Cisco 300-710 Online Practice Questions and Exam Preparation

Cisco 300-710 Online Questions & Answers

• Question 161:

  Which command should be used on the Cisco FTD CLI to capture all the packets that hit an interface?

  A. configure coredump packet-engine enable
  B. capture-traffic
  C. capture
  D. capture WORD
  C. capture

• Question 162:

  An administrator receives reports that users cannot access a cloud-hosted web server. The access control policy was recently updated with several new policy additions and URL filtering. What must be done to troubleshoot the issue and restore access without sacrificing the organization's security posture?

  A. Download a PCAP of the traffic to verify the blocks and use the FlexConfig to override the existing policy.
  B. Review the output in connection events to validate the block, and modify the policy to allow the traffic.
  C. Create a new access control policy rule to allow ports 80 and 443 to the FQDN of the web server.
  D. Verify the blocks using the packet capture tool and create a rule with the action monitor for the traffic.
  B. Review the output in connection events to validate the block, and modify the policy to allow the traffic.

• Question 163:

  After using Firepower for some time and learning about how it interacts with the network, an administrator is trying to correlate malicious activity with a user. Which widget should be configured to provide this visibility on the Cisco Firepower Dashboards?

  A. Custom analysis.
  B. Current Status
  C. Current Sessions
  D. Correlation Events
  D. Correlation Events

• Question 164:

  A network engineer is planning on replacing an Active/Standby pair of physical Cisco Secure Firewall ASAs with a pair of Cisco Secure Firewall Threat Defense Virtual appliances. Which two virtual environments support the current High Availability configuration? (Choose two.)

  A. ESXi
  B. Azure
  C. Openstack
  D. KVM
  E. AWS
  A. ESXi
  D. KVM

• Question 165:

  A network administrator wants to configure a Cisco Secure Firewall Threat Defense instance managed by Cisco Secure Firewall Management Center to block traffic to known cryptomining networks. Which system settings must the administrator configure in Secure Firewall Management Center to meet the requirement?

  A. Intrusion Policy, Security Intelligence
  B. Access Policy, Security Intelligence
  C. Malware Policy, Rules
  D. Access Policy, Rules
  B. Access Policy, Security Intelligence

  ---

  To block traffic to known cryptomining networks using Cisco Secure Firewall Threat Defense (FTD) managed by Cisco Secure Firewall Management Center (FMC), the network administrator needs to configure Security Intelligence in an Access Control Policy. Security Intelligence allows administrators to block traffic based on threat intelligence feeds, which include known malicious IP addresses, domains, and URLs. Steps: Navigate to Policies > Access Control > Access Control Policy in FMC. Edit or create an Access Control Policy. Go to the Security Intelligence tab. Enable the relevant threat intelligence feeds that include cryptomining networks. Apply the policy to the FTD device. This configuration ensures that traffic to known cryptomining networks is blocked, enhancing the network's security posture against cryptomining threats. References: Cisco Secure Firewall Management Center Configuration Guide, Chapter on Security Intelligence.

• Question 166:

  A security engineer sees an alert on Cisco Secure Endpoint console showing a malicious verdict for a file with the SHA-256 hash 0488537078abcdef048853abcdef048853abcdef048853abcdef048853abcdef048853. Which step will mitigate this threat?

  A. Add the hash to network block list.
  B. Quarantine the file on endpoint.
  C. Add the hash to custom detection list.
  D. Enable firewall on infected endpoint.
  B. Quarantine the file on endpoint.

  ---

  In Cisco Secure Endpoint, when a file is identified with a malicious verdict, the immediate and effective step to mitigate the threat on the affected endpoint is to quarantine the file. Quarantining isolates the malicious file, preventing it from executing or spreading on the system. By quarantining, the security engineer ensures the file is moved to a secure location, rendering it inert. This action is crucial for containing and neutralizing threats directly on the endpoint.

• Question 167:

  

  Refer to the exhibit. An engineer analyzes a Cisco Firepower Management Center dashboard. Which action must be taken by the user to decrease the risk of data loss?

  A. Stop all URLs that have an unknown reputation.
  B. Block the use of Dropbox.
  C. Stop all the URLs that are uncategorized.
  D. Block all the BitTorrent applications.
  C. Stop all the URLs that are uncategorized.

• Question 168:

  An administrator is configuring a new report template off. of a saved search within Cisco Secure Firewall Management Centre. The goal is to use the malware analysis report template, but use a different type saved search as the basis. The report is not working.

  What must be considered when configuring this report template?

  A. Saved searches can be used for the same report template only
  B. Saved searches are available freely for all report templates within the same domain.
  C. Saved searches from a different report template must be used.
  D. Saved searches must be renamed before using for different report template.
  A. Saved searches can be used for the same report template only

  ---

  When configuring a new report template based on a saved search in Cisco Secure Firewall Management Center (FMC), it is important to note that saved searches are specific to the report template they were created with. Saved searches cannot be freely used across different report templates. To use a different type of saved search, you must ensure that it aligns with the specific report template being used. This restriction ensures that the saved search parameters match the report's data requirements. References: Cisco Secure Firewall Management Center Administrator Guide, Chapter on Reporting and Saved Searches.

• Question 169:

  An engineer is troubleshooting an intermittent connectivity issue on a Cisco Secure Firewall Threat Defense appliance and must collect 24 hours' worth of data. The engineer started a packet capture, however it stops prematurely during this time period. The engineer notices that the packet capture buffer size is set to the default of 32 MB. Which buffer size is the maximum that the engineer must set to enable the packet capture to run successfully?

  A. 64 MB
  B. 1 GB
  C. 10 GB
  D. 100 GB
  C. 10 GB

• Question 170:

  Which description of a correlation policy configuration in the Cisco Firepower Management Center is true?

  A. The system displays correlation policies that are created on all of the domains in a multidomain deployment
  B. Deleting a response group deletes the responses of that group
  C. You cannot add a host profile qualification to a correlation rule that is triggered by a malware event
  D. Correlation policy priorities override whitelist priorities
  C. You cannot add a host profile qualification to a correlation rule that is triggered by a malware event