Securing Networks with Cisco Firepower (SNCF) practice questions

1. Question 1 of 25

   An administrator is setting up Cisco FirePower to send data to the Cisco Stealthwatch appliances. The NetFlow_Set_Parameters objet is already created, but NetFlow is not being sent to the flow collector. What must be done to prevent this from occurring?

   • ACreate a service identifier to enable the NetFlow service.
   • BAdd the NetFlow_Send_Destination object to the configuration.
   • CCreate a Security Intelligence object to send the data to Cisco Stealthwatch.
   • DAdd the NetFlow_Add_Destination object to the configuration.

   Show answer

   Correct answer: D

   How others answered

   • D86%

   Explanation

   Sorry, correct answer is D. Looking at the FTD FlexConfig Object I see no NetFlow_Send_Destination object. Only option is NetFlow_Add_Destination object.

   Adapted from community discussion by Joe_Blue · 2024-03-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

   1. J

      Joe_Blue

      2024-03-12

      Selected D2 upvotes

      Sorry, correct answer is D. Looking at the FTD FlexConfig Object I see no NetFlow_Send_Destination object. Only option is NetFlow_Add_Destination object.

   2. T

      tinyJoe

      2024-12-14

      Selected D1 upvote

      I guess correct answer is D. Unfortunately, these objects have been removed in FTD ver 7.4... https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/flex-config.html?bookSearch=true

   3. 1

      14a1949

      2025-01-14

      Selected D1 upvote

      Based on the information and the documentation, the correct answer is to add the NetFlow_Add_Destination object to the configuration (Option D). This step ensures that the NetFlow data is directed to the appropriate flow collector.

   4. S

      SegaMasterSystemAdmin

      2024-06-08

      Selected D1 upvote

      https://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/netflow/216126-configure-netflow-secure-event-logging-o.html

2. Question 2 of 25

   Which license type is required on Cisco ISE to integrate with Cisco FMC pxGrid?

   • Aapex
   • Bplus
   • Cbase
   • Dmobility

   Show answer

   Correct answer: B

   How others answered

   • B82%
   • C18%

   Explanation

   Yes, (B) should be it regarding https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_0101.html Please refer to section: "Table 1. Cisco ISE License Packages": - ISE License Packages == Plus AND - ISE Functionality Covered == Cisco pxGrid ALSO: Within chapter "Traditional License Consumption" it says: "pxGrid is used to share context collected by ISE with other products. A Plus license is required to enable pxGrid functionality. There is no session count decrement when context for session is shared. However, to use pxGrid, the number of Plus sessions licensed must be equal to the number of Base sessions licensed. For more information, see Cisco ISE Licenses and Services section in Cisco Identity Services Engine Ordering Guide."

   Adapted from community discussion by MB2222 · 2024-10-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

   1. B

      bassfunk

      2024-02-10

      Selected B4 upvotes

      Going with B. See link and scroll to the license section. https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/ise-licensing-guide-og.html#3CiscoISELicenses

   2. M

      MB2222

      2024-10-05

      2 upvotes

      Yes, (B) should be it regarding https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_0101.html Please refer to section: "Table 1. Cisco ISE License Packages": - ISE License Packages == Plus AND - ISE Functionality Covered == Cisco pxGrid ALSO: Within chapter "Traditional License Consumption" it says: "pxGrid is used to share context collected by ISE with other products. A Plus license is required to enable pxGrid functionality. There is no session count decrement when context for session is shared. However, to use pxGrid, the number of Plus sessions licensed must be equal to the number of Base sessions licensed. For more information, see Cisco ISE Licenses and Services section in Cisco Identity Services Engine Ordering Guide."

   3. T

      tinyJoe

      2024-12-21

      Selected B3 upvotes

      From past documentation, I agree that the correct answer is B. However, according to the following document, licenses containing ISE's PLUS are no longer sold and supported. https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/identity-services-engine-base-plus-apex- license-pids-eol.html

   4. J

      Joe_Blue

      2023-09-12

      Selected B2 upvotes

      The license type required on Cisco ISE to integrate with Cisco FMC pxGrid is "Plus" license. The Cisco Identity Services Engine (ISE) uses the Platform Exchange Grid (pxGrid) to integrate with other security products, such as the Cisco Firepower Management Center (FMC). To use pxGrid, a Plus license is required on Cisco ISE. The Plus license provides advanced network access control and security features, including integration with third-party products via pxGrid.

3. Question 3 of 25

   What is a feature of Cisco AMP private cloud?

   • AIt disables direct connections to the public cloud.
   • BIt supports security intelligence filtering.
   • CIt support anonymized retrieval of threat intelligence.
   • DIt performs dynamic analysis.

   Show answer

   Correct answer: A

   How others answered

   • A60%
   • D40%

   Only 60% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Correct Answer is A. Please, read this line from the referenced article: "Connecting a Firepower Management Center to an AMP private cloud disables existing direct connections to the public AMP cloud."

   Adapted from community discussion by Bobster02 · 2021-07-12 · 15 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

   1. B

      Bobster02

      2021-07-12

      15 upvotes

      Correct Answer is A. Please, read this line from the referenced article: "Connecting a Firepower Management Center to an AMP private cloud disables existing direct connections to the public AMP cloud."

   2. E

      essie007

      2021-07-08

      3 upvotes

      D is incorrect: "The AMP private cloud does not perform dynamic analysis, nor does it support anonymized retrieval of threat intelligence for other features that rely on Cisco Collective Security Intelligence (CSI), such as URL and Security Intelligence filtering. " C is correct: "All connections to the AMP cloud funnel through the AMP private cloud, which acts as an anonymized proxy to ensure the security and privacy of your monitored network." Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/file_policies_and_advanced_malware_protection.html

   3. F

      ffaiz

      2023-06-22

      Selected A2 upvotes

      Connecting a Firepower Management Center to an AMP private cloud disables existing direct connections to the public AMP cloud. https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/file_policies_and_amp_for_firepower.html#:~:text=Connecting%20a%20Firepower%20Management%20Center%20to%20an%20AMP%20private%20cloud%20disables%20existing%20direct%20connections%20to%20the%20public%20AMP%20cloud.

   4. J

      johanhc20

      2022-07-26

      Selected A1 upvote

      Your organization may have privacy or security concerns that make frequent or direct connections between your monitored network and the AMP cloud difficult or impossible. In these situations, you can set up a Cisco AMP Private Cloud, a proprietary Cisco product that acts as a compressed, on-premises version of the AMP cloud, as well as a secure mediator between your network and the AMP cloud. Connecting a Firepower Management Center to an AMP private cloud disables existing direct connections to the public AMP cloud. Correct A

4. Question 4 of 25

   Which feature within the Cisco FMC web interface allows for detecting, analyzing, and blocking malware in network traffic?

   • Aintrusion and file events
   • BCisco AMP for Networks
   • Cfile policies
   • DCisco AMP for Endpoints

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/file_policies_and_advanced_malware_protection.html#concept_5DC63E0AC3794E3FB7D59A52D7A337C2 About File Policies and Advanced Malware Protection To detect and block malware, use file policies. You can also use file policies to detect and control traffic by file type. Advanced Malware Protection (AMP) for Firepower can detect, capture, track, analyze, log, and optionally block the transmission of malware in network traffic. In the Firepower Management Center web interface, this feature is called AMP for Networks, formerly called AMP for Firepower. Since they also want to analyse, AMP is needed.

   Adapted from community discussion by z6st2a1jv · 2024-04-30 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

   1. X

      xziomal9

      2022-12-20

      Selected B4 upvotes

      Advanced Malware Protection (AMP) for Firepower can detect, capture, track, analyze, log, and optionally block the transmission of malware in network traffic. In the Firepower Management Center web interface, this feature is called AMP for Networks, formerly called AMP for Firepower. Advanced Malware Protection identifies malware using managed devices deployed inline and threat data from the Cisco cloud.

