch-level match.

How to eliminate wrong answers

Option A is wrong because Smart Licensing does not need to be disabled before restoring a backup — licensing is re-established after restore and is not a blocking condition. Option B is wrong because running a newer major version on the target does not satisfy the requirement; the versions must match exactly, not merely be newer. Option C is wrong because the hardware model does not need to be different — in fact, restoring to the same or compatible model is typical, and differing models do not enable schema remapping.

Practice this question →

4

Multi-Selectmedium

An administrator is troubleshooting a high availability (HA) failover link failure between two FTD physical appliances. Which THREE checks should be performed to diagnose physical and logical connectivity between the failover interfaces? (Choose three)

Select 3 answers

A.Verify physical link lights (LEDs) and cable integrity on the dedicated failover interfaces.

B.Run the 'show failover' command on the FTD diagnostic CLI to inspect mate status and interface monitoring states.

C.Check interface IP configuration and ensure ping reachability across the dedicated failover subnet if layer 3 failover is used.

D.Change the FTD management IP address on both units.

E.Reboot the FMC to restart failover polling.

AnswersA, B, C

Physical link lights and cable integrity confirm the layer 1 path on the dedicated failover interfaces. A failed LED or damaged cable breaks the failover link regardless of configuration, so this check isolates physical faults before investigating logical causes.

Why this answer

Option A is correct because verifying physical link lights (LEDs) and cable integrity on the dedicated failover interfaces is the first step to confirm Layer 1 connectivity, since a failed or unplugged cable or dead interface will prevent any failover communication. Option B is correct because the 'show failover' command on the FTD diagnostic CLI reports mate status, failover link state, and interface monitoring states, directly revealing whether the failover link is up or down and whether the peer is reachable. Option C is correct because if Layer 3 failover is used, the dedicated failover interfaces must have valid IP addresses in the same subnet and be ping-reachable; checking IP configuration and ping reachability validates logical connectivity across that subnet.

Option D is not relevant because changing the management IP address does not diagnose or repair the dedicated failover link and could disrupt management access. Option E is not relevant because rebooting the FMC does not restart failover polling between FTD appliances; failover is handled by the FTD data plane, not the management center.

Exam trap

The trap is selecting actions that are not directly related to the failover link, such as changing management IPs or rebooting the FMC; candidates must focus on the specific components of the failover link.

Practice this question →

5

Multi-Selectmedium

When troubleshooting a connectivity issue where traffic is being dropped, which TWO of the following logs or tools should be reviewed first to determine the cause?

Select 2 answers

A.Connection Events

B.System Access Log

C.Packet Tracer

D.File Policy Report

E.Hardware Inventory

AnswersA, C

Connection Events in the FMC analyse view record each flow's allow or block decision, the matching access control rule and the drop reason, directly revealing why traffic was denied. This satisfies the stem's need to identify the cause of drops.

Why this answer

Connection Events (A) should be reviewed first because they record per-flow details such as source/destination, ingress/egress interfaces, matched access-control rule, and the specific drop reason (e.g., deny by ACL, no matching rule, or security-intelligence block), directly revealing why traffic was dropped. Packet Tracer (C) is also correct because it simulates a specific packet against the configured policies and shows the exact point in the policy chain where it is allowed or dropped, making it ideal for pinpointing the cause of a connectivity failure. The System Access Log (B) only records administrative login/authentication activity, not traffic-forwarding decisions, so it cannot explain dropped packets.

The File Policy Report (D) covers file-type detection and malware/blocking actions on files, which is unrelated to general connectivity drops. Hardware Inventory (E) merely lists device components and serial numbers and provides no insight into traffic handling.

Exam trap

The trap is selecting tools that sound related to logging but do not provide traffic drop analysis; candidates may pick 'System Access Log' thinking it logs all access, but it only covers administrative access.

Practice this question →

6

MCQhard

An administrator notices that the FMC Health Monitor shows a 'Critical' alert for the Snort process utilization on an FTD device. What is the most appropriate first-line troubleshooting step from the FMC GUI or FTD CLI to investigate the cause of high Snort CPU usage?

A.Restart the database process via 'pmtool restartbyname mysqld'.

B.Change the Access Control policy action from 'Inspect' to 'Block' globally without logging.

C.Check the Snort performance statistics and rule update status via Devices > Device Management > Advanced > Snort Statistics.

D.Delete all custom intrusion rules immediately to clear the buffer.

AnswerC

Snort Statistics under Device Management exposes per-instance CPU, packet and rule metrics plus rule update status, letting the administrator pinpoint whether high utilisation stems from rule load or traffic. This satisfies the first-line investigation requirement without disrupting traffic.

Why this answer

The most appropriate first-line troubleshooting step is to check Snort performance statistics and rule update status via Devices > Device Management > Advanced > Snort Statistics in the FMC GUI. This provides visibility into Snort's CPU usage, packet processing rates, and rule-related metrics that can reveal whether the issue stems from rule complexity, traffic volume, or a recent rule update. It is a non-disruptive diagnostic step that gathers data before any remediation.

Exam trap

The trap is that candidates jump to disruptive remediation like restarting processes or deleting rules, when the correct first step is always to gather diagnostic data via the Snort Statistics page before making changes.

How to eliminate wrong answers

Option A is wrong because restarting the MySQL database process via 'pmtool restartbyname mysqld' addresses database issues, not Snort CPU utilization, and could disrupt FMC operations. Option B is wrong because globally changing the Access Control policy action from 'Inspect' to 'Block' without logging is a drastic, disruptive change that would disable inspection and is not a troubleshooting step. Option D is wrong because deleting all custom intrusion rules immediately is a destructive action that would remove detection capability and is not a first-line diagnostic measure.

Practice this question →

7

MCQmedium

An engineer deploys an Access Control Policy change from the FMC to a managed FTD device. The task hangs in the Deployment History with a status of 'Applying' for an extended period. Upon checking the FTD CLI, the engineer notices a locked deployment file or stuck process. What action should be taken to clear or restart the deployment process safely?

A.Cancel the task in the FMC Task Manager (System > Task Monitor), verify deployment locks, and re-attempt the deployment after clearing pending changes.

B.Power cycle the physical FTD chassis immediately using the hardware power switch.

C.Delete the Access Control Policy and recreate it with a new name.

D.Run 'reload factory-default' from the FTD CLI to reset the management plane.

AnswerA

Cancelling the stuck task in FMC Task Monitor releases the deployment lock held on the FTD, allowing the pending configuration to be cleared and redeployed cleanly. This directly addresses the locked deployment file and hung 'Applying' state described in the stem.

Why this answer

When a deployment task hangs in 'Applying' state with a locked deployment file or stuck process on the FTD, the safe remediation is to cancel the task from the FMC Task Monitor (System > Task Monitor), verify no deployment locks remain, and then re-attempt the deployment after clearing pending changes. This avoids disrupting traffic or corrupting the configuration database. The FMC-to-FTD deployment is transactional; cancelling cleanly releases the lock so a fresh deployment can proceed.

Exam trap

The trap here is that candidates reach for drastic CLI resets or hardware reboots when the correct, non-disruptive fix is to cancel the task in the FMC Task Monitor and retry after clearing locks.

How to eliminate wrong answers

Option B is wrong because power cycling the chassis is a disruptive action that can corrupt the configuration database and does not address the root cause of the stuck deployment lock. Option C is wrong because deleting and recreating the Access Control Policy does not clear the deployment lock and would lose policy references and object bindings. Option D is wrong because 'reload factory-default' wipes the entire FTD configuration and management plane, which is a catastrophic overreaction to a stuck deployment task.

Practice this question →

8

MCQhard

An administrator needs to troubleshoot an issue where legitimate traffic is being silently dropped by the FTD device. The standard packet trace does not reveal the exact reason. Which command executed on the FTD CLI is best suited to diagnose accelerated security path (ASP) drops in real time?

A.capture capin interface outside match ip any any

B.capture drop type asp-drop all

C.system support firewall-engine-debug

D.debug crypto ipsec

AnswerB

ASP drops occur in the accelerated security path and are invisible to standard packet traces. The capture drop type asp-drop all command captures packets dropped by the ASP in real time, exposing the exact drop reason, which satisfies the stem's need to diagnose silent drops.

Why this answer

The command 'capture drop type asp-drop all' is specifically designed to capture packets dropped by the Accelerated Security Path (ASP) on Cisco FTD devices. It provides real-time visibility into drops that occur in the ASP, which are not always visible through standard packet traces. This makes it the best tool for diagnosing silent drops caused by ASP-level issues.

Exam trap

300-710 SNCF often tests the specific command for ASP drop capture versus general packet capture or debug commands — candidates may choose a broad capture or debug command that does not target ASP drops.

How to eliminate wrong answers

Option A is wrong because 'capture capin interface outside match ip any any' is a general interface capture that shows traffic on the outside interface but does not specifically identify ASP drops or the reason for them. Option C is wrong because 'system support firewall-engine-debug' is a debug command for the firewall engine that can be intrusive and is not specifically focused on ASP drop diagnostics in real time. Option D is wrong because 'debug crypto ipsec' is used for troubleshooting IPsec VPN negotiations and encrypted traffic, not for diagnosing ASP drops of legitimate traffic.

Practice this question →

9

MCQmedium

An engineer needs to analyze the connection history and security events from an FTD device that occurred three weeks ago. However, when querying the FMC event viewer, the events are missing. What is the most likely cause of this behavior?

A.The administrator must run 'database-cli optimize' on the FTD CLI to unhide historical events.

B.The FTD automatically flushes its local event buffer every 48 hours regardless of FMC configuration.

C.Security events older than 7 days are automatically archived to the Cisco Cloud Analytics platform by default.

D.The events were overwritten because the event database retention period or disk space limit was reached.

AnswerD

The FMC event database has a finite retention period and disk allocation; once either limit is reached, older events are purged. Three-week-old FTD connection and security events were therefore overwritten, explaining their absence from the event viewer.

Why this answer

FMC event databases have configurable retention policies and disk space thresholds. If event retention settings are low or disk space fills up, older events are automatically purged to prevent disk exhaustion.

Practice this question →

10

Multi-Selectmedium

An administrator needs to monitor the real-time health and status of managed devices from the FMC dashboard. Which TWO dashboard widgets or features are available in FMC to assist with device monitoring? (Choose two)

Select 2 answers

A.Health Status widget

B.Real-time Packet Replay widget

C.Firewall Cluster Load Balancing Graph widget

D.Active BGP Neighbor Matrix widget

E.Device Status widget

AnswersA, E

The Health Status widget on the FMC dashboard displays real-time health and status metrics for managed devices, satisfying the requirement to monitor device health. It aggregates appliance-level indicators such as CPU, memory and disk usage.

