Securing Networks with Cisco Firepower (SNCF) 300-710 Practice Exam

test2022-07-08T06:40:49+00:00

The Cisco 300-710 SNCF exam is one of the required exam in order to obtain the CCNP Security credential, as well as a core exam 350-701. We supply our customers with the most up-to-date 300-710 Practice Exam and the most accurate study materials. Our professionals have created a series of 300-710 Practice Exam for candidates who want to ensure that they receive the maximum possible score on the actual exam. By completing them, you can ensure that you have a firm grip on the syllabus content, which increases your confidence to help you complete the test within the time limit. 300-710 Practice Exam is designed to be beneficial in ensuring memorable success in the 300-710 exam.

Now is the time to try free 300-710 practice exam!

Page 1 of 6

1. Which two routing options are valid with Cisco Firepower Threat Defense? (Choose two.)

BGPv6

ECMP with up to three equal cost paths across multiple interfaces

ECMP with up to three equal cost paths across a single interface

BGPv4 in transparent firewall mode

BGPv4 with nonstop forwarding

2. An engineer is using the configure manager add <FMC IP> Cisc402098527 command to add a new Cisco FTD device to the Cisco FMC; however, the device is not being added.

Why Is this occurring?

The NAT ID is required since the Cisco FMC is behind a NAT device.

The IP address used should be that of the Cisco FT

not the Cisco FM

DONOTRESOLVE must be added to the command

The registration key is missing from the command

3. Which Cisco Firepower Threat Defense, which two interface settings are required when configuring a routed interface? (Choose two.)

Redundant Interface

EtherChannel

Speed

Media Type

Duplex

4. A network administrator is concerned about (he high number of malware files affecting users' machines.

What must be done within the access control policy in Cisco FMC to address this concern?

Create an intrusion policy and set the access control policy to block.

Create an intrusion policy and set the access control policy to allow.

Create a file policy and set the access control policy to allow.

Create a file policy and set the access control policy to block.

5. In which two places can thresholding settings be configured? (Choose two.)

on each IPS rule

globally, within the network analysis policy

globally, per intrusion policy

on each access control rule

per preprocessor, within the network analysis policy

6. An engineer has been tasked with using Cisco FMC to determine if files being sent through the network are malware.

Which two configuration takes must be performed to achieve this file lookup? (Choose two.)

The Cisco FMC needs to include a SSL decryption policy.

The Cisco FMC needs to connect to the Cisco AMP for Endpoints service.

The Cisco FMC needs to connect to the Cisco ThreatGrid service directly for sandboxing.

The Cisco FMC needs to connect with the FireAMP Cloud.

The Cisco FMC needs to include a file inspection policy for malware lookup.

7. Refer to the exhibit.

A systems administrator conducts a connectivity test to their SCCM server from a host machine and gets no response from the server.

Which action ensures that the ping packets reach the destination and that the host receives replies?

Create an access control policy rule that allows ICMP traffic.

Configure a custom Snort signature to allow ICMP traffic after Inspection.

Modify the Snort rules to allow ICMP traffic.

Create an ICMP allow list and add the ICMP destination to remove it from the implicit deny list.

8. An engineer has been tasked with providing disaster recovery for an organization's primary Cisco FMC.

What must be done on the primary and secondary Cisco FMCs to ensure that a copy of the original corporate policy is available if the primary Cisco FMC fails?

Configure high-availability in both the primary and secondary Cisco FMCs

Connect the primary and secondary Cisco FMC devices with Category 6 cables of not more than 10 meters in length.

Place the active Cisco FMC device on the same trusted management network as the standby device

Restore the primary Cisco FMC backup configuration to the secondary Cisco FMC device when the primary device fails

9. An administrator is configuring their transparent Cisco FTD device to receive ERSPAN traffic from multiple switches on a passive port, but the Cisco FTD is not processing the traffic.

What is the problem?

The switches do not have Layer 3 connectivity to the FTD device for GRE traffic transmission.

The switches were not set up with a monitor session ID that matches the flow ID defined on the Cisco FT

The Cisco FTD must be in routed mode to process ERSPAN traffic.