   2. Z

      z6st2a1jv

      2024-04-30

      Selected B2 upvotes

      https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/file_policies_and_advanced_malware_protection.html#concept_5DC63E0AC3794E3FB7D59A52D7A337C2 About File Policies and Advanced Malware Protection To detect and block malware, use file policies. You can also use file policies to detect and control traffic by file type. Advanced Malware Protection (AMP) for Firepower can detect, capture, track, analyze, log, and optionally block the transmission of malware in network traffic. In the Firepower Management Center web interface, this feature is called AMP for Networks, formerly called AMP for Firepower. Since they also want to analyse, AMP is needed.

   3. S

      Stevens0103

      2024-07-31

      1 upvote

      It's B. "Advanced Malware Protection (AMP) for Firepower can detect, capture, track, analyze, log, and optionally block the transmission of malware in network traffic. In the Firepower Management Center web interface, this feature is called AMP for Networks, formerly called AMP for Firepower." https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/file_policies_and_advanced_malware_protection.html

   4. J

      Joninjimbo

      2024-04-25

      2 upvotes

      Updated link, still same answer: https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/file_policies_and_advanced_malware_protection.html

5. Question 5 of 25

   An administrator is configuring their transparent Cisco FTD device to receive ERSPAN traffic from multiple switches on a passive port, but the Cisco FTD is not processing the traffic. What is the problem?

   • AThe switches do not have Layer 3 connectivity to the FTD device for GRE traffic transmission.
   • BThe switches were not set up with a monitor session ID that matches the flow ID defined on the Cisco FTD.
   • CThe Cisco FTD must be in routed mode to process ERSPAN traffic.
   • DThe Cisco FTD must be configured with an ERSPAN port not a passive port.

   Show answer

   Correct answer: C

   How others answered

   • C58%
   • A33%

   Only 58% agreed on this answer — treat it as contested rather than settled.

   Explanation

   The Cisco ERSPAN feature allows you to monitor traffic on ports or VLANs and send the monitored traffic to destination ports. The ERSPAN feature requires IP routing to be enabled in the Global Configuration Mode. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9400/software/release/16-6/configuration_guide/nmgmt/b_166_nmgmt_9400_cg/b_166_nmgmt_9400_cg_chapter_01000.pdf

   Adapted from community discussion by achille5 · 2024-09-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

   1. C

      cla8829

      2023-12-10

      3 upvotes

      A & C Passive or ERSPAN Passive—Passive interfaces monitor traffic flowing across a network using a switch SPAN or mirror port. The SPAN or mirror port allows for traffic to be copied from other ports on the switch. This function provides the system visibility within the network without being in the flow of network traffic. When you configure the FTD in a passive deployment, the FTD cannot take certain actions such as blocking or shaping traffic. Passive interfaces receive all traffic unconditionally. and no traffic received on these interfaces is retransmitted. Encapsulated remote switched port analyzer (ERSPAN) interfaces allow you to monitor traffic from source ports distributed over multiple switches, and uses GRE to encapsulate the traffic. ERSPAN interfaces are only allowed when the FTD is in routed firewall mode.

   2. M

      MB2222

      2024-10-21

      4 upvotes

      Answer is (C). See section "Guidelines for Inline Sets and Passive Interfaces" Firewall Mode - ERSPAN interfaces are only allowed when the device is in routed firewall mode. https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/inline_sets_and_passive_interfaces_for_firepower_threat_defense.html#id_19616

   3. A

      achille5

      2024-09-05

      Selected C2 upvotes

      The Cisco ERSPAN feature allows you to monitor traffic on ports or VLANs and send the monitored traffic to destination ports. The ERSPAN feature requires IP routing to be enabled in the Global Configuration Mode. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9400/software/release/16-6/configuration_guide/nmgmt/b_166_nmgmt_9400_cg/b_166_nmgmt_9400_cg_chapter_01000.pdf

   4. J

      Joe_Blue

      2023-09-12

      Selected C2 upvotes

      Guidelines for Inline Sets and Passive Interfaces Firewall Mode ERSPAN interfaces are only allowed when the device is in routed firewall mode.

6. Question 6 of 25

   A network engineer sets up a secondary Cisco FMC that is integrated with Cisco Security Packet Analyzer. What occurs when the secondary Cisco FMC synchronizes with the primary Cisco FMC?

   • AThe existing configuration for integration of the secondary Cisco FMC the Cisco Security Packet Analyzer is overwritten.
   • BThe synchronization between the primary and secondary Cisco FMC fails.
   • CThe existing integration configuration is replicated to the primary Cisco FMC.
   • DThe secondary Cisco FMC must be reintegrated with the Cisco Security Packet Analyzer after the synchronization.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   "Note that any existing configurations on the intended secondary Firepower Management Center for integrations with Cisco Security Packet Analyzer will be overwritten when synchronization occurs. If necessary, recreate any such configurations on the intended primary Firepower Management Center." https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/firepower_management_center_high_availability.html#id_32288

   Adapted from community discussion by Mevijil · 2023-08-08 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

   1. M

      Mevijil

      2023-08-08

      Selected A3 upvotes

      "Note that any existing configurations on the intended secondary Firepower Management Center for integrations with Cisco Security Packet Analyzer will be overwritten when synchronization occurs. If necessary, recreate any such configurations on the intended primary Firepower Management Center." https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/firepower_management_center_high_availability.html#id_32288

   2. F

      felagund

      2023-08-10

      Selected A4 upvotes

      Correct, it's overwritten. https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/firepower_management_center_high_availability.html

   3. S

      Samer0100

      2024-09-22

      Selected A3 upvotes

      ***copied from Cisco Configuration Guide*** Note that any existing configurations on the intended secondary Firepower Management Center for integrations with Cisco Security Packet Analyzer will be overwritten when synchronization occurs. If necessary, recreate any such configurations on the intended primary Firepower Management Center.

   4. B

      bobie

      2023-12-03

      Selected A2 upvotes

      Prerequisites for Firepower Management Center High Availability "Note that any existing configurations on the intended secondary Firepower Management Center for integrations with Cisco Security Packet Analyzer will be overwritten when synchronization occurs. If necessary, recreate any such configurations on the intended primary Firepower Management Center."

7. Question 7 of 25

   An engineer wants to add an additional Cisco FTD Version 6.2.3 device to their current 6.2.3 deployment to create a high availability pair. The currently deployed Cisco FTD device is using local management and identical hardware including the available port density to enable the failover and stateful links required in a proper high availability deployment. Which action ensures that the environment is ready to pair the new Cisco FTD with the old one?

   • AChange from Cisco FDM management to Cisco FMC management on both devices and register them to FMC.
   • BEnsure that the two devices are assigned IP addresses from the 169.254.0.0/16 range for failover interfaces.
   • CFactory reset the current Cisco FTD so that it can synchronize configurations with the new Cisco FTD device.
   • DEnsure that the configured DNS servers match on the two devices for name resolution.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   it seems FDM started supporting HA in 6.3, I can't find HA mentioned in 6.2.3, so the key here is the version. For FMC setups running 6.2.3 it is supported, so A looks to be correct here. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/fdm/fptd-fdm-config-guide-623.html https://www.cisco.com/c/en/us/td/docs/security/firepower/630/fdm/fptd-fdm-config-guide-630/fptd-fdm-ha.html https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/firepower_threat_defense_high_availability.html

   Adapted from community discussion by Kris92 · 2024-09-01 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

   1. K

      Kris92

      2024-09-01

      Selected A2 upvotes

      it seems FDM started supporting HA in 6.3, I can't find HA mentioned in 6.2.3, so the key here is the version. For FMC setups running 6.2.3 it is supported, so A looks to be correct here. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/fdm/fptd-fdm-config-guide-623.html https://www.cisco.com/c/en/us/td/docs/security/firepower/630/fdm/fptd-fdm-config-guide-630/fptd-fdm-ha.html https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/firepower_threat_defense_high_availability.html

   2. B

      Bubu3k

      2024-07-08

      2 upvotes

      This are the req for HA on 6.2.3 (they need to be part of FMC) Software Requirements The two units in a High Availability configuration must: Be in the same firewall mode (routed or transparent). Have the same software version. Be in the same domain or group on the FMC. Have the same NTP configuration. See Configure NTP Time Synchronization for Threat Defense. Be fully deployed on the FMC with no uncommitted changes. Not have DHCP or PPPoE configured in any of their interfaces. (Firepower 9300) Have the same flow offload mode, either both enabled or both disabled.