Why this answer

The Health Status widget (A) is a standard FMC dashboard widget that displays real-time health metrics for managed devices, including CPU, memory, disk usage, and interface status, making it directly relevant to monitoring device health. The Device Status widget (E) is also an FMC dashboard widget that shows the current up/down status and connectivity of managed devices, which is exactly what the administrator needs for real-time status monitoring. The Real-time Packet Replay widget (B) does not exist in FMC; packet capture and replay are handled through troubleshooting tools, not dashboard widgets.

The Firewall Cluster Load Balancing Graph widget (C) is not an FMC dashboard feature; FMC provides cluster status via device health monitors, not a dedicated load-balancing graph widget. The Active BGP Neighbor Matrix widget (D) is not an FMC dashboard widget; BGP neighbor status is viewed through device-specific routing tables or CLI, not a dashboard matrix.

Exam trap

The trap is selecting plausible-sounding but non-existent widgets; only the documented FMC dashboard widgets (Health Status, Device Status, etc.) are valid.

Practice this question →

11

MCQhard

An engineer is troubleshooting an FTD device that is not sending events to the FMC. The engineer suspects that the connection between the FTD and FMC is down. Which CLI command on the FTD should the engineer use to verify the status of the management connection to the FMC?

A.show running-config

B.show events

C.show interface

D.show managers

AnswerD

The 'show managers' command on the FTD CLI displays the status of the management connection to the FMC, including whether the FTD is registered and the last communication time. It is the primary command to verify connectivity and management status.

Why this answer

The 'show managers' command is specifically designed to display the status of the FTD's management connection to FMC, including registration state and last heartbeat. It is the quickest way to verify if the FTD is successfully communicating with the FMC.

Exam trap

The trap here is using 'show running-config' to check manager status; it shows configuration but not live connectivity, which is what 'show managers' provides.

Practice this question →

12

MCQhard

An engineer is comparing configuration states between FMC and a managed FTD after several changes were made directly on the FTD CLI by a local technician. The engineer wants to confirm whether the device configuration currently running differs from what FMC last deployed, without pushing any new policy. Which FMC feature provides this comparison?

A.The FTD CLI command 'show configuration diff' executed from the diagnostic CLI, which outputs the delta against the FMC-deployed policy.

B.The 'Compare' option on the Device Management page, which shows the running configuration versus the last-deployed configuration for the managed device.

C.The 'show running-config' output captured automatically in the FMC audit log after each CLI session on the device.

D.The Health Monitor's 'Analysis' tab, which correlates configuration drift with performance anomalies on the device.

AnswerB

The Compare function on the FMC Device Management page retrieves the device's current running configuration and diffs it against the configuration FMC last deployed. This reveals out-of-band CLI changes without triggering a deployment, which is exactly what the engineer needs to detect drift caused by local edits.

Why this answer

FMC provides a Compare feature on the Device Management page that pulls the device's running configuration and diffs it against the last configuration FMC deployed. This lets administrators detect out-of-band CLI changes without deploying new policy, which is essential for identifying configuration drift.

Exam trap

The trap here is believing the FTD CLI itself can produce a diff against FMC-deployed policy, when reconciliation is performed from the manager side.

Practice this question →

13

MCQeasy

Which action must be taken on the FTD CLI after a manual configuration change is made, if you want to ensure the FMC does not overwrite it?

A.Manual changes should be avoided; perform all changes in FMC.

B.Set the device to 'Read-Only' mode.

C.Run 'fmc update lock'.

D.Run 'write memory' to lock the configuration.

E.Run 'commit configuration' to save the state.

AnswerA

The FMC is the authoritative management plane for managed FTD devices, so any CLI change made outside it is unsynchronised and can be overwritten at the next deployment. Performing all configuration in FMC therefore prevents that overwrite by keeping the device and manager consistent.

Why this answer

Manual changes on the FTD CLI should be avoided because the FMC is the central management platform and will overwrite any manual configuration changes during the next policy deployment. To ensure the FMC does not overwrite manual changes, the best practice is to perform all changes in FMC. There is no CLI command to lock manual changes from being overwritten.

Exam trap

The trap is thinking that a CLI command can lock manual changes from being overwritten by FMC. Candidates may believe that saving the configuration or using a lock command will prevent FMC from overwriting, but the correct approach is to avoid manual changes altogether.

How to eliminate wrong answers

Option B is wrong because there is no 'Read-Only' mode on FTD that prevents FMC from overwriting changes. Option C is wrong because 'fmc update lock' is not a valid command. Option D is wrong because 'write memory' saves the running configuration to startup, but it does not prevent FMC from overwriting it.

Option E is wrong because 'commit configuration' is not a valid command to lock changes; FTD uses a different configuration model.

Practice this question →

14

MCQeasy

Which license state must an FTD device reach to allow the FMC to push policy configurations to it?

A.Disabled

B.Unregistered

C.Waiting for registration

D.Registered and licensed

E.Standby mode only

AnswerD

Reaching Registered and licensed state is what permits the FMC to push policy configurations to the FTD. Registration alone establishes the management connection, but policy deployment additionally requires a valid licence entitlement, such as a Smart Licence reservation, to be applied. This satisfies the stem's requirement for the licence state enabling configuration pushes.

Why this answer

An FTD device must be in the 'Registered and licensed' state for the FMC to push policy configurations to it. Registration establishes the management connection, and licensing ensures that the device is entitled to the required features. Only when both conditions are met can policies be deployed.

Exam trap

The trap is assuming that registration alone is sufficient; candidates must remember that licensing is also required for policy deployment.

How to eliminate wrong answers

Option A is wrong because 'Disabled' means the device is not enabled for management or inspection. Option B is wrong because 'Unregistered' means the device has not completed registration with the FMC. Option C is wrong because 'Waiting for registration' indicates the device is in the process of registering but not yet fully registered.

Option E is wrong because 'Standby mode only' is not a valid license state; it may refer to HA standby, but licensing is still required.

Practice this question →

15

MCQmedium

An administrator needs to perform a full system backup of the FMC. Where is the most appropriate place to store this backup for long-term disaster recovery?

A.Local /var/log/backup partition

B.Remote server using SCP or SFTP

C.The FMC /tmp directory

D.Attached USB storage drive

E.The managed FTD flash memory

AnswerB

SCP or SFTP transfers the FMC backup archive to a separate remote host, so the image survives local disk failure, theft or site loss. Storing it on the FMC itself or an attached USB drive cannot satisfy the long-term disaster recovery requirement in the stem.

Why this answer

The FMC full system backup must be stored off-box for true disaster recovery. Cisco explicitly supports exporting the backup to a remote server via SCP or SFTP, which provides a durable, external location that survives FMC hardware failure, reimaging, or replacement. Because the backup contains the entire FMC configuration, database, and OS state, keeping it on a remote server ensures it can be restored to a new appliance or VM during a full-site disaster.

Exam trap

300-710 SNCF often tests the misconception that any local or attached storage is acceptable for disaster recovery, when the exam expects you to recognize that only an off-box remote server via SCP/SFTP satisfies long-term DR requirements.

How to eliminate wrong answers

Option A is wrong because the local /var/log/backup partition resides on the same FMC disk subsystem, so it is lost if the FMC fails, is reimaged, or is destroyed. Option C is wrong because /tmp is volatile temporary storage that is cleared on reboot and is not intended for persistent backup retention. Option D is wrong because an attached USB drive is not a supported or reliable long-term backup target for FMC full system backups and is physically tied to the appliance.

Option E is wrong because the managed FTD flash memory stores the FTD device's own configuration and software, not the FMC's full system backup, and it is not a valid FMC backup destination.

Practice this question →

16

MCQmedium

An administrator manages several FTD devices from a single FMC. After a policy deployment, a remote-site FTD shows 'Deployment Failed' in the FMC task list, and the administrator needs to identify which specific configuration object caused the failure without opening a TAC case. Which FMC workflow should the administrator use to review the detailed deployment failure reason for that device?

A.Open the FTD device's Health Monitor page and review the CPU and disk usage graphs captured during the deployment window.

B.Run the 'show managers' command on the FTD CLI and read the deployment error code returned in the registration status output.

C.Navigate to Policies > Access Control and click the Deploy icon on the individual access control policy to regenerate the failure report.

D.Open the FMC Task Status page, select the failed deployment task, and download the troubleshooting file (.tar.gz) generated for that deployment attempt.

AnswerD

The Task Status page retains each deployment task with a downloadable troubleshooting file that bundles the deployment logs, the configuration being pushed, and the error messages from the device. This is the standard FMC-native way to pinpoint which object failed on a specific managed device without console access or a TAC case.

Why this answer

Deployment failures on managed FTD devices are diagnosed through the FMC Task Status page, where each deployment task exposes a downloadable troubleshooting file containing the pushed configuration and the device's error output. This is the supported method for identifying the exact object that caused the failure without CLI access on the FTD.

Exam trap

The trap here is assuming the FTD CLI 'show managers' output includes deployment error details, when it only reports registration state and manager identity.

Practice this question →

17

MCQeasy

An administrator wants to check the status of all software processes running on an FMC appliance (such as the web server, database, and event handlers) to ensure everything is running smoothly. Which command should be run in the FMC CLI?

A.firepower-status -v

B.systemctl status all

C.show process manager

D.pmtool status

AnswerD

pmtool status queries the Process Manager, listing all software processes on the FMC appliance, including the web server, database and event handlers, with their running state. It directly satisfies the requirement to verify that every process is operating smoothly.

Why this answer

The 'pmtool status' command in the FMC CLI displays the status of all software processes managed by the Process Manager, including the web server, database, and event handlers. It is the correct command to verify that all FMC services are running properly.

Exam trap

300-710 SNCF often tests the misconception that standard Linux commands like systemctl work in the FMC CLI, when FMC uses its own pmtool for process management.

How to eliminate wrong answers

Option A is wrong because 'firepower-status -v' is not a valid FMC CLI command for checking process status. Option B is wrong because 'systemctl status all' is a Linux systemd command that is not exposed in the FMC CLI and would not show FMC-specific process states. Option C is wrong because 'show process manager' is not a valid FMC CLI command syntax; the correct tool is pmtool.

Practice this question →

18

Multi-Selecthard

An administrator is analyzing a troubleshooting scenario involving Snort inspection crashes on an FTD device. Which THREE locations or tools should the administrator check to diagnose why the Snort process restarted or crashed? (Choose three)

Select 3 answers

A.Check the Cisco Smart Software Manager portal for license expiration alerts.

B.Inspect the DHCP lease logs in /var/log/dhcpd.log.

C.Examine /var/log/messages and system log files for Out-Of-Memory (OOM) killer events targeting Snort.

D.Review Snort runtime error logs located in /var/log/snort/ or via FMC health alerts.

E.Check for core dump files generated in the crash directories using 'system support clean-core' or expert mode listing.

