Cisco CCNP 300-710 Questions & Answers

• Question 1:

  DRAG DROP

  Drag and drop the configuration steps from the left into the sequence on the right to enable external authentication on Cisco FMC to a RADIUS server.

  Select and Place:

  

  Correct Answer:

  

• Question 2:

  A network engineer sets up a secondary Cisco FMC that is integrated with Cisco Security Packet Analyzer. What occurs when the secondary Cisco FMC synchronizes with the primary Cisco FMC?

  A. The existing configuration for integration of the secondary Cisco FMC the Cisco Security Packet Analyzer is overwritten.

  B. The synchronization between the primary and secondary Cisco FMC fails.

  C. The existing integration configuration is replicated to the primary Cisco FMC.

  D. The secondary Cisco FMC must be reintegrated with the Cisco Security Packet Analyzer after the synchronization.

  Correct Answer: A

• Question 3:

  An engineer is working on a LAN switch and has noticed that its network connection to the inline Cisco IPS has gone down. Upon troubleshooting, it is determined that the switch is working as expected. What must have been implemented for this failure to occur?

  A. The upstream router has a misconfigured routing protocol.

  B. Link-state propagation is enabled.

  C. The Cisco IPS has been configured to be in fail-open mode.

  D. The Cisco IPS is configured in detection mode.

  Correct Answer: D

• Question 4:

  What is the role of the casebook feature in Cisco Threat Response?

  A. pulling data via the browser extension

  B. alert prioritization

  C. sharing threat analysis

  D. triage automation with alerting

  Correct Answer: C

  The casebook and pivot menu are widgets available in Cisco Threat Response. Casebook

  - It is used to record, organize, and share sets of observables of interest primarily during an investigation and threat analysis. You can use a casebook to get the current verdicts or dispositions on the observables. https://www.cisco.com/c/en/us/td/docs/security/ces/user_guide/esa_user_guide_13- 5-1/b_ESA_Admin_Guide_ces_13-5-1/b_ESA_Admin_Guide_13- 0_chapter_0110001.pdf

• Question 5:

  Upon detecting a flagrant threat on an endpoint, which two technologies instruct Cisco Identity Services Engine to contain the infected endpoint either manually or automatically? (Choose two.)

  A. Cisco ASA 5500 Series

  B. Cisco FMC

  C. Cisco AMP

  D. Cisco Stealthwatch

  E. Cisco ASR 7200 Series

  Correct Answer: CD

• Question 6:

  A security engineer is configuring an Access Control Policy for multiple branch locations. These locations share a common rule set and utilize a network object called INSIDE_NET which contains the locally significant internal network subnets at each location.

  Which technique will retain the policy consistency at each location but allow only the locally significant network subnet within the applicable rules?

  A. utilizing a dynamic Access Control Policy that updates from Cisco Talos

  B. utilizing policy inheritance

  C. creating a unique Access Control Policy per device

  D. creating an Access Control Policy with an INSIDE_NET network object and object overrides

  Correct Answer: D

• Question 7:

  An organization is migrating their Cisco ASA devices running in multicontext mode to Cisco FTD devices.

  Which action must be taken to ensure that each context on the Cisco ASA is logically separated in the Cisco FTD devices?

  A. Add a native instance to distribute traffic to each Cisco FTD context.

  B. Add the Cisco FTD device to the Cisco ASA port channels.

  C. Configure a container instance in the Cisco FTD for each context in the Cisco ASA.

  D. Configure the Cisco FTD to use port channels spanning multiple networks.

  Correct Answer: C

• Question 8:

  A network administrator configured a NAT policy that translates a public IP address to an internal web server IP address. An access policy has also been created that allows any source to reach the public IP address on port 80. The web server is still not reachable from the Internet on port 80.

  Which configuration change is needed?

  A. The intrusion policy must be disabled for port 80.

  B. The access policy rule must be configured for the action trust.

  C. The NAT policy must be modified to translate the source IP address as well as destination IP address.

  D. The access policy must allow traffic to the internal web server IP address.

  Correct Answer: D

• Question 9:

  An engineer is configuring Cisco FMC and wants to limit the time allowed for processing packets through the interface. However, if the time is exceeded, the configuration must allow packets to bypass detection. What must be configured on the Cisco FMC to accomplish this task?

  A. Cisco ISE Security Group Tag

  B. Automatic Application Bypass

  C. Inspect Local Traffic Bypass

  D. Fast-Path Rules Bypass

  Correct Answer: B

• Question 10:

  An engineer must define a URL object on Cisco FMC.

  What is the correct method to specify the URL without performing SSL inspection?

  A. Use Subject Common Name value.

  B. Specify all subdomains in the object group.

  C. Specify the protocol in the object.

  D. Include all URLs from CRL Distribution Points.

  Correct Answer: B