   3. T

      tanri04

      2023-09-13

      1 upvote

      changing from Cisco FDM management to Cisco FMC management on both devices and registering them to FMC, is necessary to configure high availability between two Cisco FTD devices in a deployment where they are being managed by Cisco FMC. When using Cisco FMC to manage the Cisco FTD devices, both devices must be managed by Cisco FMC before configuring high availability. This involves changing the devices from local management (Cisco FDM) to central management (Cisco FMC) and registering them to Cisco FMC. Correct answer:A Therefore, to ensure that the environment is ready to pair the new Cisco FTD with the old one, the correct action is to change from Cisco FDM management to Cisco FMC management on both devices and register them to FMC.

   4. M

      Mevijil

      2023-08-08

      1 upvote

      I can't figure out a single one of these answers that makes sense. HA is supported in FDM (https://www.cisco.com/c/en/us/td/docs/security/firepower/640/fdm/fptd-fdm-config-guide-640/fptd-fdm-ha.html) without an FMC, so not "A". I can't imagine why you'd use a Class B for Failover links so not "B". You shouldn't need to factory reset the primary to configure a secondary so not "C". And DNS doesn't need to be the same configuration so not "D". HA in FDM was a recent(ish) addition so maybe that's the one they mean?

8. Question 8 of 25

   What must be implemented on Cisco Firepower to allow multiple logical devices on a single physical device to have access to external hosts?

   • AAdd at least two container instances from the same module.
   • BSet up a cluster control link between all logical devices.
   • CDefine VLAN subinterfaces for each logical device.
   • DAdd one shared management interface on all logical devices.

   Show answer

   Correct answer: D

   How others answered

   • D52%
   • C48%

   Only 52% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Mgmt—Use to manage application instances. These interfaces can be shared by one or more logical devices to access external hosts; logical devices cannot communicate over this interface with other logical devices that share the interface. You can only assign one management interface per logical device. Depending on your application and manager, you can later enable management from a data interface; but you must assign a Management interface to the logical device even if you don't intend to use it after you enable data management. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/firepower_threat_defense_logical_devices.html#id_77524

   Adapted from community discussion by Cokamaniako · 2023-05-08 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

   1. C

      Cokamaniako

      2023-05-08

      Selected D4 upvotes

      Mgmt—Use to manage application instances. These interfaces can be shared by one or more logical devices to access external hosts; logical devices cannot communicate over this interface with other logical devices that share the interface. You can only assign one management interface per logical device. Depending on your application and manager, you can later enable management from a data interface; but you must assign a Management interface to the logical device even if you don't intend to use it after you enable data management. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/firepower_threat_defense_logical_devices.html#id_77524

   2. J

      Joe_Blue

      2023-02-08

      Selected D2 upvotes

      Mgmt—Use to manage application instances. These interfaces can be shared by one or more logical devices to access external hosts; logical devices cannot communicate over this interface with other logical devices that share the interface. You can only assign one management interface per logical device. Depending on your application and manager, you can later enable management from a data interface; but you must assign a Management interface to the logical device even if you don't intend to use it after you enable data management. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/firepower_threat_defense_logical_devices.html

   3. M

      Mevijil

      2023-02-09

      Selected D3 upvotes

      I think it's D: "The management interface is required. Note that this management interface is not the same as the chassis management interface that is used only for chassis management (in FXOS, you might see the chassis management interface displayed as MGMT, management0, or other similar names). https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/clustering/ftd-4100-9300-cluster.html#id_78369

   4. Z

      z6st2a1jv

      2023-11-16

      Selected D3 upvotes

      D - like Cokemaniak said: its a literal copy from the cisco doc regarding mgmt interface for virtual devices: These interfaces can be shared by one or more logical devices to access external hosts; https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/firepower_threat_defense_logical_devices.html#id_77524

9. Question 9 of 25

   Which feature is supported by IRB on Cisco FTD devices?

   • Aredundant interface
   • Bhigh-availability cluster
   • Cdynamic routing protocol
   • DEtherChannel interface

   Show answer

   Correct answer: A

   How others answered

   • A83%
   • C17%

   Explanation

   IRB is not the same as dynamic routing protocols. The first thing in cisco whitepaper regarding routed/transparent firewall and IRB is unsupported feautures, and the unsupported is etherchannel, Dynamic routing protocols.. so only A si the right one

   Adapted from community discussion by Initial14 · 2023-04-16 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

   1. R

      RCV

      2023-05-01

      6 upvotes

      Correct A https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html#id_40010

   2. I

      Initial14

      2023-04-16

      Selected A2 upvotes

      IRB is not the same as dynamic routing protocols. The first thing in cisco whitepaper regarding routed/transparent firewall and IRB is unsupported feautures, and the unsupported is etherchannel, Dynamic routing protocols.. so only A si the right one

   3. D

      Dolby58

      2023-02-07

      Selected A2 upvotes

      A is correct. https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html

   4. T

      tanri04

      2023-03-10

      1 upvote

      IRB stands for Integrated Routing and Bridging and is a feature that enables bridging between two or more VLANs and routing between these VLANs as well. Therefore, the feature supported by IRB on Cisco FTD devices is: C. dynamic routing protocol IRB is a layer 3 feature and supports dynamic routing protocols such as OSPF, BGP, and RIP. It allows a device to route between VLANs while still maintaining layer 2 connectivity within the VLAN. Redundant interfaces, high-availability clusters, and EtherChannel interfaces are not directly related to IRB.

10. Question 10 of 25

    

    Refer to the exhibit. A systems administrator conducts a connectivity test to their SCCM server from a host machine and gets no response from the server. Which action ensures that the ping packets reach the destination and that the host receives replies?

    • AConfigure a custom Snort signature to allow ICMP traffic after inspection.
    • BModify the Snort rules to allow ICMP traffic.
    • CCreate an access control policy rule that allows ICMP traffic.
    • DCreate an ICMP allow list and add the ICMP destination to remove it from the implicit deny list.

    Show answer

    Correct answer: C

    How others answered

    • C50%
    • B44%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    You are wrong. You can modify SNORT rule. From this : https://www.cisco.com/c/en/us/td/docs/security/firepower/70/snort3/config-guide/snort3-configuration-guide-v70/overview.html#concept_D87B73A83ACA42CCA656F0041F9D860B .... Snort 3 is architecturally redesigned to inspect more traffic with equivalent resources when compared to Snort 2. Snort 3 provides simplified and flexible insertion of traffic parsers. Snort 3 also provides new rule syntax that makes rule writing easier and shared object rule equivalents visible. ....

    Adapted from community discussion by Vlad_Is_Love_ua · 2024-02-17 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • cisco.com documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. B

       Bbb78

       2023-11-23

       4 upvotes

       exactly - preprocessor is before any ACLs, so only there will this be permitted. the ICMP rules are set to Block. Even if permited by ACL - Snort will block it first in the preprocessor. B should be correct

    2. [

       [Removed]

       2024-03-06

       Selected C3 upvotes

       As long as the packet is being dropped by the firewall, an ACP needs to be in place to allow that traffic. Please check the snor text: Blocked by the firewall.

    3. G

       Gabranch

       2023-11-22

       Selected C3 upvotes

       https://community.cisco.com/t5/network-security/ftd-firewall-blocked-or-blacklisted/td-p/4494363 The SNORT phase appears to be a red herring.

    4. V

       Vlad_Is_Love_ua

       2024-02-17

       2 upvotes

       You are wrong. You can modify SNORT rule. From this : https://www.cisco.com/c/en/us/td/docs/security/firepower/70/snort3/config-guide/snort3-configuration-guide-v70/overview.html#concept_D87B73A83ACA42CCA656F0041F9D860B .... Snort 3 is architecturally redesigned to inspect more traffic with equivalent resources when compared to Snort 2. Snort 3 provides simplified and flexible insertion of traffic parsers. Snort 3 also provides new rule syntax that makes rule writing easier and shared object rule equivalents visible. ....