AnswersC, D, E

Examining /var/log/messages reveals kernel-level OOM killer events that terminate the Snort process when memory is exhausted, directly addressing the crash diagnosis. This log records the specific process killed and memory pressure at the time, confirming whether resource exhaustion, rather than a configuration fault, caused the restart.

Why this answer

Option C is correct because when the Snort process on an FTD is killed due to memory exhaustion, the Linux kernel OOM killer logs the event in /var/log/messages and other system logs, showing which process (snort) was terminated and why. Option D is correct because Snort-specific runtime errors, such as inspection engine failures or rule-related crashes, are written to the Snort logs under /var/log/snort/ and are also surfaced as health alerts in FMC, making them a primary diagnostic source. Option E is correct because when Snort crashes it can generate core dump files in the crash directories; these can be listed in expert mode or managed with the 'system support clean-core' command, and analyzing them (or their presence) helps confirm and diagnose the crash.

Option A is incorrect because Smart Software Manager license expiration would cause registration or entitlement issues, not a Snort process restart or crash. Option B is incorrect because DHCP lease logs in /var/log/dhcpd.log relate to address assignment and have no bearing on Snort inspection crashes.

Exam trap

The trap here is that candidates pick license or DHCP log options because they sound like plausible 'system' checks, but SNCF specifically tests knowledge of Snort crash forensics paths (OOM logs, /var/log/snort, core dumps).

Practice this question →

19

MCQeasy

An administrator needs to schedule automated weekly backups of the FMC configuration and store them securely on a remote SCP server. Where is remote backup storage configured in the FMC GUI?

A.Devices > Device Management > Backup

B.System > Integration > SCP Servers

C.System > Tools > Backup / Restore > Remote Storage

D.Objects > Object Management > Servers > Backup

AnswerC

Remote SCP backup destinations are defined under System > Tools > Backup / Restore, where the Remote Storage tab holds server address, path and credentials. This satisfies the requirement to schedule automated weekly backups stored securely off-box.

Why this answer

Remote backup storage for FMC is configured under System > Tools > Backup / Restore > Remote Storage. This is where you specify the SCP server details for storing backups remotely.

Exam trap

The trap is confusing device backup with FMC system backup, or looking under Objects or Devices instead of System > Tools.

How to eliminate wrong answers

Option A is wrong because Devices > Device Management > Backup is for device backups, not FMC system backups. Option B is wrong because System > Integration > SCP Servers is not a valid path for backup configuration. Option D is wrong because Objects > Object Management > Servers > Backup is for defining server objects, not for configuring backup storage.

Practice this question →

20

MCQeasy

During a routine backup of the FMC, the administrator wants to ensure that the generated backup file contains critical historical events, configurations, and intrusion event data so that it can be fully restored to a replacement appliance if necessary. Which backup type should be selected in the FMC?

A.Manual Backup with both System Settings and Historical Event Data checkboxes enabled

B.RAID Controller Configuration Export

C.System Configuration Backup only

D.Snort Rule Update (SRU) Snapshot Backup

AnswerA

Selecting Manual Backup with both System Settings and Historical Event Data captures configurations plus historical events and intrusion data, satisfying the requirement for a fully restorable replacement appliance. The Historical Event Data checkbox is the specific element that includes event records; System Settings alone would omit them.

Why this answer

In FMC, a Manual Backup allows you to select both 'System Settings' and 'Historical Event Data' checkboxes. Enabling both ensures that the backup includes configurations, intrusion events, and other historical data, which is necessary for a full restore to a replacement appliance. This is the only backup type that captures both system configuration and event data.

Exam trap

The trap is assuming that a 'System Configuration Backup' includes everything; candidates must remember that historical event data is separate and must be explicitly selected to be included in the backup.

How to eliminate wrong answers

Option B is wrong because RAID Controller Configuration Export is not a backup type in FMC; it refers to exporting RAID settings from the underlying hardware, not FMC data. Option C is wrong because a System Configuration Backup only includes system settings and configurations, not historical event data, so it would not meet the requirement to include intrusion event data. Option D is wrong because Snort Rule Update (SRU) Snapshot Backup is not a valid FMC backup option; SRU updates are for Snort rules, not for backing up FMC data.

Practice this question →

21

Multi-Selecthard

An administrator is preparing an upgrade plan for an FMC and its managed FTD devices. Which THREE best practices should be followed during the upgrade process to minimize downtime and avoid failure? (Choose three)

Select 3 answers

A.Take a complete backup of the FMC and export device configurations prior to starting the upgrade.

B.Always upgrade the FMC to the target version before upgrading any managed FTD devices.

C.Run the pre-upgrade checker script/package on the devices to identify potential blockers.

D.Factory reset all FTD devices immediately after pushing the upgrade package.

E.Disable the sftunnel service permanently during the upgrade to prevent packet inspection.

AnswersA, B, C

Capturing a full FMC backup plus exported FTD configurations before upgrading preserves the ability to roll back if the upgrade fails, directly satisfying the stem's requirement to avoid failure and minimise downtime. Cisco recommends this as a prerequisite step, since configuration loss without a restore point would extend an outage considerably.

Why this answer

Option A is correct because taking a full FMC backup and exporting FTD configurations before any upgrade provides a rollback point if the upgrade fails or corrupts data, which is essential for minimizing downtime. Option B is correct because Cisco's upgrade best practice requires the FMC to be upgraded to the target version first, since a newer FMC can manage older FTD versions but an older FMC cannot manage newer FTD devices, avoiding management incompatibility. Option C is correct because running the pre-upgrade checker (e.g., via the FTD CLI or the FMC upgrade readiness check) identifies blockers such as unsupported configurations, insufficient disk space, or deprecated features before the upgrade begins.

Option D is incorrect because factory resetting FTD devices after pushing an upgrade would erase the configuration and cause an outage, not minimize downtime. Option E is incorrect because the sftunnel is the management tunnel between FMC and FTD; disabling it permanently would break management and prevent the FMC from pushing the upgrade or policies, and it is not a valid upgrade practice.

Exam trap

The trap is selecting options that sound plausible but are harmful, such as factory resetting devices or disabling management services. Candidates must distinguish between necessary preparatory steps and actions that would disrupt operations.

Practice this question →

22

MCQeasy

An administrator wants to export a packet capture (.pcap file) taken on an FTD interface directly from the FMC GUI for offline analysis in Wireshark. Where should the administrator navigate?

A.System > Tools > Packet Export

B.Policies > Access Control > Advanced > Packet Capture

C.Analysis > Captures or Devices > Device Management > Packet Capture

D.Objects > Object Management > Captures

AnswerC

Captured packets are retrieved from Analysis > Captures, where the .pcap can be downloaded for Wireshark. The Devices > Device Management > Packet Capture path only configures capture parameters, so the Analysis route satisfies the stem's requirement to export the file directly from the FMC GUI.

Why this answer

To export a packet capture (.pcap) taken on an FTD interface from the FMC GUI, the administrator navigates to Analysis > Captures or Devices > Device Management > Packet Capture. These locations provide access to captures stored on the FTD, allowing download of the .pcap file for offline analysis in Wireshark.

Exam trap

300-710 SNCF often tests FMC GUI navigation paths — candidates confuse where packet captures are exported (Analysis > Captures or Device Management) with unrelated menus like System > Tools or Objects > Object Management.

How to eliminate wrong answers

Option A is wrong because System > Tools > Packet Export does not exist in the FMC GUI — there is no such menu path. Option B is wrong because Policies > Access Control > Advanced > Packet Capture is not where captures are exported; access control policies may reference captures but do not provide the export function. Option D is wrong because Objects > Object Management > Captures is not a valid path — object management handles reusable objects, not packet capture files.

Practice this question →

23

MCQmedium

An FTD device is dropping packets unexpectedly. An engineer runs a packet tracer via the FTD diagnostic CLI using 'system support diagnostic-cli' and enters the command: 'packet-tracer input inside tcp 192.168.1.50 12345 10.0.0.5 80'. The output shows a drop at the 'Access-Rule' phase with the action 'DROP'. What does this indicate?

A.The NAT translation table lacks a dynamic PAT port allocation for the source IP.

B.An Access Control Policy rule matched the connection parameters and was configured with an action of Block or Block with reset.

C.The FTD routing table does not have a valid route back to the source IP 192.168.1.50.

D.The SSL decryption policy failed to validate the server certificate for 10.0.0.5.

AnswerB

The packet-tracer output shows the connection was evaluated against the Access Control policy and matched a rule whose action blocks it. The Access-Rule phase drop therefore indicates an explicit Block or Block with reset action, not a default or prefilter drop.

Why this answer

In FTD packet-tracer output, the 'Access-Rule' phase evaluates the connection against the Access Control Policy. A DROP action at this phase means an ACP rule matched the 5-tuple and was configured with Block or Block with Reset, so the packet is denied before further inspection. This is the definitive indicator that policy, not routing or NAT, caused the drop.

Exam trap

The trap is that candidates attribute any drop to routing or NAT, but packet-tracer's phase label precisely identifies which pipeline stage caused the drop, and Access-Rule unambiguously means policy.

How to eliminate wrong answers

Option A is wrong because NAT failures appear in the 'NAT' or 'Route' phase of packet-tracer, not the Access-Rule phase, and would show a different drop reason. Option C is wrong because a missing return route would surface in the 'Route' phase as 'no route to destination' or similar, not at Access-Rule. Option D is wrong because SSL decryption failures appear in the 'SSL' or 'Decrypt' phase and would reference certificate validation, not an access rule drop.

Practice this question →

24

MCQmedium

An administrator needs to verify that a newly registered FTD device is healthy and reachable from FMC before assigning it to a high-availability pair. Which FMC indicator confirms that the FMC-to-FTD management connection and device heartbeat are functioning normally?

A.The device is listed under System > Updates with a firmware version matching the FMC, confirming the management channel is active.

B.The device shows a 'Pending' status with a yellow warning icon, indicating the registration is queued and awaiting approval.

C.The device appears in Device Management with a green check and 'Managed' status, and Health Monitor shows current CPU, memory, and interface metrics for the device.

D.The device appears with a red X and 'Unreachable' status, which FMC uses to indicate the heartbeat is being retried in the background.

AnswerC

A managed FTD shows a green check and 'Managed' status in Device Management, and Health Monitor populates with live CPU, memory, and interface metrics. These indicators together confirm the management tunnel and heartbeat are operational, which is required before the device can be added to an HA pair.

Why this answer

A managed FTD is confirmed healthy when Device Management shows it as 'Managed' with a green check and Health Monitor displays live performance metrics. These signals prove the management channel and heartbeat are working, which is a prerequisite for HA pairing.

Exam trap

The trap here is treating a matching firmware version or a pending registration state as proof of an active management connection, when only live health metrics confirm it.

Practice this question →

25

MCQmedium

An engineer needs to troubleshoot intermittent packet loss between an FTD inside interface and a destination server. The engineer runs the 'packet-tracer' command on the FTD CLI. What limitation must the engineer keep in mind regarding packet-tracer?