The Cisco FTD must be configured with an ERSPAN port not a passive port.

10. Upon detecting a flagrant threat on an endpoint, which two technologies instruct Cisco Identity Services Engine to contain the infected endpoint either manually or automatically? (Choose two.)

Cisco ASA 5500 Series

Cisco FMC

Cisco AMP

Cisco Stealthwatch

Cisco ASR 7200 Series

Page 2 of 6

11. An organization wants to secure traffic from their branch office to the headquarter building using Cisco Firepower devices. They want to ensure that their Cisco Firepower devices are not wasting resources on inspecting the VPN traffic.

What must be done to meet these requirements?

Configure the Cisco Firepower devices to ignore the VPN traffic using prefilter policies

Enable a flexconfig policy to re-classify VPN traffic so that it no longer appears as interesting traffic

Configure the Cisco Firepower devices to bypass the access control policies for VPN traffic.

Tune the intrusion policies in order to allow the VPN traffic through without inspection

12. A network engineer wants to add a third-party threat feed into the Cisco FMC for enhanced threat detection.

Which action should be taken to accomplish this goal?

Enable Threat Intelligence Director using STIX and TAXII

Enable Rapid Threat Containment using REST APIs

Enable Threat Intelligence Director using REST APIs

Enable Rapid Threat Containment using STIX and TAXII

13. A network administrator notices that remote access VPN users are not reachable from inside the network. It is determined that routing is configured correctly, however return traffic is entering the firewall but not leaving it.

What is the reason for this issue?

A manual NAT exemption rule does not exist at the top of the NAT table.

An external NAT IP address is not configured.

An external NAT IP address is configured to match the wrong interface.

An object NAT exemption rule does not exist at the top of the NAT table.

14. Which policy rule is included in the deployment of a local DMZ during the initial deployment of a Cisco NGFW through the Cisco FMC GUI?

a default DMZ policy for which only a user can change the IP addresses.

deny ip any

no policy rule is included

permit ip any

15. Which two considerations must be made when deleting and re-adding devices while managing them via Cisco FMC (Choose two).

Before re-adding the device In Cisco FMC, the manager must be added back.

The Cisco FMC web interface prompts users to re-apply access control policies.

Once a device has been deleted, It must be reconfigured before it is re-added to the Cisco FM

An option to re-apply NAT and VPN policies during registration is available, so users do not need to re-apply the polices after registration is completed.

There is no option to re-apply NAT and VPN policies during registration is available, so users need to re-apply the policies after registration is completed.

16. Within Cisco Firepower Management Center, where does a user add or modify widgets?

dashboard

reporting

context explorer

summary tool

17. A security engineer must configure a Cisco FTD appliance to inspect traffic coming from the internet. The Internet traffic will be mirrored from the Cisco Catalyst 9300 Switch.

Which configuration accomplishes the task?

Set interface configuration mode to none.

Set the firewall mode to transparent.

Set the firewall mode to routed.

Set interface configuration mode to passive.

18. Which two features of Cisco AMP for Endpoints allow for an uploaded file to be blocked? (Choose two.)

application blocking

simple custom detection

file repository

exclusions

application whitelisting

19. An analyst is investigating a potentially compromised endpoint within the network and pulls a host report for the endpoint in question to collect metrics and documentation.

What information should be taken from this report for the investigation?

client applications by user, web applications, and user connections

number of attacked machines, sources of the attack, and traffic patterns

intrusion events, host connections, and user sessions

threat detections over time and application protocols transferring malware

20. administrator is configuring SNORT inspection policies and is seeing failed deployment messages in Cisco FMC.

What information should the administrator generate for Cisco TAC to help troubleshoot?

A Troubleshoot" file for the device in question.

A "show tech" file for the device in question

A "show tech" for the Cisco FM

A "troubleshoot" file for the Cisco FMC

Page 3 of 6

21. A network administrator has converted a Cisco FTD from using LDAP to LDAPS for VPN authentication. The Cisco FMC can connect to the LDAPS server, but the Cisco FTD is not connecting.

