300-710 practice questions 121–130

1. Question 121 · 338 in bank

   Select 2

   A security engineer must deploy a Cisco FTD appliance as a bump in the wire to detect intrusion events without disrupting the flow of network traffic. Which two features must be configured to accomplish the task? (Choose two.)

   • Atransparent mode
   • Btap mode
   • Cbridged mode
   • Dinline set pair
   • Epassive interfaces

   Show answer

   Answer: BD

   Explanation

   I would say A&B- both config guide descriptions use the term Bump in the wire and a TAP mode interface hase to be inline to begin with. https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/inline_sets_and_passive_interfaces_for_firepower_threat_defense.html

   Source: Adapted from community discussion — THEODORABLE

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

2. Question 122 · 338 in bank

   A network administrator has converted a Cisco FTD from using LDAP to LDAPS for VPN authentication. The Cisco FMC can connect to the LDAPS server, but the Cisco FTD is not connecting. Which configuration must be enabled on the Cisco FTD?

   • AThe LDAPS must be allowed through the access control policy.
   • BThe RADIUS server must be defined.
   • CSSL must be set to a use TLSv1.2 or lower.
   • DDNS servers must be defined for name resolution.

   Show answer

   Answer: D

   Explanation

   D- https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/215538-configure-firepower-management-center-an.html see: 3. SSL or TLS does not work as expected If you don't enable DNS on the FTDs, you can see errors in the pigtail log that suggest that LDAP is unreachable:

   Source: Adapted from community discussion — THEODORABLE

   References

   • Cisco documentation
   • cisco.com documentation

   Next question

3. Question 123 · 338 in bank

   A security engineer is deploying a pair of primary and secondary Cisco FMC devices. The secondary must also receive updates from Cisco Talos. Which action achieves this goal?

   • AManually import rule updates onto the secondary Cisco FMC device.
   • BForce failover for the secondary Cisco FMC to synchronize the rule updates from the primary.
   • CConfigure the primary Cisco FMC so that the rules are updated.
   • DConfigure the secondary Cisco FMC so that it receives updates from Cisco Talos.

   Show answer

   Answer: C

   Explanation

   Correct - If your deployment includes a high availability pair of Firepower Management Centers, import the update on the primary only. The secondary Firepower Management Center receives the rule update as part of the regular synchronization process. https://www.cisco.com/c/en/us/td/docs/security/firepower/670/configuration/guide/fpmc-config-guide-v67/system_software_updates.html

   Source: Adapted from community discussion — Mevijil

   References

   • Cisco documentation

   Next question

4. Question 124 · 338 in bank

   A security engineer must configure a Cisco FTD appliance to inspect traffic coming from the internet. The internet traffic will be mirrored from the Cisco Catalyst 9300 Switch. Which configuration accomplishes the task?

   • ASet the firewall mode to routed.
   • BSet interface configuration mode to passive.
   • CSet the firewall mode to transparent.
   • DSet interface configuration mode to none.

   Show answer

   Answer: B

   Explanation

   B ERSPAN == Routed Mode == Multiple Switch Passive == Routed Mode == Single Switch When you configure the FTD in a passive deployment, the FTD cannot take certain actions such as blocking or shaping traffic. Passive interfaces receive all traffic unconditionally. and no traffic received on these interfaces is retransmitted. Encapsulated remote switched port analyzer (ERSPAN) interfaces allow you to monitor traffic from source ports distributed over multiple switches, and uses GRE to encapsulate the traffic. ERSPAN interfaces are only allowed when the FTD is in routed firewall mode.

   Source: Adapted from community discussion — c946f3e

   References

   • Cisco documentation

   Next question

5. Question 125 · 338 in bank

   A mid-sized company is experiencing higher network bandwidth utilization due to a recent acquisition. The network operations team is asked to scale up their one Cisco FTD appliance deployment to higher capacities due to the increased network bandwidth. Which design option should be used to accomplish this goal?

   • ADeploy multiple Cisco FTD HA pairs in clustering mode to increase performance.
   • BDeploy multiple Cisco FTD appliances in firewall clustering mode to increase performance.
   • CDeploy multiple Cisco FTD appliances using VPN load-balancing to scale performance.
   • DDeploy multiple Cisco FTD HA pairs to increase performance.