A.Packet-tracer actually transmits physical packets out of the egress interface to test real network latency.

B.Packet-tracer bypasses the Snort inspection engine entirely.

C.Packet-tracer simulates packet processing through the firewall and Snort engine without transmitting physical packets.

D.Packet-tracer only works for encrypted IPsec VPN traffic.

AnswerC

Packet Tracer shows how the configuration would handle a specific flow, through routing, NAT, access control policy and Snort, without sending any packet. That makes it ideal for confirming policy allows a flow, but useless for intermittent loss, which depends on real conditions such as congestion, interface errors or an asymmetric path. Pair it with captures on the actual interfaces to see real packets.

Why this answer

The FTD CLI 'packet-tracer' command simulates a packet's processing through the firewall's policy and Snort inspection engine without actually transmitting physical packets on the wire. This makes it a safe diagnostic for policy path verification but not a true end-to-end connectivity or latency test.

Exam trap

The trap is assuming packet-tracer sends real packets and can measure latency or loss; SNCF tests that it only simulates internal processing without transmitting physical packets.

How to eliminate wrong answers

Option A is wrong because packet-tracer does not transmit physical packets; it only simulates processing internally. Option B is wrong because packet-tracer does traverse the Snort inspection engine in its simulation, showing inspection results. Option D is wrong because packet-tracer is not limited to IPsec VPN traffic; it works for general flow simulation.

Practice this question →

26

MCQmedium

An administrator is troubleshooting a scenario where configuration deployment from FMC to an FTD device fails with a 'Deployment Validation Error'. Where can the administrator view the detailed validation messages and deployment task history?

A.Objects > Object Management > History

B.System > Monitoring > Task Manager

C.Analysis > Intrusions > Events

D.Devices > Platform Settings > Deployment Log

AnswerB

The Task Manager records every deployment attempt and its validation messages, so it satisfies the need to view detailed failure reasons and task history. Deployment Validation Errors surface here rather than in FMC health monitors or device logs.

Why this answer

The Task Manager in FMC (System > Monitoring > Task Manager) provides detailed deployment task history, including validation errors and the specific reasons why a configuration deployment to an FTD failed. It shows each deployment attempt, its status, and any error messages generated during validation.

Exam trap

The trap here is confusing the location of deployment logs with other monitoring or object management sections; candidates might assume deployment errors are under device management or object history, but they are specifically in the Task Manager under System > Monitoring.

How to eliminate wrong answers

Option A is wrong because Objects > Object Management > History does not exist; object management does not track deployment history. Option C is wrong because Analysis > Intrusions > Events displays intrusion events, not deployment validation errors. Option D is wrong because Devices > Platform Settings > Deployment Log is not a valid FMC menu path; platform settings are used for device configuration, not deployment logs.

Practice this question →

27

MCQeasy

An administrator needs to verify the license status and active feature subscriptions (such as URL Filtering, Malware, and IPS) on an FMC. Where should the administrator check this information in the FMC GUI?

A.Policies > Access Control > Subscriptions

B.System > Licenses > Smart Licenses

C.Objects > Object Management > Licensing

D.Devices > Device Management > Licenses

AnswerB

System > Licenses > Smart Licenses displays the FMC's registration status and the active feature subscriptions, including URL Filtering, Malware and IPS. This is the single GUI location where an administrator verifies which entitlements are currently enabled and consumed.

Why this answer

In FMC, license status and active feature subscriptions are found under System > Licenses > Smart Licenses. This page displays the Smart Licensing status, including which features (URL Filtering, Malware, IPS, etc.) are enabled and their compliance.

Exam trap

The trap is that candidates might look under device management or object management for licensing, but the correct location is System > Licenses > Smart Licenses.

How to eliminate wrong answers

Option A is wrong because Policies > Access Control > Subscriptions does not exist; access control policies are for traffic filtering, not licensing. Option C is wrong because Objects > Object Management > Licensing is not a valid path; object management is for reusable objects. Option D is wrong because Devices > Device Management > Licenses is not where license status is shown; device management is for managing devices, not licenses.

Practice this question →

28

MCQmedium

You are analyzing connection events and notice a block action. Which field in the connection event details best explains why the connection was dropped by the policy?

A.Reason

B.Policy Enforcement

C.Connection Policy

D.Traffic Log

E.Drop Description

AnswerA

The Reason field records the specific policy or engine decision that produced the block, such as an access control rule or intrusion policy drop. It directly explains why the connection was denied, unlike generic action or verdict fields.

Why this answer

The 'Reason' field in a connection event explicitly states why the connection was dropped, such as 'Blocked by Access Control Rule' or 'Drop due to Snort rule'. It is the most direct indicator of the policy enforcement cause. Other fields like Policy Enforcement or Connection Policy may show related metadata but do not provide the specific drop reason.

Exam trap

The trap is confusing the Reason field with other policy-related fields; candidates might choose 'Policy Enforcement' because it sounds like it explains enforcement, but the actual field that gives the drop reason is 'Reason'.

How to eliminate wrong answers

Option B is wrong because 'Policy Enforcement' is not a standard field in connection event details; it may refer to the policy that was enforced but does not explain the drop reason. Option C is wrong because 'Connection Policy' is not a field that explains why a connection was dropped; it might refer to the policy name but lacks the specific reason. Option D is wrong because 'Traffic Log' is a general term for logs, not a specific field that explains the drop.

Option E is wrong because 'Drop Description' is not a standard field in FMC connection events; the actual field is 'Reason'.

Practice this question →

29

MCQeasy

An administrator needs to generate a troubleshooting file from an FTD device to send to Cisco TAC. The file must include detailed configuration and diagnostic information. Which FTD CLI command should the administrator use?

A.show running-config

B.show system resources

C.show diagnostic

D.show tech-support

AnswerD

The 'show tech-support' command generates a comprehensive troubleshooting file that includes configuration, logs, and diagnostic data. This is the standard command to collect information for TAC cases. It outputs a large amount of data that can be redirected to a file for analysis. It is specifically designed for this purpose, making it the correct choice for gathering detailed system information.

Why this answer

The 'show tech-support' command is the correct choice because it generates a detailed troubleshooting file containing configuration, logs, and diagnostic information. This is the standard procedure for collecting data for Cisco TAC. Other commands like 'show running-config' or 'show system resources' provide only partial information and are not sufficient for a comprehensive troubleshooting file.

Exam trap

The trap here is thinking that 'show running-config' or 'show system resources' would be enough for TAC, when in fact 'show tech-support' is the comprehensive command that bundles all necessary data.

Practice this question →

30

MCQeasy

An administrator needs to troubleshoot a routing issue on an FTD device managed by FMC. Where in the FMC GUI should the administrator navigate to view and modify static and dynamic routing configurations for the device?

A.Objects > Object Management > Network > Routes

B.Devices > Device Management > Edit Device > Routing tab

C.System > Configuration > Network Settings

D.Policies > Access Control > Routing

AnswerB

Static and dynamic routing for a managed FTD is configured under Devices > Device Management, editing the device and opening the Routing tab, which exposes virtual routers, static routes and dynamic routing protocols. This satisfies the requirement to view and modify routing configuration in the FMC GUI.

Why this answer

To view and modify static and dynamic routing configurations for an FTD device in FMC, the administrator navigates to Devices > Device Management, edits the device, and selects the Routing tab. This tab provides access to static routes, dynamic routing protocols (OSPF, BGP, EIGRP), and related routing settings for that specific device.

Exam trap

300-710 SNCF often tests FMC navigation — candidates confuse device-specific routing configuration (Devices > Device Management > Routing) with object management or policy menus that sound related but do not configure routing.

How to eliminate wrong answers

Option A is wrong because Objects > Object Management > Network > Routes is not where routing is configured — object management handles reusable network objects (hosts, networks), not device routing tables. Option C is wrong because System > Configuration > Network Settings is not a valid FMC path for device routing — system settings cover FMC-level configuration, not per-device routing. Option D is wrong because Policies > Access Control > Routing does not exist — access control policies handle traffic inspection, not routing configuration.

Practice this question →

31

MCQmedium

An administrator manages several FTD devices with FMC and needs to verify that each device's health monitor is reporting correctly after a recent configuration change. The administrator wants to view the current health status of all managed devices from a single location in the FMC GUI. Which FMC feature should the administrator use?

A.Health Monitor

B.Device Management

C.Audit Log

D.Task Status

AnswerA

The Health Monitor in FMC provides a centralized dashboard that displays the status of managed devices, including CPU, memory, interface status, and other health metrics. It collects data from all registered FTD devices and alerts on threshold violations. This is the correct tool for viewing overall health status from one location after configuration changes.

Why this answer

The Health Monitor is the dedicated FMC feature that aggregates and displays health status for all managed FTD devices. It provides real-time metrics and alerts, allowing administrators to quickly verify device health after changes. Other options like Audit Log, Task Status, and Device Management serve different purposes and do not offer centralized health monitoring.

Exam trap

The trap here is confusing health monitoring with configuration management or logging features.

Practice this question →

32

MCQeasy

A network administrator is asked to provide a real-time view of active connections passing through a managed FTD device, including source and destination IP addresses, ports, and the applied access control rule, for an ongoing incident. Which FMC analysis tool should the administrator use?

A.The System > Monitoring > Audit Log page, which records configuration changes made to the FMC and managed devices.

B.The Analysis > Intrusions > Events page, which lists every packet that traversed the device regardless of whether an intrusion was detected.

C.The Device Management > Interfaces page, which shows per-interface packet counters and error statistics for the managed device.

D.The Analysis > Connections > Events page, which displays connection events with the matching access control rule and initiating user information.

AnswerD

Analysis > Connections > Events shows connection events recorded by the managed FTD, including 5-tuple details, the access control rule that permitted or blocked the flow, and associated user or application metadata. This is the FMC tool designed for reviewing active and recent connection activity during incident investigation.

Why this answer

Connection events in FMC capture per-flow details including the 5-tuple, the access control rule that matched, and identity or application context. This gives investigators the real-time and historical view of active connections needed to understand what traffic is traversing the managed FTD.

Exam trap

The trap here is confusing intrusion events with connection events, since both appear under Analysis but only connection events list every flow with its matching rule.

Practice this question →

33

MCQeasy

An administrator wants to configure automated email notifications from the FMC whenever a critical health monitor alert occurs on any managed device. Where should this be configured in the FMC GUI?

A.Objects > Object Management > Alerting

B.Policies > Access Control > Logging

C.System > Health > Monitor > Alert Responses

D.Devices > Device Management > Alerts

AnswerC

System > Health > Monitor > Alert Responses defines automated actions triggered by health monitor alerts, including email notifications. Configuring the response here satisfies the requirement for automatic emails whenever a critical health alert fires on any managed device.