Which configuration must be enabled on the Cisco FTD?

SSL must be set to a use TLSv1.2 or lower.

The LDAPS must be allowed through the access control policy.

DNS servers must be defined for name resolution.

The RADIUS server must be defined.

22. An organization does not want to use the default Cisco Firepower block page when blocking HTTP traffic. The organization wants to include information about its policies and procedures to help educate the users whenever a block occurs.

Which two steps must be taken to meet these requirements? (Choose two.)

Modify the system-provided block page result using Python.

Create HTML code with the information for the policies and procedures.

Edit the HTTP request handling in the access control policy to customized block.

Write CSS code with the information for the policies and procedures.

Change the HTTP response in the access control policy to custom.

23. Which CLI command is used to generate firewall debug messages on a Cisco Firepower?

system support firewall-engine-debug

system support ssl-debug

system support platform

system support dump-table

24. Refer to the exhibit.

An engineer is modifying an access control pokey to add a rule to inspect all DNS traffic that passes through the firewall After making the change and deploying the pokey they see that DNS traffic is not bang inspected by the Snort engine.

What is the problem?

The rule must specify the security zone that originates the traffic

The rule must define the source network for inspection as well as the port

The action of the rule is set to trust instead of allow.

The rule is configured with the wrong setting for the source port

25. Which CLI command is used to control special handling of ClientHello messages?

system support ssl-client-hello-tuning

system support ssl-client-hello-display

system support ssl-client-hello-force-reset

system support ssl-client-hello-enabled

26. An organization is migrating their Cisco ASA devices running in multicontext mode to Cisco FTD devices.

Which action must be taken to ensure that each context on the Cisco ASA is logically separated in the Cisco FTD devices?

Add a native instance to distribute traffic to each Cisco FTD context.

Add the Cisco FTD device to the Cisco ASA port channels.

Configure a container instance in the Cisco FTD for each context in the Cisco AS

Configure the Cisco FTD to use port channels spanning multiple networks.

27. A company wants a solution to aggregate the capacity of two Cisco FTD devices to make the best use of resources such as bandwidth and connections per second.

Which order of steps must be taken across the Cisco FTDs with Cisco FMC to meet this requirement?

Configure the Cisco FTD interfaces, add members to FMC, configure cluster members in FMC, and create cluster in Cisco FM

Add members to Cisco FMC, configure Cisco FTD interfaces in Cisco FM

configure cluster members in Cisco FMC, create cluster in Cisco FM

and configure cluster members in Cisco FM

Configure the Cisco FTD interfaces and cluster members, add members to Cisco FM

and create the cluster in Cisco FM

Add members to the Cisco FMC, configure Cisco FTD interfaces, create the cluster in Cisco FMC, and configure cluster members in Cisco FM

28. An administrator is attempting to add a new FTD device to their FMC behind a NAT device with a NAT ID of NAT001 and a password of Cisco0420l06525. The private IP address of the FMC server is 192.168.45.45. which is being translated to the public IP address of 209.165.200.225/27.

Which command set must be used in order to accomplish this task?

configure manager add 209.165.200.225 <reg_key> <nat_id>

configure manager add 192.168.45,45 <reg_key> <nat_id>

configure manager add 209.165.200.225 255.255.255.224 <reg_key> <nat_id>

configure manager add 209.165.200.225/27 <reg_key> <nat_id>

29. A network administrator is configuring an FTD in transparent mode. A bridge group is set up and an access policy has been set up to allow all IP traffic. Traffic is not passing through the FTD.

What additional configuration is needed?

The security levels of the interfaces must be set.

A default route must be added to the FT

An IP address must be assigned to the BV

A mac-access control list must be added to allow all MAC addresses.

30. A hospital network needs to upgrade their Cisco FMC managed devices and needs to ensure that a disaster recovery process is in place.

What must be done in order to minimize downtime on the network?

Configure a second circuit to an ISP for added redundancy

Keep a copy of the current configuration to use as backup

Configure the Cisco FMCs for failover

Configure the Cisco FMC managed devices for clustering.