   Show answer

   Answer: B

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/clustering/ftd-cluster-solution.html#concept_C8502505F840451C9E600F1EED9BC18E

   Source: Adapted from community discussion — tanri04

   Next question

6. Question 126 · 338 in bank

   

   Refer to the exhibit. An engineer is analyzing a Network Risk Report from Cisco FMC. Which application must the engineer take immediate action against to prevent unauthorized network use?

   • AYouTube
   • BTOR
   • CChrome
   • DKerberos

   Show answer

   Answer: B

   Explanation

   Answer is B. YouTube can have use as a research tool. TOR has been linked to illegal activity and no business being used in workplace. EVER!

   Source: Adapted from community discussion — bassfunk

   Next question

7. Question 127 · 338 in bank

   An organization is implementing Cisco FTD using transparent mode in the network. Which rule in the default Access Control Policy ensures that this deployment does not create a loop in the network?

   • AMulticast and broadcast packets are denied by default
   • BSTP BPDU packets are allowed by default.
   • CARP inspection is enabled by default.
   • DARP packets are allowed by default.

   Show answer

   Answer: B

   Explanation

   BPDU Handling To prevent loops using the Spanning Tree Protocol, BPDUs are passed by default. By default BPDUs are also forwarded for advanced inspection, which is unnecessary for this type of packet, and which can cause problems if they are blocked due to an inspection restart, for example. We recommend that you always exempt BPDUs from advanced inspection. To do so, use FlexConfig to configure an EtherType ACL that trusts BPDUs and exempts them from advanced inspection on each member interface. See FlexConfig Policies for FTD. https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html

   Source: Adapted from community discussion — GCalvo

   References

   • Cisco documentation

   Next question

8. Question 128 · 338 in bank

   Select 2

   When a Cisco FTD device is configured in transparent firewall mode, on which two interface types can an IP address be configured? (Choose two.)

   • APhysical
   • BEtherChannel
   • CSubinterface
   • DBVI
   • EDiagnostic

   Show answer

   Answer: DE

   Explanation

   D and E are correct. in transparent firewall mode you can only configure BVI and Diagnostic but not the physical interfaces

   Source: Adapted from community discussion — SegaMasterSystemAdmin

   References

   • Cisco documentation

   Next question

9. Question 129 · 338 in bank

   A security engineer needs to configure a network discovery policy on a Cisco FMC appliance and prevent excessive network discovery events from overloading the FMC database? Which action must be taken to accomplish this task?

   • AMonitor only the default IPv4 and IPv6 network ranges.
   • BConfigure NetFlow exporters for monitored networks.
   • CChange the network discovery method to TCP/SYN.
   • DExclude load balancers and NAT devices in the policy.

   Show answer

   Answer: D

   Explanation

   From this source look under section "network discovery rules": We recommend that you exclude load balancers (or specific ports on load balancers) and NAT devices from monitoring. These devices may create excessive and misleading events, filling the database and overloading the Firepower Management Center. https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Network_Discovery_Policies.html

   Source: Adapted from community discussion — 0b274d3

   References

   • Cisco documentation

   Next question

10. Question 130 · 338 in bank

    An organization is installing a new Cisco FTD appliance in the network. An engineer is tasked with configuring access between two network segments within the same IP subnet. Which step is needed to accomplish this task?

    • ASpecify a name for the bridge group.
    • BAssign an IP address to the Bridge Virtual Interface.
    • CPermit BPDU packets to prevent loops.
    • DAdd a separate bridge group for each segment.

    Show answer

    Answer: B

    Explanation

    About Routed Firewall Mode Different Subnets (192.168.1.0/24 + 172.16.0.1/24) FTD device uses bridging techniques to pass traffic between the interfaces. Each bridge group includes a Bridge Virtual Interface (BVI) to which you assign an IP address on the network. The FTD device routes between BVIs and regular routed interfaces About Transparent Firewall Mode (192.168.1.0/24) Same Subnet Layer 2 connectivity is achieved by using a "bridge group" where you group together the inside and outside interfaces for a network, and the FTD device uses bridging techniques to pass traffic between the interfaces. Each bridge group includes a Bridge Virtual Interface (BVI) to which you assign an IP address on the network. You can have multiple bridge groups for multiple networks Question is asking "a new Cisco FTD appliance in the network"It means 1 device for 2 segments (L2) Thus, I will go with B

    Source: Adapted from community discussion — gwb

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 121. 338 questions available.