11. Question 11 of 25

    Select 2

    A security engineer must deploy a Cisco FTD appliance as a bump in the wire to detect intrusion events without disrupting the flow of network traffic. Which two features must be configured to accomplish the task? (Choose two.)

    • Atransparent mode
    • Btap mode
    • Cbridged mode
    • Dinline set pair
    • Epassive interfaces

    Show answer

    Correct answer: B, D

    How others answered

    • BD62%
    • AB31%

    Only 62% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I would say A&B- both config guide descriptions use the term Bump in the wire and a TAP mode interface hase to be inline to begin with. https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/inline_sets_and_passive_interfaces_for_firepower_threat_defense.html

    Adapted from community discussion by THEODORABLE · 2023-11-15 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. S

       Stevens0103

       2024-07-30

       Selected B, D4 upvotes

       It's B&D. "The firewall mode only affects regular firewall interfaces, and not IPS-only interfaces such as inline sets or passive interfaces. IPS-only interfaces can be used in both firewall modes." https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/interface_overview_for_firepower_threat_defense.html#concept_DB45E8BBB07946728427FF98DB2DC56D

    2. G

       gwb

       2024-09-18

       4 upvotes

       yeah "bump in the wire" correct. But the question is "not to block" traffic. transparent mode can block it. Instead of choosing two different modes, I will go Tap mode (not blocking) along with configuration part (inline set pair), so both answers are referring tap mode. my answer is B and D

    3. T

       THEODORABLE

       2023-11-15

       3 upvotes

       I would say A&B- both config guide descriptions use the term Bump in the wire and a TAP mode interface hase to be inline to begin with. https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/inline_sets_and_passive_interfaces_for_firepower_threat_defense.html

    4. B

       BroDawg

       2024-01-13

       2 upvotes

       B & D Inline Set, with optional Tap mode—An inline set acts like a bump on the wire, and binds two interfaces together to slot into an existing network. This function allows the FTD to be installed in any network environment without the configuration of adjacent network devices. Inline interfaces receive all traffic unconditionally, but all traffic received on these interfaces is retransmitted out of an inline set unless explicitly dropped. https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/inline_sets_and_passive_interfaces_for_firepower_threat_defense.html

12. Question 12 of 25

    In a multi-tenant deployment where multiple domains are in use, which update should be applied outside of the Global Domain?

    • Aminor upgrade
    • Blocal import of intrusion rules
    • CCisco Geolocation Database
    • Dlocal import of major upgrade

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    https://www.cisco.com/c/en/us/td/docs/security/firepower/670/configuration/guide/fpmc-config-guide-v67/system_software_updates.html B fits better In a multidomain deployment, you can import local intrusion rules in any domain. You can view local intrusion rules imported in the current domain and ancestor domains.

    Adapted from community discussion by kakakayayaya · 2022-06-12 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. K

       kakakayayaya

       2022-06-12

       4 upvotes

       https://www.cisco.com/c/en/us/td/docs/security/firepower/670/configuration/guide/fpmc-config-guide-v67/system_software_updates.html B fits better In a multidomain deployment, you can import local intrusion rules in any domain. You can view local intrusion rules imported in the current domain and ancestor domains.

    2. T

       tanri04

       2024-03-11

       2 upvotes

       The correct answer is B. Local import of intrusion rules should be applied outside of the Global Domain. In a multi-tenant deployment, the Global Domain applies to all tenants, while each tenant has its own domain with its own policies, objects, and configurations. If a minor upgrade or a major upgrade is applied, it should be done globally and affects all tenants. Similarly, the Cisco Geolocation Database should be updated globally as it applies to all tenants. However, intrusion rules can be specific to a tenant's needs and should be imported locally in the tenant's domain to ensure that only the desired rules are applied to that tenant's traffic.

    3. A

       achille5

       2024-08-03

       2 upvotes

       "In a multidomain deployment, you can import local intrusion rules in any domain, but you can import intrusion rule updates from Talos in the Global domain only"

    4. M

       minon_bob

       2023-12-05

       Selected B1 upvote

       In a multidomain deployment, you can import local intrusion rules in any domain. You can view local intrusion rules imported in the current domain and ancestor domains.

13. Question 13 of 25

    Select 2

    A security engineer is adding three Cisco FTD devices to a Cisco FMC. Two of the devices have successfully registered to the Cisco FMC. The device that is unable to register is located behind a router that translates all outbound traffic to the router’s WAN IP address. Which two steps are required for this device to register to the Cisco FMC? (Choose two.)

    • AReconfigure the Cisco FMC to use the device’s private IP address instead of the WAN address.
    • BConfigure a NAT ID on both the Cisco FMC and the device.
    • CReconfigure the Cisco FMC to use the device’s hostname instead of IP address.
    • DRemove the IP address defined for the device in the Cisco FMC.
    • EAdd the port number being used for PAT on the router to the device’s IP address in the Cisco FMC.

    Show answer

    Correct answer: B, D

    How others answered

    • BD61%
    • AB39%

    Only 61% agreed on this answer — treat it as contested rather than settled.

    Explanation

    PAT lets you use a single public IP address and unique ports to access the public network; these ports are dynamically assigned as needed, so you cannot initiate a connection to a device behind a PAT router. Normally, you need both IP addresses (along with a registration key) for both routing purposes and for authentication: the FMC specifies the device IP address when you add a device, and the device specifies the FMC IP address. However, if you only know one of the IP addresses, which is the minimum requirement for routing purposes, then you must also specify a unique NAT ID on both sides of the connection to establish trust for the initial communication and to look up the correct registration key. The FMC and device use the registration key and NAT ID (instead of IP addresses) to authenticate and authorize for initial registration. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/device_management_basics.html

    Adapted from community discussion by Kris92 · 2024-03-03 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. K

       Kris92

       2024-03-03

       Selected B, D6 upvotes

       PAT lets you use a single public IP address and unique ports to access the public network; these ports are dynamically assigned as needed, so you cannot initiate a connection to a device behind a PAT router. Normally, you need both IP addresses (along with a registration key) for both routing purposes and for authentication: the FMC specifies the device IP address when you add a device, and the device specifies the FMC IP address. However, if you only know one of the IP addresses, which is the minimum requirement for routing purposes, then you must also specify a unique NAT ID on both sides of the connection to establish trust for the initial communication and to look up the correct registration key. The FMC and device use the registration key and NAT ID (instead of IP addresses) to authenticate and authorize for initial registration. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/device_management_basics.html

    2. S

       Stevens0103

       2024-01-28

       Selected B, D4 upvotes

       It's B & D. 100% guarantee. "For example, you add a device to the FMC, and you do not know the device IP address (for example, the device is behind a PAT router), so you specify only the NAT ID and the registration key on the FMC; leave the IP address blank. On the device, you specify the FMC IP address, the same NAT ID, and the same registration key. The device registers to the FMC's IP address. At this point, the FMC uses the NAT ID instead of IP address to authenticate the device." https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Device_Management_Basics.html

    3. I

       Initial14

       2023-04-19

       3 upvotes

       If you are registering device that is behind NAT, on FMC you must: specify a unique NAT ID for each device you want to add while leaving the IP address blank, and then on each device, specify both the management center IP address and the NAT ID. Note: The NAT ID must be unique per device. On FTD you: configure manager add [manager IP] regk3y78 natid56 In the case when FTD is with public address and FMC is behind NAT: specify a unique NAT ID per device on both the management center and the devices, and specify the device IP addresses on the management center. on FTD: onfigure manager add DONTRESOLVE regk3y78 natid90 If the threat defense is behind a NAT device, enter a unique NAT ID along with the management center IP address or hostname, for example: > configure manager add 10.70.45.5 regk3y78 natid56

    4. C

       c946f3e

       2023-09-13

       2 upvotes

       configure manager add {hostname | IPv4_address | IPv6_address | DONTRESOLVE } regkey [nat_id] [display_name] {hostname | IPv4_address | IPv6_address}—Sets the management center hostname, IPv4 address, or IPv6 address. DONTRESOLVE —If the management center is not directly addressable, use DONTRESOLVE instead of a hostname or IP address. If you use DONTRESOLVE , then a nat_id is required. When you add this device to the management center, make sure that you specify both the device IP address and the nat_id ; one side of the connection needs to specify an IP address, and both sides need to specify the same, unique NAT ID. Example: > configure manager add DONTRESOLVE abc123 efg456 Manager successfully configured. Please make note of reg_key as this will be required while adding Device in FMC. >

14. Question 14 of 25

    What is a characteristic of bridge groups on a Cisco FTD?

