Cisco 300-710 Online Practice Questions and Exam Preparation

Cisco 300-710 Online Questions & Answers

• Question 301:

  An engineer runs the command restore remote-manager-backup location 2.2.2.2 admin /Volume/home/admin FTD408566513.zip on a Cisco FMC. After connecting to the repository, the Cisco FTD device is unable to accept the backup file. What is the reason for this failure?

  A. The backup file is not in .cfg format.
  B. The wrong IP address is used.
  C. The backup file extension was changed from .tar to .zip.
  D. The directory location is incorrect.
  C. The backup file extension was changed from .tar to .zip.

  ---

  Explanation Explanation/Reference: https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3455.pdf

• Question 302:

  A network administrator is configuring a site-to-site IPsec VPN to a router sitting behind a Cisco FTD. The administrator has configured an access policy to allow traffic to this device on UDP 500, 4500, and ESP VPN traffic is not working. Which action resolves this issue?

  A. Set the allow action in the access policy to trust.
  B. Enable IPsec inspection on the access policy.
  C. Modify the NAT policy to use the interface PAT.
  D. Change the access policy to allow all ports.
  A. Set the allow action in the access policy to trust.

• Question 303:

  In which two ways do access control policies operate on a Cisco Firepower system? (Choose two.)

  A. Traffic inspection can be interrupted temporarily when configuration changes are deployed.
  B. The system performs intrusion inspection followed by file inspection.
  C. They can block traffic based on Security Intelligence data.
  D. File policies use an associated variable set to perform intrusion prevention.
  E. The system performs a preliminary inspection on trusted traffic to validate that it matches the trusted parameters.
  A. Traffic inspection can be interrupted temporarily when configuration changes are deployed.
  C. They can block traffic based on Security Intelligence data.

  ---

  Explanation Explanation/Reference:When deploying changes SNORT can restart causing traffic interuptions --> https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/ policy_management.html#reference_F11C552688424DEF85ED145FA97283B7 File policies don't make use of Variable sets, those are used for Intrusion policies. https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Access_Control_Using_Intrusion_and_File_Policies.html

• Question 304:

  A network administrator is deploying a new Cisco Secure Firewall Threat Defense (FTD) firewall. After Cisco Secure FTD is deployed, inside clients have intermittent connectivity to each other. When reviewing the packet capture on the Secure FTD firewall, the administrator sees that Secure FTD is responding to all the ARP requests on the inside network. Which action must the network administrator take to resolve the issue?

  A. Review the access policy and verify that ARP is allowed from inside to inside.
  B. Review NAT policy and disable incorrect proxy ARP configuration.
  C. Convert the FTD to transparent mode to allow ARP requests.
  D. Hardcode the MAC address of the FTD to IP mapping on client machines.
  B. Review NAT policy and disable incorrect proxy ARP configuration.

  ---

  If inside clients have intermittent connectivity issues and the Cisco Secure FTD is responding to all ARP requests on the inside network, it indicates that there may be an incorrect proxy ARP configuration in the NAT policy. Proxy ARP can cause the FTD to respond to ARP requests on behalf of other devices, leading to connectivity issues. Steps to resolve: Review the NAT policy on the FTD to identify any incorrect proxy ARP configurations. Disable the proxy ARP setting for the relevant NAT rules that are causing the issue. This ensures that the FTD only responds to ARP requests as needed, preventing it from interfering with normal ARP traffic on the inside network. References: Cisco Secure Firewall Management Center Configuration Guide, Chapter on NAT and ARP Configuration.

• Question 305:

  An engineer is attempting to create a new dashboard within the Cisco FMC to have a single view with widgets from many of the other dashboards. The goal is to have a mixture of threat and security related widgets along with Cisco Firepower device health information. Which two widgets must be configured to provide this information? (Choose two.)

  A. Intrusion Events
  B. Correlation Information
  C. Appliance Status
  D. Current Sessions
  E. Network Compliance
  A. Intrusion Events
  C. Appliance Status

  ---

  https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/dashboards.html#ID-2206-00000283

• Question 306:

  A network administrator is troubleshooting access to a website hosted behind a Cisco FTD device. External clients cannot access the web server via HTTPS. The IP address configured on the web server is 192.168.7.46. The administrator is running the command capture CAP interface outside match ip any 192.168.7.46 255.255.255.255 but cannot see any traffic in the capture. Why is this occurring?

  A. The capture must use the public IP address of the web server.
  B. The packet capture shows only blocked traffic.
  C. The FTD has no route to the web server.
  D. The access policy is blocking the traffic.
  A. The capture must use the public IP address of the web server.

• Question 307:

  An engineer is implementing a new Cisco Secure Firewall. The firewall must filler traffic between the three subnets:

  1.

  LAN 192.168.101.0724

  2.

  DMZ 192.168 200.0/24

  3.

  WAN 10.0.0.0/30

  Which firewall mode must the engineer implement?

  A. transparent
  B. network
  C. routed
  D. gateway
  C. routed

  ---

  To filter traffic between multiple subnets, the engineer must implement the firewall in routed mode. In routed mode, the firewall operates as a Layer 3 device, capable of routing traffic between different IP subnets. This mode is appropriate for filtering traffic between LAN, DMZ, and WAN subnets. Steps to configure routed mode: Access the firewall's management interface. Configure interfaces for each subnet (LAN, DMZ, WAN) with appropriate IP addresses and network masks. Define security zones and apply access control policies to filter traffic as required. This ensures that the firewall can inspect and route traffic between the different subnets, providing the necessary security and control. References: Cisco Secure Firewall Threat Defense Configuration Guide, Chapter on Routed Mode Configuration.

• Question 308:

  An administrator is attempting to remotely log into a switch in the data center using SSH and is unable to connect. How does the administrator confirm that traffic is reaching the firewall?

  A. by performing a packet capture on the firewall
  B. by attempting to access it from a different workstation
  C. by running Wireshark on the administrator's PC
  D. by running a packet tracer on the firewall
  D. by running a packet tracer on the firewall

  ---

  https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212474-working-with-firepower-threat-defense-f.html#anc16

• Question 309:

  What is a characteristic of bridge groups on a Cisco FTD?

  A. In routed firewall mode, routing between bridge groups is supported.
  B. Routing between bridge groups is achieved only with a router-on-a-stick configuration on a connected router.
  C. In routed firewall mode, routing between bridge groups must pass through a routed interface.
  D. In transparent firewall mode, routing between bridge groups is supported.
  A. In routed firewall mode, routing between bridge groups is supported.

  ---

  https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/intro-fw.pdf

• Question 310:

  A network administrator notices that remote access VPN users are not reachable from inside the network. It is determined that routing is configured correctly, however return traffic is entering the firewall but not leaving it What is the reason for this issue?

  A. A manual NAT exemption rule does not exist at the top of the NAT table.
  B. An external NAT IP address is not configured.
  C. An external NAT IP address is configured to match the wrong interface.
  D. An object NAT exemption rule does not exist at the top of the NAT table.
  A. A manual NAT exemption rule does not exist at the top of the NAT table.

  ---

  Explanation Explanation/Reference:https://www.cisco.com/c/en/us/support/docs/security/firepower-management- center/212702-configure-and-verify-nat-on-ftd.html