Why this answer

FMC health alert email notifications are configured under System > Health > Monitor > Alert Responses. There you define alert response objects that specify the email recipients and the health events (critical/warning) that trigger them, then apply them to health policies. This is the only location in the FMC GUI that natively sends email on health monitor alerts.

Exam trap

The trap is that candidates look under Objects or Policies for alerting because those menus contain most configuration, but health alert responses live under System > Health > Monitor.

How to eliminate wrong answers

Option A is wrong because Objects > Object Management does not contain an 'Alerting' section for health email notifications; object management holds reusable objects like networks, ports, and URLs. Option B is wrong because Policies > Access Control > Logging configures connection event logging and syslog, not health monitor email alerts. Option D is wrong because Devices > Device Management manages device registration, interfaces, and platform settings, not health alert email responses.

Practice this question →

34

MCQhard

An administrator is troubleshooting an FTD device that is experiencing intermittent connectivity issues. The administrator suspects that the issue is related to the data plane and wants to capture packets to analyze the traffic. Which tool in FMC should be used to capture packets on the FTD data interfaces?

A.Packet Tracer

B.NetFlow

C.Packet Capture

D.CLI capture using 'capture' command

AnswerC

The Packet Capture tool in FMC allows administrators to capture packets on FTD data interfaces. It provides a GUI-based way to define capture parameters, start and stop captures, and download the resulting pcap file for analysis. This is the correct tool for capturing data plane traffic on FTD managed by FMC.

Why this answer

The Packet Capture tool in FMC is designed to capture live traffic on FTD data interfaces. It allows the administrator to define capture filters, start captures, and download pcap files. Packet Tracer simulates packet flow, NetFlow provides flow metadata, and CLI capture is not an FMC tool.

Thus, Packet Capture is the correct choice.

Exam trap

The trap here is confusing Packet Tracer with Packet Capture; Packet Tracer simulates a packet's path, while Packet Capture records actual packets.

Practice this question →

35

Multi-Selecteasy

An administrator is setting up health monitoring alerts on the FMC. Which TWO notification methods can be configured when a health alert is triggered? (Choose two)

Select 2 answers

A.Automated SMS text message directly via built-in cellular SIM

B.Email notification

C.SNMP Trap

D.Direct Bluetooth broadcast

E.Automated phone call via SIP trunking

AnswersB, C

Email notification lets the FMC send health alert messages to configured recipients through a mail relay, satisfying the requirement for a configurable alert notification method. It delivers alert details directly to administrators' inboxes, enabling prompt awareness of health events without requiring a separate monitoring console.

Why this answer

On the Cisco Firepower Management Center (FMC), health monitoring alerts can be delivered through the built-in notification mechanisms, and the two supported methods are Email notification (B) and SNMP Trap (C). Email notification (B) is correct because FMC's health monitor configuration allows you to specify recipient email addresses and an SMTP server so that alert messages are sent when a health event occurs. SNMP Trap (C) is correct because FMC can be configured with SNMP trap receivers, allowing health alerts to be forwarded as SNMP traps to a monitoring station.

The remaining options are not valid FMC health alert delivery methods: FMC has no built-in cellular SIM for SMS (A), no Bluetooth broadcast capability for alerts (D), and no SIP trunking integration to place automated phone calls (E).

Exam trap

The trap is assuming FMC supports SMS or phone call alerts; only email and SNMP trap are valid notification methods for health alerts.

Practice this question →

36

Multi-Selecthard

An administrator is performing a backup and restore operation on an FMC appliance. Which THREE statements are correct regarding the FMC restore process? (Choose three)

Select 3 answers

A.Backups can be restored across major software version differences (e.g., restoring a v6.2 backup directly onto v7.4).

B.Restoring a backup overwrites the existing configuration and database on the target FMC.

C.Restoring an FMC backup automatically restores all connected FTD local flash images.

D.After restoring a backup to a new appliance, managed FTD devices may require re-registration or trust re-establishment due to changed CA keys.

E.The target FMC appliance must be running the exact same software version as the appliance where the backup was generated.

AnswersB, D, E

Restoring a backup replaces the target FMC's entire configuration and database, satisfying the stem's requirement that restore operations overwrite existing data rather than merge it. This full replacement mechanism distinguishes restore from selective import, ensuring the appliance returns to the exact captured state.

Why this answer

Option B is correct because the FMC restore process is destructive: it replaces the existing configuration and database on the target appliance with the contents of the backup, so any current settings are overwritten. Option D is correct because the backup includes the FMC's internal CA and certificate material; when restored to a different appliance, the CA keys and identity differ from what managed FTD devices originally trusted, so the devices may need to be re-registered or have trust re-established. Option E is correct because FMC backups are version-specific and can only be restored onto an FMC running the exact same software version as the one that generated the backup.

Option A is incorrect because restoring across major version differences (e.g., v6.2 backup onto v7.4) is not supported; you must first restore to the matching version and then upgrade. Option C is incorrect because an FMC backup captures the FMC configuration and database, not the local flash images on managed FTD devices, so those images are not restored by an FMC restore.

Exam trap

Candidates may assume that backups are portable across versions or that restoring FMC also restores FTD images. The exam tests these specific limitations.

Practice this question →

37

Multi-Selecthard

An administrator is troubleshooting an issue where Snort inspection engine crashes repeatedly on an FTD device. Which THREE diagnostic artifacts or steps should the administrator collect and perform to assist Cisco TAC in resolving the core dump issue? (Choose three)

Select 3 answers

A.Collect the generated core dump files located in the core directory (such as /var/common/ or /var/sf/cores/).

B.Delete all log files in /var/log to clear disk space before opening a TAC case.

C.Note the exact timestamp and any preceding intrusion events or traffic patterns that coincided with the crash.

D.Generate a full 'system support tech-support' bundle from the FTD CLI.

E.Format the flash memory partition containing the Snort binaries.

AnswersA, C, D

Core dumps capture the exact memory state at the moment the Snort inspection engine crashed, which is the primary forensic artifact Cisco TAC requires to trace the faulting code path. Without them, TAC cannot diagnose the crash root cause.

Why this answer

Option A is correct because when the Snort inspection engine crashes on an FTD, the resulting core dump files are written to directories such as /var/common/ or /var/sf/cores/, and these binaries are essential for TAC to perform root-cause analysis of the crash. Option C is correct because recording the exact timestamp of the crash along with any preceding intrusion events or traffic patterns helps TAC correlate the core dump with the triggering conditions and reproduce the fault. Option D is correct because generating a full 'system support tech-support' bundle from the FTD CLI captures the complete device state, configuration, logs, and diagnostics that Cisco TAC requires alongside the core files.

Option B is incorrect because deleting log files in /var/log destroys forensic evidence and does not address the core dump issue. Option E is incorrect because formatting the flash partition containing the Snort binaries would remove critical software and is a destructive action that would not help diagnose the crash.

Exam trap

The trap is selecting destructive or irrelevant actions like deleting logs or formatting partitions; candidates must choose steps that preserve and collect diagnostic evidence.

Practice this question →

38

Multi-Selectmedium

An administrator is troubleshooting high memory utilization on an FMC appliance. Which TWO actions or tools can be used to identify resource-heavy processes or clean up storage? (Choose two)

Select 2 answers

A.Navigate to Analysis > Health > Monitor to review historical memory utilization graphs and identify anomalies.

B.Run 'system support memory-dump' from the FMC GUI.

C.Use the FMC CLI expert mode to run standard Linux utilities such as 'top' or 'ps' to inspect process resource consumption.

D.Restart the Snort inspection engine on the FMC.

E.Execute 'clear memory cache' in the FMC CLI.

AnswersA, C

The Health Monitor page under Analysis retains historical memory graphs, letting the administrator correlate spikes with specific timeframes and identify which processes or features drove utilisation upward. This directly supports diagnosing the high memory condition described.

Why this answer

Option A is correct because the FMC's Analysis > Health > Monitor page provides Health Monitor graphs, including historical memory utilization, which let the administrator spot trends and anomalies that correlate with resource-heavy periods. Option C is correct because entering expert mode from the FMC CLI gives access to the underlying Linux shell, where standard utilities like 'top' and 'ps' show per-process CPU and memory consumption so the offending process can be identified. Option B is wrong because 'system support memory-dump' is not a valid FMC GUI action for this purpose.

Option D is wrong because restarting the Snort inspection engine on the FMC does not identify resource-heavy processes or clean up storage, and Snort typically runs on managed devices rather than the FMC itself. Option E is wrong because 'clear memory cache' is not a valid FMC CLI command.

Exam trap

The trap is that candidates pick plausible-sounding but non-existent commands like 'clear memory cache' or 'system support memory-dump' from the GUI, when the real tools are the Health Monitor graphs and Linux utilities in expert mode.

Practice this question →

39

Multi-Selecthard

When configuring FMC backup schedules, which TWO storage options are natively supported for the backup files?

Select 2 answers

A.Remote SCP server

B.Local USB drive

C.Cloud S3 storage bucket

D.Local management appliance storage

E.Centralized Syslog server

AnswersA, D

SCP is one of the two natively supported FMC backup destinations, letting scheduled backups transfer to a remote server over SSH. This satisfies the stem's requirement for natively supported storage options, alongside local storage. It provides off-box retention, protecting backups if the FMC appliance itself fails.

Why this answer

Option A (Remote SCP server) is correct because FMC's backup scheduling feature natively supports exporting backups to a remote host via SCP, allowing administrators to store configuration backups off-box using the SCP protocol. Option D (Local management appliance storage) is also correct because FMC natively supports storing scheduled backups on the local disk of the management appliance itself. Options B (Local USB drive), C (Cloud S3 storage bucket), and E (Centralized Syslog server) are not natively supported backup destinations for FMC scheduled backups; USB and S3 are not built-in options in the FMC backup schedule configuration, and a Syslog server is used for event/log forwarding, not for storing backup files.

Exam trap

The trap is assuming FMC supports modern storage targets like S3 or USB — candidates pick those because they are common in other backup tools, but FMC natively supports only local appliance storage and remote SCP.

Practice this question →

40

MCQmedium

When troubleshooting policy deployment failures, which log file on the FMC should be examined to see the specific error returned by the device during the commit process?

A.FMC kernel log

B.Snort logs

C.Deployment History

D.System Access Log

E.Audit logs

AnswerC

Deployment History records each configuration push to managed devices, capturing the exact error returned by the device when a commit fails. Unlike general troubleshooting logs, it preserves per-deployment status and failure messages, directly satisfying the requirement to identify the specific device-returned error during policy deployment.

Why this answer

The Deployment History in FMC records each policy deployment attempt, including the specific error messages returned by the managed device during the commit process. It is the primary place to troubleshoot deployment failures.

Exam trap

The trap is assuming that general system logs (kernel, audit, access) contain deployment errors, when only the Deployment History captures the device's commit response.

