Cisco 300-710 Online Practice Questions and Exam Preparation

Cisco 300-710 Online Questions & Answers

• Question 221:

  An engineer must deploy a Cisco FTD device. Management wants to examine traffic without requiring network changes that will disrupt end users. Corporate security policy requires the separation of management traffic from data traffic and the use of SSH over Telnet for remote administration. How must the device be deployed to meet these requirements?

  A. in routed mode with a diagnostic interface
  B. in transparent mode with a management Interface
  C. in transparent made with a data interface
  D. in routed mode with a bridge virtual interface
  B. in transparent mode with a management Interface

  ---

  To deploy a Cisco FTD device that meets the requirements of the question, the engineer must use transparent mode with a management interface. Transparent mode is a firewall configuration in which the FTD device acts as a "bump in the wire" or a "stealth firewall" and is not seen as a router hop to connected devices. In transparent mode, the FTD device can examine traffic without requiring network changes that will disrupt end users, such as changing IP addresses or routing configurations1. A management interface is a dedicated interface that is used for managing the FTD device and separating management traffic from data traffic. A management interface can be configured to allow SSH access for remote administration, which is more secure than Telnet2. The other options are incorrect because: Routed mode is a firewall configuration in which the FTD device acts as a router and performs address translation and routing for connected networks. Routed mode requires network changes that may disrupt end users, such as changing IP addresses or routing configurations1. A diagnostic interface is a special interface that is used for troubleshooting and capturing traffic on the FTD device. A diagnostic interface does not separate management traffic from data traffic or allow SSH access for remote administration. Transparent mode with a data interface does not meet the requirement of separating management traffic from data traffic. A data interface is a regular interface that is used for passing and inspecting traffic on the FTD device. A data interface does not allow SSH access for remote administration2. Routed mode with a bridge virtual interface (BVI) does not meet the requirement of examining traffic without requiring network changes that will disrupt end users. A BVI is a logical interface that acts as a container for one or more physical or logical interfaces that belong to the same layer 2 broadcast domain. A BVI allows the FTD device to route between different bridge groups on the same security module/engine. However, routed mode still requires network changes that may disrupt end users, such as changing IP addresses or routing configurations.

• Question 222:

  When an engineer captures traffic on a Cisco FTD to troubleshoot a connectivity problem, they receive a large amount of output data in the GUI tool. The engineer found that viewing the Captures this way is time-consuming and difficult lo son and filter. Which file type must the engineer export the data in so that it can be reviewed using a tool built for this type of analysis?

  A. NetFlow v9
  B. PCAP
  C. NetFlow v5
  D. IPFIX
  B. PCAP

  ---

  When capturing traffic on a Cisco FTD device to troubleshoot a connectivity problem, a file type that can be exported for reviewing using a tool built for this type of analysis is PCAP. PCAP stands for Packet Capture and it is a file format used to store network packet data captured from a network interface8. PCAP files contain the raw data of network packets, including the headers and payloads of each packet8. PCAP files are widely used in network analysis and troubleshooting tasks. They enable network administrators, analysts, and researchers to inspect and analyze network traffic for various purposes, such as diagnosing network issues, detecting malicious activity, measuring network performance, and understanding network protocols8. PCAP files can be read by applications that understand that format, such as Wireshark, tcpdump, CA NetMaster, or Microsoft Network Monitor8. The other options are incorrect because: NetFlow v9 is not a file type, but a protocol for collecting and exporting information about network flows. A network flow is a sequence of packets that share common attributes such as source and destination IP addresses, ports, and protocols9. NetFlow v9 records contain summary information about network flows, such as start and end times, byte counts, packet counts, and so on9. NetFlow v9 records do not contain the raw data of network packets. NetFlow v5 is not a file type, but an earlier version of the NetFlow protocol for collecting and exporting information about network flows. NetFlow v5 records contain similar information as NetFlow v9 records, but with fewer fields and less flexibility10. NetFlow v5 records do not contain the raw data of network packets. IPFIX is not a file type, but a protocol for collecting and exporting information about network flows. IPFIX stands for IP Flow Information Export and it is based on NetFlow v9, but with some extensions and improvements11. IPFIX records contain similar information as NetFlow v9 records, but with more fields and more flexibility11. IPFIX records do not contain the raw data of network packets.

• Question 223:

  A network administrator is implementing an active/passive high availability Cisco FTD pair. When adding the high availability pair, the administrator cannot select the secondary peer. What is the cause?

