300-710 practice questions 111–120

1. Question 111 · 338 in bank

   A network administrator is trying to convert from LDAP to LDAPS for VPN user authentication on a Cisco FTD. Which action must be taken on the Cisco FTD objects to accomplish this task?

   • AIdentify the LDAPS cipher suite and use a Cipher Suite List object to define the Cisco FTD connection requirements.
   • BModify the Policy List object to define the session requirements for LDAPS.
   • CAdd a Key Chain object to acquire the LDAPS certificate.
   • DCreate a Certificate Enrollment object to get the LDAPS certificate needed.

   Show answer

   Answer: D

   Explanation

   "7. If LDAPS or STARTTLS is used, the root CA also needs to be trusted by the FTD. In order to do this first navigate to Devices > Certificates." "Give the trustpoint a Name then choose Manual enrollment from the Enrollment Type dropdown. Paste the PEM root ca certificate here, then click Save." https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/216955-configure-ad-ldap-authentication-and-u.html

   Source: Adapted from community discussion — Stevens0103

   References

   • Cisco documentation
   • cisco.com documentation

   Next question

2. Question 112 · 338 in bank

   Which feature is supported by IRB on Cisco FTD devices?

   • Aredundant interface
   • Bhigh-availability cluster
   • Cdynamic routing protocol
   • DEtherChannel interface

   Show answer

   Answer: A

   Explanation

   IRB is not the same as dynamic routing protocols. The first thing in cisco whitepaper regarding routed/transparent firewall and IRB is unsupported feautures, and the unsupported is etherchannel, Dynamic routing protocols.. so only A si the right one

   Source: Adapted from community discussion — Initial14

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 113 · 338 in bank

   

   Refer to the exhibit. A systems administrator conducts a connectivity test to their SCCM server from a host machine and gets no response from the server. Which action ensures that the ping packets reach the destination and that the host receives replies?

   • AConfigure a custom Snort signature to allow ICMP traffic after inspection.
   • BModify the Snort rules to allow ICMP traffic.
   • CCreate an access control policy rule that allows ICMP traffic.
   • DCreate an ICMP allow list and add the ICMP destination to remove it from the implicit deny list.

   Show answer

   Answer: C

   Explanation

   You are wrong. You can modify SNORT rule. From this : https://www.cisco.com/c/en/us/td/docs/security/firepower/70/snort3/config-guide/snort3-configuration-guide-v70/overview.html#concept_D87B73A83ACA42CCA656F0041F9D860B .... Snort 3 is architecturally redesigned to inspect more traffic with equivalent resources when compared to Snort 2. Snort 3 provides simplified and flexible insertion of traffic parsers. Snort 3 also provides new rule syntax that makes rule writing easier and shared object rule equivalents visible. ....

   Source: Adapted from community discussion — Vlad_Is_Love_ua

   References

   • Cisco documentation
   • cisco.com documentation
   • cisco.com documentation

   Next question

4. Question 114 · 338 in bank

   While configuring FTD, a network engineer wants to ensure that traffic passing though the appliance does not require routing or VLAN rewriting. Which interface mode should the engineer implement to accomplish this task?

   • Ainline set
   • Bpassive
   • Ctransparent
   • Dinline tap

   Show answer

   Answer: A

   Explanation

   "traffic passing though the appliance" - Passive interface doesn't allow this. Transparent - is not an interface mode. "inline tap" can be appropriate but it should be named as "inline set with tap". As for me "inline set" - is the best choice.

   Source: Adapted from community discussion — kakakayayaya

   References

   • Cisco documentation

   Next question

5. Question 115 · 338 in bank

   An administrator is setting up a Cisco FMC and must provide expert mode access for a security engineer. The engineer is permitted to use only a secured out-of-band network workstation with a static IP address to access the Cisco FMC. What must be configured to enable this access?

   • AEnable SSH and define an access list.
   • BEnable HTTPS and SNMP under the Access List section.
   • CEnable SCP under the Access List section.
   • DEnable HTTP and define an access list.

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

6. Question 116 · 338 in bank

   A network administrator registered a new FTD to an existing FMC. The administrator cannot place the FTD in transparent mode. Which action enables transparent mode?