Page 4 of 6

31. Which interface type allows packets to be dropped?

passive

inline

ERSPAN

TAP

32. There is an increased amount of traffic on the network and for compliance reasons, management needs visibility into the encrypted traffic.

What is a result of enabling TLS'SSL decryption to allow this visibility?

It prompts the need for a corporate managed certificate

It has minimal performance impact

It is not subject to any Privacy regulations

It will fail if certificate pinning is not enforced

33. What are the minimum requirements to deploy a managed device inline?

inline interfaces, security zones, MTU, and mode

passive interface, MTU, and mode

inline interfaces, MTU, and mode

passive interface, security zone, MTU, and mode

34. Which two statements about deleting and re-adding a device to Cisco FMC are true? (Choose two.)

An option to re-apply NAT and VPN policies during registration is available, so users do not need to re-apply the policies after registration is completed.

Before re-adding the device in Cisco FMC, you must add the manager back in the device.

No option to delete and re-add a device is available in the Cisco FMC web interface.

The Cisco FMC web interface prompts users to re-apply access control policies.

No option to re-apply NAT and VPN policies during registration is available, so users need to re-apply the policies after registration is completed.

35. The CEO ask a network administrator to present to management a dashboard that shows custom analysis tables for the top DNS queries URL category statistics, and the URL reputation statistics.

Which action must the administrator take to quickly produce this information for management?

Run the Attack report and filter on DNS to show this information.

Create a new dashboard and add three custom analysis widgets that specify the tables needed.

Modify the Connection Events dashboard to display the information in a view for management.

Copy the intrusion events dashboard tab and modify each widget to show the correct charts.

36. An engineer is tasked with deploying an internal perimeter firewall that will support multiple DMZs Each DMZ has a unique private IP subnet range.

How is this requirement satisfied?

Deploy the firewall in transparent mode with access control policies.

Deploy the firewall in routed mode with access control policies.

Deploy the firewall in routed mode with NAT configured.

Deploy the firewall in transparent mode with NAT configured.

37. A network administrator notices that inspection has been interrupted on all non-managed interfaces of a device.

What is the cause of this?

The value of the highest MTU assigned to any non-management interface was changed.

The value of the highest MSS assigned to any non-management interface was changed.

A passive interface was associated with a security zone.

Multiple inline interface pairs were added to the same inline interface.

38. A network engineer must provide redundancy between two Cisco FTD devices. The redundancy configuration must include automatic configuration, translation, and connection updates.

After the initial configuration of the two appliances, which two steps must be taken to proceed with the redundancy configuration? (Choose two.)

Configure the virtual MAC address on the failover link.

Disable hellos on the inside interface.

Configure the standby IP addresses.

Ensure the high availability license is enabled.

Configure the failover link with stateful properties.

39. What is a behavior of a Cisco FMC database purge?

User login and history data are removed from the database if the User Activity check box is selected.

Data can be recovered from the device.

The appropriate process is restarted.

The specified data is removed from Cisco FMC and kept for two weeks.

40. Network traffic coining from an organization's CEO must never be denied.

Which access control policy configuration option should be used if the deployment engineer is not permitted to create a rule to allow all traffic?

Configure firewall bypass.

Change the intrusion policy from security to balance.

Configure a trust policy for the CE

Create a NAT policy just for the CE

Page 5 of 6

41. Refer to the exhibit.

An administrator is looking at some of the reporting capabilities for Cisco Firepower and noticed this section of the Network Risk report showing a lot of SSL activity that cloud be used for evasion.

Which action will mitigate this risk?

Use SSL decryption to analyze the packets.

Use encrypted traffic analytics to detect attacks

Use Cisco AMP for Endpoints to block all SSL connection

Use Cisco Tetration to track SSL connections to servers.

42. A network administrator is configuring Snort inspection policies and is seeing failed deployment messages in Cisco FMC.

What information should the administrator generate for Cisco TAC to help troubleshoot?

A "show tech" file for the device in question.

A "troubleshoot" file for the device in question.