    • AIn routed firewall mode, routing between bridge groups is supported.
    • BRouting between bridge groups is achieved only with a router-on-a-stick configuration on a connected router.
    • CIn routed firewall mode, routing between bridge groups must pass through a routed interface.
    • DIn transparent firewall mode, routing between bridge groups is supported.

    Show answer

    Correct answer: A

    How others answered

    • A86%

    Explanation

    In routed mode: The BVI acts as the gateway between the bridge group and other routed interfaces. To route between bridge groups/routed interfaces, you must name the BVI. For some interface-based features, you can use the BVI itself. https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/intro-fw.pdf

    Adapted from community discussion by liqucika · 2024-01-24 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. L

       liqucika

       2024-01-24

       Selected A4 upvotes

       In routed mode: The BVI acts as the gateway between the bridge group and other routed interfaces. To route between bridge groups/routed interfaces, you must name the BVI. For some interface-based features, you can use the BVI itself. https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/intro-fw.pdf

    2. H

       hz033

       2024-05-07

       Selected A1 upvote

       In routed mode, you can have one or more isolated bridge groups like in transparent mode, but also have normal routed interfaces as well for a mixed deployment. https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/configuration/general/asa-99-general-config/intro-fw.html#ID-2106-0000000a

    3. 1

       14a1949

       2025-01-14

       Selected A1 upvote

       According to the Cisco documentation, in routed firewall mode, bridge group traffic can indeed be routed to other bridge groups or routed interfaces. Therefore, the correct answer is: A. In routed firewall mode, routing between bridge groups is supported.

    4. I

       ion123

       2024-01-05

       2 upvotes

       why given answer " A. In routed firewall mode, routing between bridge groups is supported." is not correct?

15. Question 15 of 25

    A network administrator is configuring a BVI interface on a routed FTD. The administrator wants to isolate traffic on the interfaces connected to the bridge group and not have the FTD route this traffic using the routing table. What must be configured?

    • AA new VRF must be created for the BVI interface
    • BAn IP address must be configured on the BVI
    • CIP routing must be removed from the physical interfaces connected to the BVI
    • DThe BVI interface must be configured for transparent mode

    Show answer

    Correct answer: A

    How others answered

    • A58%
    • D25%
    • B17%

    Only 58% agreed on this answer — treat it as contested rather than settled.

    Explanation

    "How to Manage Overlapping Segments in Routed Firewall Mode with BVI Interfaces" In the following example, BVI-G is configured in VRG and Bridge Group 1 is the routed interface for interfaces G0/1 and G0/2. Similarly, BVI-B is configured in VRB and Bridge Group 2 is the routed interface for interfaces G0/3 and G0/4. Consider that both BVIs have the same IP subnet address, say 10.10.10.5/24. Because of virtual routers, the network is isolated on the shared resources. https://www.cisco.com/c/dam/en/us/td/i/400001-500000/440001-450000/442001-443000/442782.jpg https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/virtual-routing-for-firepower-threat-defense.html

    Adapted from community discussion by Stevens0103 · 2024-02-20 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. T

       tinyJoe

       2025-01-02

       Selected A2 upvotes

       It's very difficut to choose, I would choose A. As for D, this FTD is already in Routed mode. I don't think changing it to Transparent is the best solution, since I assume it is already connected to multiple IP subnets. As for B, the configuration to IP addresses to the BVI is mandatory regardless of whether or not there is separation from routing. As for C, I don't understand what you mean by “IP routing must be removed”. Supplementary, the best solution is “not assigning a name to the BVI interface”. I don't understand why this is not an option. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config -76/device-ops-tfw.html?bookSearch=true#:~:text=not%20assigning%20a%20name

    2. S

       Stevens0103

       2024-02-20

       Selected A2 upvotes

       "How to Manage Overlapping Segments in Routed Firewall Mode with BVI Interfaces" In the following example, BVI-G is configured in VRG and Bridge Group 1 is the routed interface for interfaces G0/1 and G0/2. Similarly, BVI-B is configured in VRB and Bridge Group 2 is the routed interface for interfaces G0/3 and G0/4. Consider that both BVIs have the same IP subnet address, say 10.10.10.5/24. Because of virtual routers, the network is isolated on the shared resources. https://www.cisco.com/c/dam/en/us/td/i/400001-500000/440001-450000/442001-443000/442782.jpg https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/virtual-routing-for-firepower-threat-defense.html

    3. K

       KISRUVEM

       2024-01-15

       Selected A3 upvotes

       I’m thinking A. Creating a VRF with just the BVI would effectively isolate it from routing.

    4. T

       teenytiny

       2024-07-11

       1 upvote

       To complete my thought below, I agree with Dash_888 because VRFs use the routing table. Question specifies, "and not have the FTD route traffic using the routing table"

16. Question 16 of 25

    Remote users who connect via Cisco Secure Client to the corporate network behind a Cisco Secure Firewall Threat Defense device are reporting no audio on calls when calling between remote users using their softphones. These same users can call internal users on the corporate network without any issues. What is the cause of this issue?

    • AThe hairpinning feature is not available on Cisco Secure Firewall Threat Defense
    • BCisco Secure Firewall Threat Defense needs a NAT policy that allows outside to outside communication
    • CThe Enable Spoke to Spoke Connectivity through Hub option is not selected on Cisco Secure Firewall Threat Defense
    • DSplit tunneling is enabled for the Remote Access VPN on Cisco Secure Firewall Threat Defense

    Show answer

    Correct answer: B

    How others answered

    • B91%

    Explanation

    Based on the following scenarios I'd be leaning more on B: -No audio on the call between an AnyConnect Client and an external number. -No audio on the call between an AnyConnect Client and another AnyConnect Client. https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client-v4x/220337-troubleshoot-common-anyconnect-communica.html

    Adapted from community discussion by Bubu3k · 2024-07-13 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. B

       Bubu3k

       2024-07-13

       Selected B7 upvotes

       Based on the following scenarios I'd be leaning more on B: -No audio on the call between an AnyConnect Client and an external number. -No audio on the call between an AnyConnect Client and another AnyConnect Client. https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client-v4x/220337-troubleshoot-common-anyconnect-communica.html

    2. S

       Silexis

       2025-02-05

       1 upvote

       Though, the wording "is not available" it might be wrong. (hate Cisco for such a bad wording) It might also be D where there is an Extended ACL for split tunneling and there are missing subnets - rendering host from subnet A cannot call host from subnet B. A full tunnel gateway wont suffer from this thing and only the Spoke-to-Spoke command has to be taken care of (I am running such a deployment on FTD and RAVPN and I don't have any NAT configured but the U-turn and indeed in full-tunnel mode and the Cisco Jabber calls are working just fine)

    3. R

       ricckku

       2024-09-26

       2 upvotes

       A is the correct answer. The hair-pinning feature is definitely required. https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215875-configure-anyconnect-vpn-client-on-ftd.html#toc-hId-1618727688

    4. D

       d0980cc

       2025-04-09

       1 upvote

       Bubu3k great find. Here's the one that pertains to FTD. https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/216180-troubleshoot-common-anyconnect-communica.html#anc8:~:text=check%20that%20the%20correct%20inbound%20and%20outbound%20interfaces%20configuration%20is%20in%20place

17. Question 17 of 25

    An organization has a Cisco FTD that uses bridge groups to pass traffic from the inside interfaces to the outside interfaces. They are unable to gather information about neighboring Cisco devices or use multicast in their environment. What must be done to resolve this issue?