   • ADeregister the FTD device from FMC and configure transparent mode via the CLI.
   • BObtain an FTD model that supports transparent mode.
   • CAdd a Bridge Group Interface to the FTD before transparent mode is configured.
   • DAssign an IP address to two physical interfaces.

   Show answer

   Answer: A

   Explanation

   A is the correct answer 100% "steps to change FTD mode: 1- Deregister the FTD device from the FMC. You cannot change the mode until you deregister the device. 2-Access the FTD device CLI 3- Change the firewall mode: configure firewall [routed | transparent]' Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/601/configuration/guide/fpmc-config-guide-v601/fpmc-config-guide-v601_chapter_01101010.html#:~:text=Deregister%20the%20FTD,deregister%20the%20device.

   Source: Adapted from community discussion — DID123

   References

   • Cisco documentation
   • Cisco documentation

   Next question

7. Question 117 · 338 in bank

   Select 2

   A network engineer must provide redundancy between two Cisco FTD devices. The redundancy configuration must include automatic configuration, translation, and connection updates. After the initial configuration of the two appliances, which two steps must be taken to proceed with the redundancy configuration? (Choose two.)

   • AConfigure the virtual MAC address on the failover link.
   • BConfigure the failover link with stateful properties.
   • CDisable hellos on the inside interface.
   • DEnsure the high availability license is enabled.
   • EConfigure the standby IP addresses.

   Show answer

   Answer: BE

   Explanation

   The two steps that must be taken to proceed with the redundancy configuration between two Cisco FTD devices are: B. Configure the failover link with stateful properties. E. Configure the standby IP addresses.

   Source: Adapted from community discussion — Joe_Blue

   Next question

8. Question 118 · 338 in bank

   An administrator is attempting to add a new FTD device to their FMC behind a NAT device with a NAT ID of NAT001 and a password of Cisco0123456789. The private IP address of the FMC server is 192.168.45.45, which is being translated to the public IP address of 209.165.200.225/27. Which command set must be used in order to accomplish this task?

   • Aconfigure manager add 209.165.200.225 255.255.255.224
   • Bconfigure manager add 209.165.200.225
   • Cconfigure manager add 209.165.200.225/27
   • Dconfigure manager add 192.168.45.45

   Show answer

   Answer: B

   Explanation

   B is the closest--well, none of them have the password included but since we are not using the NATID/Donotresolve I think we need the outside IP of the device in the add manager statement

   Source: Adapted from community discussion — THEODORABLE

   Next question

9. Question 119 · 338 in bank

   An engineer attempts to pull the configuration for a Cisco FTD sensor to review with Cisco TAC but does not have direct access to the CLI for the device. The CLI for the device is managed by Cisco FMC to which the engineer has access. Which action in Cisco FMC grants access to the CLI for the device?

   • ACreate a backup of the configuration within the Cisco FMC.
   • BDownload the configuration file within the File Download section of Cisco FMC.
   • CExport the configuration using the Import/Export tool within Cisco FMC.
   • DUse the show run all command in the Cisco FTD CLI feature within Cisco FMC.

   Show answer

   Answer: D

   Explanation

   For those of you struggling to find this FTD CLI they are referring to, it's not really a full CLI but more like a command injector that uses the LINA engine to pull CLI data from the FTD. This tool is located under settings/Health/Monitor/Devices, select , View System & Troubleshooting Details.../Advanced Troubleshooting/Threat Defense CLI/ and then select a command or set your own and execute it to receive output. The answer is 100% D! I confirmed this myself on version 7.0.1

   Source: Adapted from community discussion — trudint

   Next question

10. Question 120 · 338 in bank

    An engineer must add DNS-specific rules to the Cisco FTD intrusion policy. The engineer wants to use the rules currently in the Cisco FTD Snort database that are not already enabled but does not want to enable more than are needed. Which action meets these requirements?

    • AChange the rules using the Generate and Use Recommendations feature.
    • BChange the rule state within the policy being used.
    • CChange the dynamic state of the rule within the policy.
    • DChange the base policy to Security over Connectivity.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 111. 338 questions available.