A "troubleshoot" file for the Cisco FM

A "show tech" for the Cisco FM

43. What is an advantage of adding multiple inline interface pairs to the same inline interface set when deploying an asynchronous routing configuration?

Allows the IPS to identify inbound and outbound traffic as part of the same traffic flow.

The interfaces disable autonegotiation and interface speed is hard coded set to 1000 Mbps.

Allows traffic inspection to continue without interruption during the Snort process restart.

The interfaces are automatically configured as a media-independent interface crossover.

44. What is the maximum SHA level of filtering that Threat Intelligence Director supports?

SHA-1024

SHA-4096

SHA-512

SHA-256

45. The administrator notices that there is malware present with an .exe extension and needs to verify if any of the systems on the network are running the executable file.

What must be configured within Cisco AMP for Endpoints to show this data?

prevalence

threat root cause

vulnerable software

file analysis

46. An engainer must add DNS-specific rules to me Cisco FTD intrusion policy. The engineer wants to use the rules currently in the Cisco FTD Snort database that are not already enabled but does not want to enable more than are needed.

Which action meets these requirements?

Change the dynamic state of the rule within the policy.

Change the base policy to Security over Connectivity.

Change the rule state within the policy being used.

Change the rules using the Generate and Use Recommendations feature.

47. Which two packet captures does the FTD LINA engine support? (Choose two.)

Layer 7 network ID

source IP

application ID

dynamic firewall importing

protocol

48. Which CLI command is used to control special handling of clientHello messages?

system support ssl-client-hello-tuning

system support ssl-client-hello-display

system support ssl-client-hello-force-reset

system support ssl-client-hello-reset

49. An engineer must configure high availability for the Cisco Firepower devices. The current network topology does not allow for two devices to pass traffic concurrently.

How must the devices be implemented in this environment?

in active/active mode

in a cluster span EtherChannel

in active/passive mode

in cluster interface mode

50. What is the result of specifying of QoS rule that has a rate limit that is greater than the maximum throughput of an interface?

The rate-limiting rule is disabled.

Matching traffic is not rate limited.

The system rate-limits all traffic.

The system repeatedly generates warnings.

Page 6 of 6

51. After using Firepower for some time and learning about how it interacts with the network, an administrator is trying to correlate malicious activity with a user.

Which widget should be configured to provide this visibility on the Cisco Firepower dashboards?

Custom Analysis

Current Status

Current Sessions

Correlation Events

52. An engineer is troubleshooting a file that is being blocked by a Cisco FTD device on the network.

The user is reporting that the file is not malicious.

Which action does the engineer take to identify the file and validate whether or not it is malicious?

identify the file in the intrusion events and submit it to Threat Grid for analysis.

Use FMC file analysis to look for the file and select Analyze to determine its disposition.

Use the context explorer to find the file and download it to the local machine for investigation.

Right click the connection event and send the file to AMP for Endpoints to see if the hash is malicious.

53. What is the maximum bit size that Cisco FMC supports for HTTPS certificates?

1024

8192

4096

2048

54. A connectivity issue is occurring between a client and a server which are communicating through a Cisco Firepower device While troubleshooting, a network administrator sees that traffic is reaching the server, but the client is not getting a response.

Which step must be taken to resolve this issue without initiating traffic from the client?

Use packet-tracer to ensure that traffic is not being blocked by an access list.

Use packet capture to ensure that traffic is not being blocked by an access list.

Use packet capture to validate that the packet passes through the firewall and is NATed to the corrected IP address.

Use packet-tracer to validate that the packet passes through the firewall and is NATed to the corrected IP address.

55. Which report template field format is available in Cisco FMC?

box lever chart

arrow chart

bar chart

benchmark chart

56. What is the role of the casebook feature in Cisco Threat Response?

sharing threat analysts

pulling data via the browser extension

triage automaton with alerting

alert prioritization

57. What is the benefit of selecting the trace option for packet capture?

The option indicates whether the packet was dropped or successful.

The option indicated whether the destination host responds through a different path.

The option limits the number of packets that are captured.

The option captures details of each packet.