How to eliminate wrong answers

Option A is wrong because the FMC kernel log does not contain policy deployment errors from managed devices. Option B is wrong because Snort logs are on the FTD sensor and relate to intrusion events, not policy deployment commit errors. Option D is wrong because the System Access Log records administrative access to the FMC, not deployment errors.

Option E is wrong because Audit logs track configuration changes and user actions, not the device's commit error output.

Practice this question →

41

MCQmedium

An administrator is troubleshooting an FTD device that is not registering with the FMC. The administrator suspects a certificate or network issue. Which FTD CLI command should be used to verify the registration status and connectivity to the FMC?

A.show cisco-fmc

B.show managers

C.show registration status

D.show fmc-connection

AnswerB

The 'show managers' command displays the current manager (FMC) information, including registration status, the FMC IP address, and the last heartbeat time. It is the primary command to verify if the FTD is successfully registered and communicating with the FMC. If registration is failing, this command will show a status other than 'Registered' or indicate connectivity issues, making it the correct choice for troubleshooting registration problems.

Why this answer

The 'show managers' command is the correct tool to verify FTD registration with the FMC. It provides details such as the manager type, IP address, registration status, and last heartbeat. When an FTD fails to register, this command will indicate the current state, helping the administrator determine if the issue is network-related, certificate-related, or configuration-related.

The other options are non-existent commands.

Exam trap

The trap here is assuming that a command containing 'fmc' or 'registration' would be the correct one, when in fact the FTD CLI uses the generic term 'managers' to refer to the FMC.

Practice this question →

42

MCQhard

When troubleshooting an issue where an FTD interface is in a 'down' state, which command helps verify if there is a physical layer issue or an administrative shutdown?

A.show link status

B.show interface

C.show hardware interface

D.show run interface

E.show status

AnswerB

The show interface command reports line protocol status, administrative state and physical errors, distinguishing an administratively shut interface from a genuine physical-layer failure. This directly satisfies the stem's need to separate shutdown from cabling or hardware faults.

Why this answer

The 'show interface' command on FTD displays detailed per-interface status including line protocol state, administrative state, speed, duplex, and error counters, which lets the administrator distinguish a physical layer problem (line down, no link) from an administrative shutdown (interface administratively down). This is the standard CLI check for interface state on FTD.

Exam trap

The trap is that candidates pick 'show run interface' because it shows the shutdown command, but SNCF tests the command that reveals live physical layer status, which is 'show interface'.

How to eliminate wrong answers

Option A is wrong because 'show link status' is not a valid FTD/Lina command for interface diagnostics. Option C is wrong because 'show hardware interface' is not a recognized FTD command and does not report operational link state. Option D is wrong because 'show run interface' displays the running configuration (including shutdown/no shutdown) but does not show live physical layer status or error counters.

Option E is wrong because 'show status' is not a valid FTD command for interface state verification.

Practice this question →

43

MCQhard

An FTD high availability pair experiences a failover due to a hardware failure on the active unit. After the standby unit takes over, the administrator notices that existing TCP connections were dropped and did not state-fully fail over. What configuration setting should the administrator verify?

A.Ensure that dynamic routing protocols are configured with graceful restart.

B.Verify that stateful failover is enabled and the failover link interface is operational and passing state packets.

C.Verify that clustering is enabled instead of high availability.

D.Check that adaptive inspection is disabled in the Access Control Policy.

AnswerB

Stateful failover replicates the connection table over the failover link, so the standby unit inherits existing sessions and keeps TCP connections alive. If that link is down or stateful failover is disabled, sessions drop, matching the observed non-stateful failover.

Why this answer

Stateful failover in an FTD HA pair requires that the failover link be up and actively passing state synchronization packets between the active and standby units. If the failover link is down or stateful failover is not enabled, the standby unit takes over the interfaces but has no session table, so existing TCP connections are dropped and must be re-established.

Exam trap

The trap is confusing routing protocol graceful restart with firewall stateful failover; candidates who focus on 'failover' as a routing concept pick option A instead of verifying the HA failover link and stateful failover setting.

How to eliminate wrong answers

Option A is wrong because graceful restart applies to routing protocol adjacencies (OSPF/BGP) and does not preserve firewall session state across failover. Option C is wrong because clustering is a separate multi-device scaling technology, not a replacement for HA stateful failover, and enabling it would not fix session preservation. Option D is wrong because adaptive inspection relates to inspection policy behavior, not to whether session state is synchronized across HA peers.

Practice this question →

44

MCQhard

An FMC high availability (HA) pair has split-brain symptoms due to a management network failure. After restoring network connectivity, the standby unit remains in a 'Failed' state and does not automatically re-synchronize. What is the correct procedure to recover the HA sync?

A.Run 'system support fmc-ha-sync' from the standby FMC CLI.

B.Go to System > Integration > HA, break the HA pairing, and re-establish it using the active unit as the primary.

C.Reboot both FMC units simultaneously.

D.From the primary FMC CLI, run 'configure ha restore-sync'.

AnswerB

Breaking the HA pairing and re-establishing it with the active unit as primary forces the standby to rebuild its configuration and database from the healthy peer, clearing the Failed state that blocks automatic re-synchronisation after split-brain.

Why this answer

When an FMC HA pair experiences split-brain and the standby unit remains in a 'Failed' state after network restoration, the correct recovery is to break the HA pairing and re-establish it using the active unit as the primary. This forces a clean re-synchronization and resolves the failed state.

Exam trap

The trap is assuming that HA will automatically re-synchronize after network restoration, or that there is a simple CLI command to force sync. Candidates may also confuse FMC HA with FTD HA procedures.

How to eliminate wrong answers

Option A is wrong because 'system support fmc-ha-sync' is not a valid FMC CLI command; FMC HA synchronization is managed through the GUI or specific procedures. Option C is wrong because rebooting both units simultaneously can cause further issues and does not guarantee re-synchronization; it may even worsen the split-brain. Option D is wrong because 'configure ha restore-sync' is not a valid FMC CLI command; HA recovery is not performed via such commands.

Practice this question →

45

MCQhard

An administrator is troubleshooting asymmetric routing issues across an FTD firewall using the FMC connection events and FTD CLI. The administrator wants to disable TCP state bypass or adjust TCP normalization settings to allow non-synchronized SYN packets through for a specific application. Where are TCP normalization and stateful inspection parameters configured for FTD?

A.Policies > Access Control > Advanced > Network Settings

B.Objects > Object Management > Advanced > TCP State

C.Devices > Platform Settings > Edit Policy > Stateful Inspection / TCP Settings

D.System > Configuration > Global Parameters > TCP

AnswerC

TCP normalisation and stateful inspection parameters, including TCP state bypass behaviour, live under Devices > Platform Settings > Stateful Inspection / TCP Settings, not in access control policy. This satisfies the stem's need to permit non-synchronised SYN packets for a specific application.

Why this answer

TCP normalization and stateful inspection parameters for FTD are configured under Devices > Platform Settings > Edit Policy > Stateful Inspection / TCP Settings. This is where you adjust TCP state bypass, normalization, and related settings that affect how the FTD handles asymmetric flows and non-synchronized SYN packets.

Exam trap

The trap is confusing Access Control policy settings with Platform Settings; TCP normalization is a device-level platform setting, not an access control rule option.

How to eliminate wrong answers

Option A is wrong because Policies > Access Control > Advanced > Network Settings does not exist as a TCP normalization location; Access Control policies handle traffic inspection and rule actions, not global TCP state parameters. Option B is wrong because Objects > Object Management > Advanced > TCP State is not a valid FMC path for TCP normalization configuration. Option D is wrong because System > Configuration > Global Parameters > TCP is not where FTD TCP settings are configured; global system settings do not include per-device TCP normalization.

Practice this question →

46

Multi-Selecthard

An administrator is investigating an issue where connection events are failing to reach the FMC from a managed FTD. Which THREE daemons or logs on the FTD and FMC should be checked to troubleshoot event transport and communication issues? (Choose three)

Select 3 answers

A.FTD event streaming and SFIMS logs

B./var/log/dhcpd.log

C./var/log/cisco/sftunnel.log

D./var/log/samba/smb.log

E.FMC event collection and correlator logs (such as /var/log/messages or application logs in /var/sf/log)

AnswersA, C, E

The SFIMS process handles event streaming from the FTD to the FMC, so its logs reveal whether connection events are being generated, queued or dropped before transport. Checking FTD event streaming alongside SFIMS logs isolates failures at the source rather than the tunnel.

Why this answer

Option A is correct because the FTD's event streaming process and SFIMS (the Firepower Management Center communication agent) are responsible for generating and forwarding connection events to the FMC, so their logs directly reveal whether events are being produced and transmitted. Option C is correct because /var/log/cisco/sftunnel.log records the status of the sftunnel (Secure Firewall Tunnel) connection between the FTD and FMC; if this tunnel is down or flapping, event transport will fail. Option E is correct because on the FMC, the event collection and correlator components receive and process events, and their logs (for example /var/log/messages or application logs under /var/sf/log) show whether events arrive and are ingested.

Option B is not relevant because /var/log/dhcpd.log pertains to DHCP daemon activity, which has nothing to do with FTD-to-FMC event transport. Option D is not relevant because /var/log/samba/smb.log relates to SMB/CIFS file-sharing services, which are unrelated to Firepower event communication.

Exam trap

300-710 often tests event transport by mixing relevant FTD/FMC logs with unrelated Linux service logs (dhcpd, samba) — candidates must identify the specific daemons and logs involved in the event pipeline.

Practice this question →

47

MCQmedium

An engineer is troubleshooting a newly deployed FTD device where syslog messages are not reaching the external syslog server. Which tool on the FTD CLI can the engineer use to verify if the syslog generation and transmission process is attempting to send packets out the management or data interface?

A.Run 'debug syslog all' from the FTD expert mode.

B.Capture traffic on the designated egress interface matching the syslog server IP and UDP port 514.

C.Use 'system support reset-logging'.

D.Check the FMC dashboard under System > Logging > Syslog status.

AnswerB

Capturing on the egress interface for the syslog server IP and UDP 514 confirms whether FTD actually generates and transmits syslog packets, and reveals which interface they leave by. This directly satisfies the stem's requirement to verify the sending process.

Why this answer

To verify if syslog packets are being sent out the correct interface, the engineer should capture traffic on the designated egress interface matching the syslog server IP and UDP port 514. This will show whether the FTD is attempting to transmit syslog messages and on which interface.

Exam trap

The trap is assuming there is a built-in debug or status tool for syslog; candidates must know that packet capture is the primary method to verify transmission.

How to eliminate wrong answers

Option A is wrong because 'debug syslog all' is not a valid command on FTD expert mode; FTD does not have a syslog debug command like that. Option C is wrong because 'system support reset-logging' resets logging configuration, not a diagnostic tool to verify packet transmission. Option D is wrong because the FMC dashboard does not have a Syslog status page under System > Logging; syslog status is not monitored there.