    • ACreate a firewall rule to allow CDP traffic
    • BCreate a bridge group with the firewall interfaces
    • CChange the firewall mode to transparent
    • DChange the firewall mode to routed

    Show answer

    Correct answer: C

    How others answered

    • C43%
    • A43%
    • D15%

    Only 43% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The C is the correct answer. https://www.cisco.com/c/en/us/td/docs/security/asa/asa913/configuration/general/asa-913-general-config/intro-fw.html Passing Traffic Not Allowed in Routed Mode In routed mode, some types of traffic cannot pass through the ASA even if you allow it in an access rule. The bridge group, however, can allow almost any traffic through using either an access rule (for IP traffic) or an EtherType rule (for non-IP traffic): IP traffic—In routed firewall mode, broadcast and "multicast traffic is blocked even if you allow it in an access rule," including unsupported dynamic routing protocols and DHCP (unless you configure DHCP relay). Within a bridge group, you can allow this traffic with an access rule (using an extended ACL). Non-IP traffic—AppleTalk, IPX, BPDUs, and MPLS, for example, can be configured to go through using an EtherType rule. Note "The bridge group does not pass CDP packets packets, or any packets that do not have a valid EtherType greater than or equal to 0x600. An exception is made for BPDUs and IS-IS, which are supported. "

    Adapted from community discussion by ThanosAth · 2022-01-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • cisco.com documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. J

       Joe_Blue

       2023-03-11

       Selected C3 upvotes

       The inability to gather information about neighboring Cisco devices or use multicast in a Cisco FTD environment that uses bridge groups is likely due to the fact that the firewall is operating in routed mode. In order to resolve this issue and enable the necessary features, the firewall mode needs to be changed to transparent mode. In transparent mode, the firewall operates as a bridge between the two interfaces, allowing multicast traffic to pass through and enabling the organization to gather information about neighboring Cisco devices. In addition, it is not necessary to create a bridge group when operating in transparent mode, as the firewall acts as a transparent bridge between the two interfaces.

    2. O

       orotta

       2022-02-10

       4 upvotes

       According to question: "The organization uses bridge groups to pass traffic from the inside interfaces to the outside interfaces" the organization has already implemented Bridge Groups therefore: Transparent firewall Mode does not allow traffic between bridge groups, it needs another router to pass traffic between bridge groups Route firewall mode allows traffic between bridge groups but does not allow broadcast and multicast traffic but by creating access rule, you can allow multicast traffic. CDP-configured device sends periodic messages to a multicast address. I think the answer is A

    3. T

       ThanosAth

       2022-01-18

       2 upvotes

       The C is the correct answer. https://www.cisco.com/c/en/us/td/docs/security/asa/asa913/configuration/general/asa-913-general-config/intro-fw.html Passing Traffic Not Allowed in Routed Mode In routed mode, some types of traffic cannot pass through the ASA even if you allow it in an access rule. The bridge group, however, can allow almost any traffic through using either an access rule (for IP traffic) or an EtherType rule (for non-IP traffic): IP traffic—In routed firewall mode, broadcast and "multicast traffic is blocked even if you allow it in an access rule," including unsupported dynamic routing protocols and DHCP (unless you configure DHCP relay). Within a bridge group, you can allow this traffic with an access rule (using an extended ACL). Non-IP traffic—AppleTalk, IPX, BPDUs, and MPLS, for example, can be configured to go through using an EtherType rule. Note "The bridge group does not pass CDP packets packets, or any packets that do not have a valid EtherType greater than or equal to 0x600. An exception is made for BPDUs and IS-IS, which are supported. "

    4. B

       Bobster02

       2021-06-13

       2 upvotes

       My vote goes to the original answer D. Organization already has bridge groups with firewall interfaces. Cisco configuration guide says: Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of its screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a “bump in the wire,” or a “stealth firewall,” and is not seen as a router hop to connected devices. However, like any other firewall, access control between interfaces is controlled, and all of the usual firewall checks are in place. Layer 2 connectivity is achieved by using a "bridge group" where you group together the inside and outside interfaces for a network, and the Firepower Threat Defense device uses bridging techniques to pass traffic between the interfaces. Each bridge group includes a Bridge Virtual Interface (BVI) to which you assign an IP address on the network. You can have multiple bridge groups for multiple networks. In transparent mode, these bridge groups cannot communicate with each other.

18. Question 18 of 25

    Select 2

    Which two routing options are valid with Cisco FTD? (Choose two.)

    • ABGPv6
    • BECMP with up to three equal cost paths across multiple interfaces
    • CECMP with up to three equal cost paths across a single interface
    • DBGPv4 in transparent firewall mode
    • EBGPv4 with nonstop forwarding

    Show answer

    Correct answer: A, B

    How others answered

    • AB63%
    • BE38%

    Only 63% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A : https://www.cisco.com/c/en/us/td/docs/security/firepower/660/fdm/fptd-fdm-config-guide-660/fptd-fdm-bgp.html " BGP IPv4 is supported both on global and user-defined virtual routers. However, only BGP IPv6 configuration is supported on a global virtual router." Its about Cisco FTD devices and not Cisco FTDv appliance B : https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/routing-ecmp.html " You can have up to 8 equal cost static or dynamic routes across up to 8 interfaces within each zone." I read this as 1 equal cost route per interface. So 3 equal cost paths means 3 interfaces, not 1. So B must be valid and not C.

    Adapted from community discussion by rbrain · 2024-12-10 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. N

       netwguy

       2021-09-02

       6 upvotes

       Cisco is trying to throw us off here - correct answers are A and C. As pfunky states, we can have up to 8 routes, meaning that C is a "valid" answer. The reason E is incorrect is that we cannot configure NSF for BGPv4 - we can only configure graceful restart, which relies on info from NSF capable/aware devices. For OSPF however, we can configure a device to be fully NSF capable/aware. Read through this if you are still in doubt: https://www.cisco.com/c/en/us/td/docs/security/firepower/660/fdm/fptd-fdm-config-guide-660/fptd-fdm-ospf.html

    2. R

       rbrain

       2024-12-10

       Selected A, B2 upvotes

       A : https://www.cisco.com/c/en/us/td/docs/security/firepower/660/fdm/fptd-fdm-config-guide-660/fptd-fdm-bgp.html " BGP IPv4 is supported both on global and user-defined virtual routers. However, only BGP IPv6 configuration is supported on a global virtual router." Its about Cisco FTD devices and not Cisco FTDv appliance B : https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/routing-ecmp.html " You can have up to 8 equal cost static or dynamic routes across up to 8 interfaces within each zone." I read this as 1 equal cost route per interface. So 3 equal cost paths means 3 interfaces, not 1. So B must be valid and not C.

    3. A

       Abetong

       2023-08-26

       1 upvote

       https://www.cisco.com/c/en/us/td/docs/security/firepower/622/configuration/guide/fpmc-config-guide-v622/bgp_for_firepower_threat_defense.html#:~:text=BGP%20is%20supported%20only%20in%20routed%20mode. Guidelines for BGP Firewall Mode Guidelines Does not support transparent firewall mode. BGP is supported only in routed mode. FTD supports BGPv6 https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/bgp_for_firepower_threat_defense.html FTD ECMP https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/routing-ecmp.html The FTD device supports Equal-Cost Multi-Path (ECMP) routing. You can configure traffic zones per virtual router to contain a group of interfaces. You can have up to 8 equal cost static or dynamic routes across up to 8 interfaces within each zone. For example, you can configure multiple default routes across three interfaces in the zone

    4. B

       Bubu3k

       2024-01-03

       Selected A, B2 upvotes

       https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/routing-ecmp.html "You can associate only 8 interfaces per ECMP zone."