  A. The second Cisco FTD is not the same model as the primary Cisco FTD.
  B. An high availability license must be added to the Cisco FMC before adding the high availability pair.
  C. The failover link must be defined on each Cisco FTD before adding the high availability pair.
  D. Both Cisco FTD devices are not at the same software version.
  A. The second Cisco FTD is not the same model as the primary Cisco FTD.

• Question 224:

  Which two solutions are used to access and view aggregated log data from the firewalls using Cisco Security Analytics and Logging? (Choose two.)

  A. Cisco Secure Network Analytics
  B. Cisco Defense Orchestrator
  C. Cisco Catalyst Center
  D. Secure Cloud Analytics
  E. Cisco Prime Infrastructure
  A. Cisco Secure Network Analytics
  D. Secure Cloud Analytics

• Question 225:

  An administrator is optimizing the Cisco FTD rules to improve network performance, and wants to bypass inspection for certain traffic types to reduce the load on the Cisco FTD. Which policy must be configured to accomplish this goal?

  A. intrusion
  B. prefilter
  C. URL filtering
  D. identity
  B. prefilter

• Question 226:

  An engineer is deploying a Cisco Secure Firewall Management Center appliance. The company must send data to Cisco Secure Network Analytics appliances. Which two actions must the engineer take? (Choose two.)

  A. Create a service identifier to enable the NetFlow service.
  B. Add the Netflow_Send_Destination object to the configuration.
  C. Add the Netflow_Set_Parameters object to the configuration.
  D. Add the Netflow_Add_Destination object to the configuration.
  E. Security Intelligence object to send data to Cisco Secure Network Analytics
  C. Add the Netflow_Set_Parameters object to the configuration.
  D. Add the Netflow_Add_Destination object to the configuration.

  ---

  Explanation Explanation/Reference:

• Question 227:

  An engineer is configuring a second Cisco FMC as a standby device but is unable to register with the active unit. What is causing this issue?

  A. The primary FMC currently has devices connected to it.
  B. The code versions running on the Cisco FMC devices are different.
  C. The licensing purchased does not include high availability
  D. There is only 10Mbps of bandwidth between the two devices.
  B. The code versions running on the Cisco FMC devices are different.

  ---

  https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/firepower_management_center_high_availability.html

• Question 228:

  A network administrator is migrating from a Cisco ASA to a Cisco FTD. EIGRP is configured on the Cisco ASA but it is not available in the Cisco FMC. Which action must the administrator take to enable this feature on the Cisco FTD?

  A. Configure EIGRP parameters using FlexConfig objects.
  B. Add the command feature eigrp via the FTD CLI.
  C. Create a custom variable set and enable the feature in the variable set.
  D. Enable advanced configuration options in the FMC.
  A. Configure EIGRP parameters using FlexConfig objects.

  ---

  https://community.cisco.com/t5/network-security/adding-eigrp-to-ftd-using-fmc/td-p/4284529

• Question 229:

  An organization is using a Cisco FTD and Cisco ISE to perform identity-based access controls. A network administrator is analyzing the Cisco FTD events and notices that unknown user traffic is being allowed through the firewall. How should this be addressed to block the traffic while allowing legitimate user traffic?

  A. Modify the Cisco ISE authorization policy to deny this access to the user
  B. Modify Cisco ISE to send only legitimate usernames to the Cisco FTD
  C. Add the unknown user in the Access Control Policy in Cisco FTD
  D. Add the unknown user in the Malware and File Policy in Cisco FTD
  C. Add the unknown user in the Access Control Policy in Cisco FTD

  ---

  https://www.cisco.com/c/en/us/td/docs/security/firepower/640/fdm/fptd-fdm-config-guide-640/fptd-fdm-identity.html#concept_655B055575E04CA49B10186DEBDA301A

• Question 230:

  A VPN user is unable to conned lo web resources behind the Cisco FTD device terminating the connection. While troubleshooting, the network administrator determines that the DNS responses are not getting through the Cisco FTD What must be done to address this issue while still utilizing Snort IPS rules?

  A. Uncheck the "Drop when Inline" box in the intrusion policy to allow the traffic.
  B. Modify the Snort rules to allow legitimate DNS traffic to the VPN users.
  C. Disable the intrusion rule threshes to optimize the Snort processing.
  D. Decrypt the packet after the VPN flow so the DNS queries are not inspected
  B. Modify the Snort rules to allow legitimate DNS traffic to the VPN users.