Cisco 300-710 Online Practice Questions and Exam Preparation

Cisco 300-710 Online Questions & Answers

• Question 281:

  An engineer must export a packet capture from Cisco Secure Firewall Management Center to assist in troubleshooting an issue on a Secure Firewall Threat Defense device. When the engineer navigates to the URL for Secure Firewall Management Center at:

  https:///capture/CAPI/pcap/sample.pcap

  The engineer receives a 403: Forbidden error instead of being provided with the PCAP file. Which action resolves the issue?

  A. Disable the proxy setting on the client browser.
  B. Disable the HTTPS server and use HTTP.
  C. Enable HTTPS in the device platform policy.
  D. Enable the proxy setting in the device platform policy.
  C. Enable HTTPS in the device platform policy.

  ---

  If an engineer receives a 403: Forbidden error when attempting to download a packet capture file from Cisco Secure Firewall Management Center (FMC), the issue is likely due to HTTPS not being enabled in the device platform policy. To resolve this issue, the engineer must enable HTTPS in the platform policy. Steps: In FMC, navigate to Policies > Device Management > Platform Settings. Edit the relevant platform policy. Enable HTTPS for the device. Deploy the changes to the FTD device. This ensures that the FMC and FTD device can securely transfer the packet capture file over HTTPS, resolving the 403 error. References: Cisco Secure Firewall Management Center Administrator Guide, Chapter on Platform Settings and HTTPS Configuration.

• Question 282:

  Which rule action is only available in Snort 3?

  A. Pass
  B. Generate
  C. Alert
  D. Rewrite
  C. Alert

• Question 283:

  A security engineer is deploying Cisco Secure Endpoint to detect a zero day malware attack with an SHA-256 hash of 47ea931f3e9dc23ec0b0885a80663e30ea013d493f8e88224b570a0464084628. What must be configured in Cisco Secure Endpoint to enable the application to take action based on this hash?

  A. access control rule
  B. correlation policy
  C. transform set
  D. custom detection list
  D. custom detection list

• Question 284:

  A network engineer wants to disable the HTTP response page and interactive blocking of the entire access control policy in Cisco Secure Firewall Management Center. What must be selected in Block Response Page and Interactive Block Response Page?

  A. Custom
  B. View
  C. System
  D. None
  D. None

• Question 285:

  Refer to the exhibit.

  

  An administrator is looking at some of the reporting capabilities for Cisco Firepower and noticed this section of the Network Risk Report showing a lot of SSL activity that could be used for evasion. Which action will mitigate this risk?

  A. Use SSL decryption to analyze the packets.
  B. Use Cisco Tetration to track SSL connections to servers.
  C. Use encrypted traffic analytics to detect attacks.
  D. Use Cisco AMP for Endpoints to block all SSL connection.
  A. Use SSL decryption to analyze the packets.

  ---

  Explanation Explanation/Reference:https://www.cisco.com/c/en/us/td/docs/security/firepower/623/fdm/fptd-fdm-config-guide-623/fptd-fdm-ssl-decryption.html

• Question 286:

  An engineer is configuring URL filtering for a Cisco FTD device in Cisco FMC. Users must receive a warning when they access http://www.badadultsite.com with the option of continuing to the website if they choose to. No other websites should be blocked. Which two actions must the engineer take to meet these requirements? (Choose two.)

  A. On the HTTP Responses tab of the access control policy editor, set the Block Response Page to Custom.
  B. On the HTTP Responses tab of the access control policy editor, set the Interactive Block Response Page to System-provided.
  C. Configure the default action for the access control policy to Interactive Block.
  D. Configure an access control rule that matches the Adult URL category and set the action to Interactive Block.
  E. Configure an access control rule that matches an URL object for http://www.badadultsite.com/ and set the action to Interactive Block.
  B. On the HTTP Responses tab of the access control policy editor, set the Interactive Block Response Page to System-provided.
  E. Configure an access control rule that matches an URL object for http://www.badadultsite.com/ and set the action to Interactive Block.

  ---

  To configure URL filtering for a Cisco FTD device in Cisco FMC, and to meet the requirements of the question, the engineer must do the following: On the HTTP Responses tab of the access control policy editor, set the Interactive Block Response Page to system-provided. This will enable the system to display a warning page to the users when they try to access a blocked URL, and give them the option to continue or cancel. The system-provided page is a default page that contains a generic message and a logo1. Configure an access control rule that matches an URL object for http://www.badadultsite.com; and set the action to Interactive Block. This will apply the interactive block action to the specific URL that is defined in the URL object. The interactive block action will trigger the interactive block response page that was configured in the previous step1. The other options are incorrect because: On the HTTP Responses tab of the access control policy editor, setting the Block Response Page to Custom will not affect the interactive block action. The block response page is used when the action is set to Block, not Interactive Block1. Configuring the default action for the access control policy to Interactive Block will apply the interactive block action to all URLs that are not matched by any access control rule. This will not meet the requirement of blocking no other websites1. Configuring an access control rule that matches the Adult URL category and sets the action to Interactive Block will apply the interactive block action to all URLs that belong to the Adult category. This will not meet the requirement of blocking only http://www.badadultsite.com1.

• Question 287:

  The security engineer reviews the syslog server events of an organization and sees many outbound connections to malicious sites initiated from hosts running Cisco Secure Endpoint. The hosts are on a separate network from the Cisco FTD device. Which action blocks the connections?

  A. Modify the policy on Cisco Secure Endpoint to enable DFC.
  B. Modify the access control policy on the Cisco FMC to block malicious outbound connections
  C. Add the IP addresses of the malicious sites to the access control policy on the Cisco FMC
  D. Add a Cisco Secure Endpoint policy with the Tetra and Spero engines enabled
  A. Modify the policy on Cisco Secure Endpoint to enable DFC.

• Question 288:

  An organization has a Cisco IPS running in inline mode and is inspecting traffic for malicious activity. When traffic is received by the Cisco IRS, if it is not dropped, how does the traffic get to its destination?

  A. It is retransmitted from the Cisco IPS inline set.
  B. The packets are duplicated and a copy is sent to the destination.
  C. It is transmitted out of the Cisco IPS outside interface.
  D. It is routed back to the Cisco ASA interfaces for transmission.
  A. It is retransmitted from the Cisco IPS inline set.

• Question 289:

  A network engineer is configuring URL Filtering on Firepower Threat Defense. Which two port requirements on the Firepower Management Center must be validated to allow communication with the cloud service? (Choose two.)

  A. outbound port TCP/443
  B. inbound port TCP/80
  C. outbound port TCP/8080
  D. inbound port TCP/443
  E. outbound port TCP/80
  A. outbound port TCP/443
  E. outbound port TCP/80

  ---

  Explanation Explanation/Reference:https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Security__Internet_Access__and_Communication_Ports.html

• Question 290:

  An analyst is investigating a potentially compromised endpoint within the network and pulls a host report for the endpoint in question to collect metrics and documentation. What information should be taken from this report for the investigation?

  A. client applications by user, web applications, and user connections
  B. number of attacked machines, sources of the attack, and traffic patterns
  C. threat detections over time and application protocols transferring malware
  D. intrusion events, host connections, and user sessions
  D. intrusion events, host connections, and user sessions