19. Question 19 of 25

    A security engineer is configuring an Access Control Policy for multiple branch locations. These locations share a common rule set and utilize a network object called INSIDE_NET which contains the locally significant internal network subnets at each location. What technique will retain the policy consistency at each location but allow only the locally significant network subnet within the application rules?

    • Autilizing a dynamic ACP that updates from Cisco Talos
    • Bcreating a unique ACP per device
    • Cutilizing policy inheritance
    • Dcreating an ACP with an INSIDE_NET network object and object overrides

    Show answer

    Correct answer: D

    How others answered

    • D69%
    • C31%

    Only 69% agreed on this answer — treat it as contested rather than settled.

    Explanation

    should be D, policy inheritance is doing part of the job, but the more important thing is to have the object values specific to the location, which can be done with object overrides https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Reusable_Objects.html#concept_8BFE8B9A83D742D9B647A74F7AD50053

    Adapted from community discussion by Kris92 · 2024-08-24 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. 1

       14a1949

       2025-01-14

       Selected D1 upvote

       The best technique to retain policy consistency across multiple branch locations while allowing only the locally significant network subnet within the application rules is: **D. creating an ACP with an INSIDE_NET network object and object overrides** This approach allows you to maintain a consistent Access Control Policy (ACP) across all locations while using object overrides to specify the locally significant subnets for each branch (https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/access-rules.html) (https://www.cisco.com/c/en/us/td/docs/security/firepower/710/fdm/fptd-fdm-config-guide-710/fptd-fdm-access.html).

    2. K

       Kris92

       2024-08-24

       Selected D2 upvotes

       should be D, policy inheritance is doing part of the job, but the more important thing is to have the object values specific to the location, which can be done with object overrides https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Reusable_Objects.html#concept_8BFE8B9A83D742D9B647A74F7AD50053

    3. M

       Mevijil

       2023-06-17

       Selected D2 upvotes

       Definitely D - object override allows you to create a single object with multiple values, which is what they're doing for the two different networks sharing one rule set

    4. S

       SegaMasterSystemAdmin

       2023-12-08

       2 upvotes

       no that can't be it because policy inheritance will just ensure that child policies will inherit the policies from the parent policy

20. Question 20 of 25

    An organization is setting up two new Cisco FTD devices to replace their current firewalls and cannot have any network downtime. During the setup process, the synchronization between the two devices is failing. What action is needed to resolve this issue?

    • AConfirm that both devices are running the same software version.
    • BConfirm that both devices are configured with the same types of interfaces.
    • CConfirm that both devices have the same flash memory sizes.
    • DConfirm that both devices have the same port-channel numbering.

    Show answer

    Correct answer: C

    How others answered

    • C55%
    • A45%

    Only 55% agreed on this answer — treat it as contested rather than settled.

    Explanation

    C I agree with everyone, The devices must have the same type and number of interfaces and software needs to be on same version. However, the question is specifically touching on synchronization issues, so the answer is C. If you are using units with different flash memory sizes in your High Availability configuration, make sure the unit with the smaller flash memory has enough space to accommodate the software image files and the configuration files. If it does not, configuration synchronization from the unit with the larger flash memory to the unit with the smaller flash memory will fail. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/firepower_threat_defense_high_availability.html

    Adapted from community discussion by jamesque23 · 2022-06-03 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. J

       jamesque23

       2022-06-03

       4 upvotes

       C I agree with everyone, The devices must have the same type and number of interfaces and software needs to be on same version. However, the question is specifically touching on synchronization issues, so the answer is C. If you are using units with different flash memory sizes in your High Availability configuration, make sure the unit with the smaller flash memory has enough space to accommodate the software image files and the configuration files. If it does not, configuration synchronization from the unit with the larger flash memory to the unit with the smaller flash memory will fail. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/firepower_threat_defense_high_availability.html

    2. S

       SegaMasterSystemAdmin

       2023-12-06

       Selected C4 upvotes

       The answer is C because if the flash memory is smaller on the secondary, then syncing will fail. Confirming that both devices are running the same code is a perquisite for HA and does not have anything to do with synchronization failure.

    3. U

       ureis

       2023-11-03

       5 upvotes

       you dont need same exactly size flash to make HA, just need enought space, not exact space

    4. O

       orotta

       2022-08-13

       4 upvotes

       The question is not asking the requirement of HA, but it is asking "During the setup process the synchronization between the HA fails" so the answer is the synchronization fails due to less flash memory space in the second firewall

21. Question 21 of 25

    An administrator is working on a migration from Cisco ASA to the Cisco FTD appliance and needs to test the rules without disrupting the traffic. Which policy type should be used to configure the ASA rules during this phase of the migration?

    • APrefilter
    • BIntrusion
    • CAccess Control
    • DIdentity

    Show answer

    Correct answer: A

    How others answered

    • A52%
    • C48%

    Only 52% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I change my mind to A after reading this document --> https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/prefiltering_and_prefilter_policies.html Fastpath vs Trust discussion Fastpath and there for prefilter wins because it bypasses all further inspection and handling instead of only exempt from deep inspection and discovery, aka Trust function in ACL. On top of that you only have to configure it once in the ACL policy instead on per rule base

    Adapted from community discussion by rbrain · 2024-12-11 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • cisco.com documentation
    • cisco.com documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. I

       Initial14

       2023-10-12

       Selected A4 upvotes

       When you migrate from ASA to FTD you use prefilter. The question states: "to test the rules without disrupting the traffic" this is done with prefilter. With prefilter you only have rules based on L3 and L4, same as ASA. This is also in cisco's whitepaper regarding migration from ASA to FTD

    2. R

       rbrain

       2024-12-11

       Selected A2 upvotes

       I change my mind to A after reading this document --> https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/prefiltering_and_prefilter_policies.html Fastpath vs Trust discussion Fastpath and there for prefilter wins because it bypasses all further inspection and handling instead of only exempt from deep inspection and discovery, aka Trust function in ACL. On top of that you only have to configure it once in the ACL policy instead on per rule base

    3. K

       Kris92

       2024-08-24

       Selected A1 upvote

       Both Prefilter and ACP are correct here, there are a bunch of discussions on the community around this topic, generally speaking I would probably go with ACP, but I believe that by default the migration tool will migrate the rules to prefilter and that's the answer they are going for here. https://community.cisco.com/t5/network-security/firepower-prefilter-or-access-control-policy/td-p/3832096 https://community.cisco.com/t5/network-security/asa-to-ftd-policy-migration-best-practice/td-p/3081218 https://community.cisco.com/t5/network-security/asa-ftd-migration-prefilter-policy-or-access-control-policy/td-p/4587384

    4. 1

       14a1949

       2025-01-14

       Selected A1 upvote

       he correct answer is actually A. Prefilter. Prefilter policies are designed to quickly filter traffic before it reaches the deeper inspection engines, allowing you to test rules without disrupting the traffic. This is particularly useful during a migration phase, as it ensures that the network's performance is not impacted while you configure and test the new rules. Access Control policies (Option C) are used to define and enforce security rules, but they do not specifically provide the capability to test rules without affecting traffic in the same way that prefilter policies do.

22. Question 22 of 25

    What is the benefit of selecting the trace option for packet capture?

    • AThe option indicates whether the packet was dropped or successful.
    • BThe option indicates whether the destination host responds through a different path.
    • CThe option limits the number of packets that are captured.
    • DThe option captures details of each packet.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Correct answer is A. Because - Packet capture is available with the trace option, which provides you with a verdict as to whether the packet is dropped or successful. https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/troubleshooting_the_system.html#:~:text=Packet%20capture%20is%20available%20with%20the%20trace%20option%2C%20which%20provides%20you%20with%20a%20verdict%20as%20to%20whether%20the%20packet%20is%20dropped%20or%20successful.

    Adapted from community discussion by Heorhiiyatskovskyi · 2022-08-10 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. H

       Heorhiiyatskovskyi

       2022-08-10

       9 upvotes

       Correct answer is A. Because - Packet capture is available with the trace option, which provides you with a verdict as to whether the packet is dropped or successful. https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/troubleshooting_the_system.html#:~:text=Packet%20capture%20is%20available%20with%20the%20trace%20option%2C%20which%20provides%20you%20with%20a%20verdict%20as%20to%20whether%20the%20packet%20is%20dropped%20or%20successful.