Practice this question →

48

Multi-Selecthard

An administrator must capture and analyze traffic on a specific FTD interface to troubleshoot an intermittent connectivity problem. The administrator wants to use FMC-native capabilities rather than logging into the device CLI. Which TWO actions can the administrator perform from the FMC to capture and then inspect the traffic? (Choose two.)

Select 2 answers

A.Download the resulting .pcap file from the FMC packet capture task and open it in a third-party analyzer such as Wireshark.

B.Create a packet capture on the managed device interface from the FMC Device Management page, specifying the interface and an optional access list or match filter.

C.Use the FMC Intrusion Events page to reconstruct the raw packet bytes for the flow from the stored event payload.

D.Enable 'Capture All Traffic' under the FTD platform settings so every packet is retained in the FMC event database for later inspection.

E.Run the 'capture-traffic' command from the FMC CLI to pull packets from the managed device into the FMC local filesystem.

AnswersA, B

Once the capture completes, FMC provides the .pcap file for download from the packet capture task. Administrators can then open it in Wireshark or another analyzer to inspect packet-level detail, which is the intended FMC-native workflow for deep traffic analysis of a managed FTD interface.

Why this answer

FMC lets administrators create a packet capture on a managed FTD interface with optional filters, then download the resulting .pcap for analysis in an external tool. This provides a GUI-driven capture workflow without requiring CLI access to the device.

Exam trap

The trap here is assuming FMC stores raw packets in its event database, when packet data must be explicitly captured on the device and downloaded as a .pcap.

Practice this question →

49

MCQeasy

An administrator wants to generate a health report on the FMC to present hardware utilization trends over the past 30 days. Which section of the FMC GUI provides pre-built health reports and metric tracking?

A.Policies > Actions > Health Reporting

B.Devices > Device Management > Health Status

C.Analysis > Health > Monitor

D.System > Monitoring > Syslog

AnswerC

Analysis > Health > Monitor provides pre-built health reports and metric tracking, directly satisfying the requirement for hardware utilisation trends over 30 days. Unlike the dashboards under Overview, which show only current status, this section retains historical metrics and generates exportable reports covering the specified period.

Why this answer

The FMC's Analysis > Health > Monitor section provides pre-built health dashboards and metric tracking for managed devices, including CPU, memory, disk, and interface statistics over configurable time ranges such as the past 30 days. This is where administrators generate health reports and view historical utilization trends.

Exam trap

300-710 SNCF often tests GUI navigation paths, and candidates confuse the Health Monitor under Analysis with device status pages under Devices or syslog configuration under System — the correct path is Analysis > Health > Monitor.

How to eliminate wrong answers

Option A is wrong because Policies > Actions > Health Reporting is not a valid FMC menu path — health reporting lives under Analysis, not Policies. Option B is wrong because Devices > Device Management > Health Status shows per-device status but is not the pre-built reporting and trend-tracking section. Option D is wrong because System > Monitoring > Syslog configures syslog forwarding, not health metric reporting or trend analysis.

Practice this question →

50

Multi-Selecthard

An administrator is planning an upgrade of an FMC managing multiple FTD devices across various software versions. Which THREE factors must be validated according to Cisco compatibility guidelines before proceeding? (Choose three)

Select 3 answers

A.Supported upgrade paths (e.g., whether a direct jump from v6.4 to v7.4 is supported or requires an intermediate upgrade).

B.Available disk space on both FMC and FTD partitions (such as /var and /root) to ensure the upgrade packages can unpack successfully.

C.The local NTP server stratum level must be exactly stratum 1.

D.The serial number of the external power supplies attached to the rack mount chassis.

E.Cisco Firepower Compatibility Guide to ensure the target FMC version supports the currently installed FTD versions.

AnswersA, B, E

Cisco supports only defined upgrade paths; jumping directly from v6.4 to v7.4 is unsupported and requires intermediate releases. Confirming the supported path for each FTD version ensures the FMC can orchestrate the upgrade without an unsupported state.

Why this answer

Option A is correct because Cisco upgrade planning requires verifying supported upgrade paths; for example, a direct jump from v6.4 to v7.4 may not be supported and may require an intermediate release such as v7.0 or v7.2 before reaching v7.4. Option B is correct because the upgrade process must have sufficient free space on FMC and FTD partitions, including /var and /root, so that downloaded packages and temporary files can be unpacked and staged without filling the filesystem. Option E is correct because the Cisco Firepower Compatibility Guide must be consulted to confirm that the target FMC software version interoperates with and supports the FTD versions currently managed by that FMC.

Option C is not required because NTP stratum 1 is not a Cisco Firepower upgrade prerequisite; time synchronization matters, but the local NTP server does not have to be stratum 1. Option D is not required because the serial numbers of external power supplies are irrelevant to software compatibility and upgrade validation.

Exam trap

The trap is selecting irrelevant hardware or network details (like NTP stratum or power supply serial numbers) as compatibility factors; candidates may think any infrastructure detail matters, but only software paths, disk space, and the compatibility guide are required.

Practice this question →

51

Multi-Selectmedium

When analyzing performance issues, which THREE metrics should an administrator monitor in the FMC Health Monitor?

Select 3 answers

A.CPU utilization

B.Memory utilization

C.Disk utilization

D.User login frequency

E.Number of active GUI sessions

AnswersA, B, C

High CPU directly impacts packet processing.

Why this answer

In the FMC Health Monitor, CPU utilization (A) is a core metric because sustained high processor load directly degrades policy deployment, event processing, and GUI responsiveness. Memory utilization (B) must be monitored since FMC runs multiple services (e.g., the database, Tomcat, and eventing processes) that can exhaust RAM and trigger swapping or service restarts. Disk utilization (C) is equally critical because the FMC stores event data, configuration backups, and updates on disk; a full /var or / volume can halt logging and even the web interface.

The unmarked options do not belong because user login frequency (D) and the number of active GUI sessions (E) are administrative activity indicators, not system health or performance metrics tracked by the FMC Health Monitor.

Exam trap

300-710 SNCF often tests the distinction between performance metrics and administrative/audit metrics — candidates may select login frequency or GUI session counts, but the Health Monitor's performance trio is CPU, memory, and disk.

Practice this question →

52

Multi-Selectmedium

An engineer needs to troubleshoot high CPU usage on an FTD device caused by Snort. Which THREE actions or features can be adjusted or implemented to mitigate Snort CPU load? (Choose three)

Select 3 answers

A.Convert all physical interfaces into switchports without IP addresses.

B.Configure SSL Decryption policies to bypass trusted internal traffic or known safe applications.

C.Disable the FTD kernel entirely and run Snort in standalone user-space loopback mode.

D.Tune the Intrusion Policy to disable rules that are not applicable to the network environment.

E.Optimize Access Control rules by placing frequently matched allow rules higher in the rule order with fewer inspection requirements.

AnswersB, D, E

SSL Decryption policies determine which flows Snort must decrypt and inspect. Bypassing trusted internal traffic or known safe applications removes that decryption and inspection workload from the Snort engine, directly lowering CPU consumption without weakening inspection of untrusted sessions.

Why this answer

Option B is correct because SSL Decryption is one of the most CPU-intensive operations Snort performs; bypassing trusted internal traffic or known safe applications in the SSL policy prevents Snort from decrypting and inspecting that traffic, directly reducing CPU load. Option D is correct because the Intrusion Policy determines which Snort rules are evaluated, and disabling rules not applicable to the network environment reduces the number of signatures Snort must process per packet, lowering CPU utilization. Option E is correct because Access Control rules are evaluated top-down, and placing frequently matched allow rules higher with fewer inspection requirements (e.g., no intrusion or file inspection) lets traffic be allowed early with minimal Snort processing, reducing overall CPU demand.

Option A is incorrect because converting physical interfaces to switchports without IP addresses is a Layer 2 deployment consideration and does not by itself reduce Snort CPU load. Option C is incorrect because disabling the FTD kernel and running Snort in standalone user-space loopback mode is not a supported or valid FTD configuration and would not mitigate CPU usage.

Exam trap

300-710 SNCF often tests the misconception that disabling kernel components or restructuring interfaces can reduce Snort CPU load, when the real levers are policy tuning, decryption bypass, and rule optimization.

Practice this question →

53

MCQhard

When a packet capture is running on the FTD, where can you download the resulting .pcap file for analysis in Wireshark?

A.Devices > Device Management > Diagnostics

B.Devices > Device Management > Captures

C.System > Tools > File Transfer

D.Objects > File Lists

E.Analysis > Packet Analysis

AnswerB

Packet captures on the FTD are stored and retrieved via the Devices > Device Management > Captures page in the FMC, satisfying the requirement to download the resulting .pcap for Wireshark analysis. This location lists completed capture files and provides the download action, unlike other monitoring or analysis sections.

Why this answer

Packet capture files (.pcap) generated on the FTD can be downloaded from Devices > Device Management > Captures in the FMC GUI. This page lists active and completed captures and provides a download option for the resulting pcap file, which can then be opened in Wireshark for detailed analysis. It is the designated location for managing and retrieving capture files.

Exam trap

The trap is that candidates confuse the capture download location with other file management areas like File Transfer or File Lists, but the correct path is specifically Devices > Device Management > Captures.

How to eliminate wrong answers

Option A is wrong because Devices > Device Management > Diagnostics is used for diagnostic tools like troubleshooting wizards and packet tracer, not for downloading capture files. Option C is wrong because System > Tools > File Transfer is used for importing and exporting files such as backups and upgrades, not for retrieving packet captures. Option D is wrong because Objects > File Lists is used to manage file objects for policies, not capture files.

Option E is wrong because Analysis > Packet Analysis is not the correct path for downloading captures from FTD devices.

Practice this question →

54

Multi-Selecteasy

An administrator is performing health monitoring on an FMC appliance. Which TWO health monitors are available out-of-the-box in the FMC Health Monitor dashboard to track system resource utilization? (Choose two)

Select 2 answers

A.CPU Utilization

B.Disk Utilization

C.SSL Handshake Latency

D.SNMP Trap Queue Depth

E.BGP Peer Flap Counter

AnswersA, B

CPU Utilization is a default FMC health monitor, reporting processor load directly from the appliance's system metrics without extra configuration. It satisfies the stem's out-of-the-box requirement by tracking system resource utilisation, letting the administrator spot sustained high CPU that degrades inspection and logging performance.

Why this answer

The FMC Health Monitor dashboard ships with a set of default, out-of-the-box monitors that focus on appliance-level system resources, and CPU Utilization (A) is one of them, tracking processor load on the FMC so administrators can detect performance degradation. Disk Utilization (B) is also a built-in monitor, reporting how full the FMC's disk partitions are, which is critical because a full disk can halt logging, event storage, and database operations. Both A and B are standard system-resource monitors present by default without any additional configuration.