    2. S

       Sarbi

       2022-09-30

       3 upvotes

       Looks to me A. he packet capture feature with trace option allows real packets that are captured on the ingress interface to be traced through the system. The trace information is displayed at a later stage. These packets are not dropped on the egress interface, as they are real data-path traffic. Packet capture for Firepower Threat Defense devices supports troubleshooting and analysis of data packets. Once the packet is acquired, snort detects the tracing flag that is enabled in the packet. Snort writes tracer elements, through which the packet traverses. Snort verdict as a result of capturing packets can be one of DROP/ALLOW/Would DROP. The file-size option is used when you need to capture packets with the size limit more than 32 MB.

    3. J

       James3222

       2022-03-31

       3 upvotes

       Answer: D The trace function provides additional details when doing a packet capture. "Tracing a real packet can be very useful to troubleshoot connectivity issues. It allows you to see all the internal checks that a packet goes through." https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212474-working-with-firepower-threat-defense-f.html#anc13

    4. A

       AS04

       2022-08-02

       3 upvotes

       The answer is A, trace does provide detail but you ultimately look at the result portion to see if the packet allowed or dropped.

23. Question 23 of 25

    Which command should be used on the Cisco FTD CLI to capture all the packets that hit an interface?

    • Aconfigure coredump packet-engine enable
    • Bcapture-traffic
    • Ccapture
    • Dcapture WORD

    Show answer

    Correct answer: D

    How others answered

    • D81%
    • C19%

    Explanation

    Answer: C Reason: the command "capture-traffic" is used for SNORT Engine Captures. To capture a LINA Engine Capture, you use the "capture" command. Since the Lina Engine represents the actual physical interface of the device, "capture" is the only reasonable choice Reference: https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212474-working-with-firepower-threat-defense-f.html#anc10

    Adapted from community discussion by James3222 · 2022-04-03 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. J

       James3222

       2022-04-03

       13 upvotes

       Answer: C Reason: the command "capture-traffic" is used for SNORT Engine Captures. To capture a LINA Engine Capture, you use the "capture" command. Since the Lina Engine represents the actual physical interface of the device, "capture" is the only reasonable choice Reference: https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212474-working-with-firepower-threat-defense-f.html#anc10

    2. J

       Joe_Blue

       2024-03-09

       Selected D4 upvotes

       Here's the syntax: capture interface [buffer ] [match ] [packet-length ]

    3. S

       SanchezEldorado

       2023-04-30

       Selected D3 upvotes

       James is right about the capture-traffic command, but D is a better answer than C. Go into the cli, type "capture" then hit the question mark. The only option is "WORD". WORD represents a capture name. D is more specific than C.

    4. J

       johanhc20

       2023-07-23

       Selected D3 upvotes

       Im going with D on this one. You cannot send the command "capture" from CLI - the command needs a name argument following "capture". You can send the command "capture [WORD]" with following , from both LINA and CLIish.

24. Question 24 of 25

    Select 2

    Which two considerations must be made when deleting and re-adding devices while managing them via Cisco FMC? (Choose two.)

    • AAn option to re-apply NAT and VPN policies during registration is available, so users do not need to re-apply the policies after registration is completed.
    • BBefore re-adding the device in Cisco FMC, the manager must be added back.
    • COnce a device has been deleted, it must be reconfigured before it is re-added to the Cisco FMC.
    • DThe Cisco FMC web interface prompts users to re-apply access control policies.
    • EThere is no option to re-apply NAT and VPN policies during registration available, so users need to re-apply the policies after registration is completed.

    Show answer

    Correct answer: D, E

    How others answered

    • DE60%
    • BE40%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    It's D & E for sure. "When a device is deleted and then re-added, the FMC web interface prompts you to re-apply your access control policies. However, there is no option to re-apply the NAT and VPN policies during registration. Any previously applied NAT or VPN configuration will be removed during registration and must be re-applied after registration is complete." https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Device_Management_Basics.html#ID-2242-00000786 When a device is deleted from FMC, the manager is not automatically removed.

    Adapted from community discussion by Stevens0103 · 2024-07-21 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. S

       Stevens0103

       2024-07-21

       Selected D, E2 upvotes

       It's D & E for sure. "When a device is deleted and then re-added, the FMC web interface prompts you to re-apply your access control policies. However, there is no option to re-apply the NAT and VPN policies during registration. Any previously applied NAT or VPN configuration will be removed during registration and must be re-applied after registration is complete." https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Device_Management_Basics.html#ID-2242-00000786 When a device is deleted from FMC, the manager is not automatically removed.

    2. 1

       14a1949

       2025-01-14

       Selected D, E2 upvotes

       When a device is deleted and then re-added, the FMC web interface prompts you to re-apply your access control policies. However, there is no option to re-apply the NAT and VPN policies during registration. Any previously applied NAT or VPN configuration will be removed during registration and must be re-applied after registration is complete. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/device_management_basics.html

    3. R

       rcharger00

       2022-11-22

       2 upvotes

       D&E is correct https://www.cisco.com/c/en/us/td/docs/security/firepower/670/configuration/guide/fpmc-config-guide-v67/device_management_basics.html?bookSearch=true When a device is deleted and then re-added, the FMC web interface prompts you to re-apply your access control policies. However, there is no option to re-apply the NAT and VPN policies during registration. Any previously applied NAT or VPN configuration will be removed during registration and must be re-applied after registration is complete.

    4. S

       Samer0100

       2024-09-21

       Selected D, E1 upvote

       ***copied from cisco configuration guide*** When a device is deleted and then re-added, the FMC web interface prompts you to re-apply your access control policies. However, there is no option to re-apply the NAT and VPN policies during registration. Any previously applied NAT or VPN configuration will be removed during registration and must be re-applied after registration is complete. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/device_management_basics.html

25. Question 25 of 25

    After using Firepower for some time and learning about how it interacts with the network, an administrator is trying to correlate malicious activity with a user. Which widget should be configured to provide this visibility on the Cisco Firepower dashboards?

    • ACurrent Sessions
    • BCorrelation Events
    • CCurrent Status
    • DCustom Analysis

    Show answer

    Correct answer: B

    How others answered

    • B67%
    • D33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    https://www.cisco.com/c/en/us/td/docs/security/firepower/670/configuration/guide/fpmc-config-guide-v67/dashboards.html#ID-2206-00000283 The Correlation Events widget shows the average number of correlation events per second, by priority. D - right answer

    Adapted from community discussion by kakakayayaya · 2021-12-13 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-710 or CertExamHQ.

    1. K

       kakakayayaya

       2021-12-13

       4 upvotes

       https://www.cisco.com/c/en/us/td/docs/security/firepower/670/configuration/guide/fpmc-config-guide-v67/dashboards.html#ID-2206-00000283 The Correlation Events widget shows the average number of correlation events per second, by priority. D - right answer

    2. B

       Bobster02

       2021-12-13

       4 upvotes

       My choice is answer D. https://www.cisco.com/c/en/us/td/docs/security/firepower/622/configuration/guide/fpmc-config-guide-v622/dashboards.html#ID-2206-00000283

    3. J

       Joe_Blue

       2023-09-11

       Selected B3 upvotes

       The Correlation Events widget should be configured to provide visibility of malicious activity correlated with a user on the Cisco Firepower dashboards.

    4. 1

       14a1949

       2025-01-14

       Selected B1 upvote

       The Custom Analysis widget (Option D) allows for creating tailored views and reports based on specific criteria, which can be very useful for various types of analysis. However, it is not specifically designed for correlating malicious activity with users. The Correlation Events widget (Option B) is specifically intended to provide visibility into events triggered by correlation rules, which are designed to detect and track malicious activities. This makes it the most suitable choice for correlating malicious activity with a user on the Cisco Firepower dashboards.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 1 of 25