The other options do not belong: SSL Handshake Latency (C) is not a default FMC health monitor, SNMP Trap Queue Depth (D) is not an out-of-the-box FMC system-resource monitor, and BGP Peer Flap Counter (E) relates to routing protocol state rather than FMC appliance resource utilization.

Exam trap

300-710 SNCF often tests whether candidates can distinguish FMC's built-in Health Monitor metrics (CPU, memory, disk, interface) from unrelated features like SSL inspection statistics, SNMP integration, or routing protocol counters that sound plausible but are not default health monitors.

Practice this question →

55

Multi-Selectmedium

Which TWO methods can be used to gather diagnostic information for a Cisco TAC case from an FTD device?

Select 2 answers

A.Generate a troubleshooting file in the FMC

B.Taking a memory dump of the Snort process

C.Running a full system re-image

D.Exporting the full database schema

E.Run a packet capture on the FTD CLI

AnswersA, E

The troubleshooting file bundles FTD diagnostics, configuration and logs into one archive that Cisco TAC accepts. Generating it from the FMC satisfies the requirement to gather diagnostic information without needing direct CLI access to the managed device.

Why this answer

Option A is correct because the Firepower Management Center (FMC) provides a built-in 'Generate Troubleshooting File' feature under the device's Troubleshoot menu, which bundles logs, configuration, and health data into a single archive specifically intended for Cisco TAC analysis. Option E is correct because running a packet capture on the FTD CLI (e.g., using the 'capture-traffic' command or the FTD 'capture' command in expert mode) lets an administrator collect live packet-level data that TAC commonly requests to diagnose traffic and inspection issues. Option B is not a standard TAC diagnostic method for FTD; a Snort memory dump is not a routine, supported data-gathering procedure and is typically used only for specific crash analysis.

Option C is wrong because re-imaging the device is a destructive recovery action, not a diagnostic data-gathering method, and would erase evidence. Option D is wrong because exporting a full database schema is not a supported FTD diagnostic collection method and provides no useful troubleshooting data for TAC.

Exam trap

300-710 SNCF often tests whether candidates can distinguish supported diagnostic-gathering methods (troubleshooting file, CLI packet capture) from destructive or non-diagnostic actions like re-imaging, memory dumps, or database exports that sound technical but are not part of TAC workflows.

Practice this question →

56

Multi-Selecthard

An administrator is troubleshooting intermittent connectivity loss between an FTD managed device and the FMC. Which TWO methods or tools can be used to verify registration and communication status between the managed device and the FMC? (Choose two.)

Select 2 answers

A.Inspect the Access Control policy rule hit counts.

B.Run a packet capture on the FMC management interface filtering for UDP port 514.

C.Review the connection status in the FMC GUI under Devices > Device Management.

D.Check the health monitor alerts specifically for 'SNMP Agent' status.

E.Execute the 'show sftunnel status' or 'sftm status' command on the FTD CLI.

AnswersC, E

The FMC GUI's Devices > Device Management page shows each managed FTD's registration and connectivity state, letting the administrator confirm whether the device is currently reachable and communicating, which directly addresses verifying registration and communication status during intermittent connectivity loss.

Why this answer

Option C is correct because the FMC GUI at Devices > Device Management displays each managed device's registration and connectivity state (e.g., 'Up'/'Down' or 'Reachable'), which directly reflects the SFTunnel-based management channel status. Option E is correct because the FTD CLI commands 'show sftunnel status' (or the newer 'sftm status') report the state of the Secure Firewall Tunnel (SFTunnel) that carries management traffic between the FTD and FMC, including peer connectivity and heartbeat information. Option A is wrong because Access Control policy hit counts show traffic matching rules, not the management/registration tunnel status.

Option B is wrong because UDP port 514 is syslog, not the SFTunnel management protocol, and capturing on the FMC management interface would not verify registration state. Option D is wrong because the health monitor's 'SNMP Agent' status concerns SNMP polling, not the FTD-to-FMC registration and communication channel.

Exam trap

300-710 SNCF often tests whether candidates confuse data-plane inspection tools (rule hit counts, packet captures on syslog ports) with the management-plane SFTunnel verification commands and GUI locations that actually confirm FMC registration.

Practice this question →

57

Multi-Selecthard

An engineer is troubleshooting a scenario where an FTD device fails its pre-upgrade health check during an upgrade initiated from the FMC. Which THREE common pre-check failures must be resolved before proceeding? (Choose three)

Select 3 answers

A.Active SSH sessions logged into the FTD CLI.

B.Unapplied pending configuration deployments between FMC and FTD.

C.Insufficient disk space on the target upgrade partition (/var or /CiscoMFT).

D.Active critical health monitor alarms on the device.

E.Configured static routing tables with default gateways.

AnswersB, C, D

Pending configuration changes not yet deployed from FMC to the FTD block the upgrade, because the health check requires the device's running configuration to match the FMC-managed policy. Deploying pending changes clears this pre-check failure before the upgrade proceeds.

Why this answer

Option B is correct because the FMC pre-upgrade health check verifies configuration synchronization, and any pending, undeployed policy or configuration changes between FMC and the managed FTD must be deployed before the upgrade can proceed. Option C is correct because the upgrade process requires adequate free space on the target partition (such as /var or /CiscoMFT) to stage and extract the new software image, and the pre-check fails if disk space is insufficient. Option D is correct because active critical health monitor alarms indicate an unhealthy device state, and the pre-check blocks the upgrade until those critical alarms are cleared.

Option A is not a pre-check failure condition, since active SSH sessions to the FTD CLI do not by themselves block an FMC-initiated upgrade. Option E is not a failure condition either, as static routes and default gateways are normal, valid configuration and are not checked as an upgrade blocker.

Exam trap

300-710 SNCF often tests which conditions actually block an FMC-initiated upgrade — candidates may incorrectly select benign items like active SSH sessions or static routes, when the real blockers are pending deployments, disk space, and critical health alarms.

Practice this question →

58

MCQmedium

An FTD device managed by FMC is failing to download latest Snort Rule Updates (SRUs) and GeoDB updates automatically. The FMC has internet access via an HTTPS proxy. Where must the HTTPS proxy settings be configured on the FMC so that it can successfully reach Cisco update servers?

A.Objects > Object Management > Network Proxy

B.Devices > Device Management > Advanced > Proxy

C.Policies > Access Control > Updates > Proxy

D.System > Configuration > Proxy

AnswerD

The FMC's own management-plane traffic to Cisco update servers uses the appliance-level proxy configuration, found under System > Configuration > Proxy. Configuring it there lets SRU and GeoDB downloads traverse the HTTPS proxy; platform settings or FTD-level proxies do not govern this.

Why this answer

For the FMC to download SRUs and GeoDB updates through an HTTPS proxy, the proxy settings must be configured under System > Configuration > Proxy. This is the global proxy configuration that the FMC uses for all outbound internet communications, including update downloads.

Exam trap

The trap is confusing the FMC's system proxy with device-level proxy settings or network objects; candidates may pick a path that seems logical but is not the global system configuration.

How to eliminate wrong answers

Option A is wrong because Objects > Object Management > Network Proxy is for defining network objects, not for configuring the system proxy. Option B is wrong because Devices > Device Management > Advanced > Proxy is for setting proxy on managed devices, not the FMC itself. Option C is wrong because Policies > Access Control > Updates > Proxy is not a valid path; access control policies do not contain proxy settings for updates.

Practice this question →

59

Multi-Selecthard

Which THREE steps are part of a standard FTD upgrade workflow managed via the FMC?

Select 3 answers

A.Manually delete all existing access rules

B.Run a factory reset on the FTD

C.Upload the upgrade package to the FMC

D.Review and approve the health check report

E.Select the device in the Upgrade management page

AnswersC, D, E

FMC-managed upgrades begin by importing the Cisco-provided upgrade package into the FMC's software repository, since the FMC pushes images to managed devices. Without the package staged on the FMC, no device can be upgraded, making this an obligatory early workflow step.

Why this answer

Option C is correct because the standard FTD upgrade workflow managed through the FMC begins by uploading the FTD software upgrade package (image) to the FMC, which then stages it for deployment to managed devices. Option E is correct because after the package is available, the administrator selects the target device(s) in the FMC's Upgrade management page to initiate and schedule the upgrade. Option D is correct because the workflow includes running a readiness/health check on the device and reviewing and approving the resulting health check report before proceeding with the actual upgrade.

Options A and B are incorrect: manually deleting all existing access rules is not a step in the upgrade workflow and would disrupt policy, and running a factory reset on the FTD is not part of a standard upgrade—it would wipe the configuration rather than upgrade the software.

Exam trap

The trap here is including unnecessary or destructive steps like factory reset or deleting access rules, which are not part of the standard upgrade workflow and would cause operational issues.

Practice this question →

60

MCQhard

An FMC administrator is troubleshooting a scenario where device registration between an FTD and FMC fails immediately with a registration key mismatch error. The administrator verified the NAT ID and registration key. What underlying protocol handshake fails during this registration process, and how can it be debugged?

A.The sftunnel (TCP 8305) handshake fails; debug using 'sftunnel status' and examining /var/log/sftunnel.log.

B.The HTTPS REST API (TCP 443) handshake fails; debug using 'debug rest-api'.

C.The SNMP trap receiver fails; debug using 'system support snmp-debug'.

D.The SSH tunnel (TCP 22) fails; debug using 'tail -f /var/log/secure'.

AnswerA

Device registration relies on the sftunnel daemon over TCP 8305; a key mismatch aborts that handshake before registration completes. Checking 'sftunnel status' and /var/log/sftunnel.log on the FTD reveals the negotiation failure, confirming the key or NAT ID mismatch.

Why this answer

FTD-to-FMC registration relies on the sftunnel, which uses TCP 8305 for its handshake and ongoing management communication. When registration fails with a key mismatch, the sftunnel handshake is what is failing, and it can be debugged with 'sftunnel status' and by examining /var/log/sftunnel.log on the FTD.

Exam trap

The trap is assuming registration uses HTTPS/REST (TCP 443) because FMC's UI is web-based — candidates pick the REST API option, missing that FTD registration specifically uses the sftunnel on TCP 8305.

How to eliminate wrong answers

Option B is wrong because while FMC uses HTTPS (TCP 443) for its web UI and some REST API calls, device registration itself is carried over the sftunnel, not the REST API, and 'debug rest-api' is not the relevant troubleshooting command. Option C is wrong because SNMP is used for monitoring and traps, not for FTD registration — SNMP failures would not produce a registration key mismatch error. Option D is wrong because SSH (TCP 22) is used for CLI access to the FTD, not for FMC-FTD management registration; the sftunnel is a separate, dedicated channel on TCP 8305.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Management And Troubleshooting questions.

Start 20-question session