300-710 practice questions 131–140

1. Question 131 · 338 in bank

   An engineer defines a new rule while configuring an Access Control Policy. After deploying the policy, the rule is not working as expected and the hit counters associated with the rule are showing zero. What is causing this error?

   • AAn incorrect application signature was used in the rule.
   • BThe wrong source interface for Snort was selected in the rule.
   • CThe rule was not enabled after being created.
   • DLogging is not enabled for the rule.

   Show answer

   Answer: A

   Explanation

   Only A. Incorrect Application signature: Lets say you want to block facebook, and instead facebook you used Facebook games. B and D makes no sense C: Rules are enabled by default, only SNORT rules need to be enabled (drop and generate events, generate events,...) to take action.

   Source: Adapted from community discussion — Initial14

   References

   • Cisco documentation

   Next question

2. Question 132 · 338 in bank

   An administrator needs to configure Cisco FMC to send a notification email when a data transfer larger than 10 MB is initiated from an internal host outside of standard business hours. Which Cisco FMC feature must be configured to accomplish this task?

   • Afile and malware policy
   • Bapplication detector
   • Ccorrelation policy
   • Dintrusion policy

   Show answer

   Answer: C

   Explanation

   The correct answer is C. To accomplish this task, the administrator must configure a correlation policy in Cisco FMC. Correlation policies allow you to correlate security events based on various criteria, including time of day, user, source/destination IP address, and more. When the specified criteria are met, the correlation policy can trigger a response action, such as sending an email notification.

   Source: Adapted from community discussion — Joe_Blue

   References

   • Cisco documentation

   Next question

3. Question 133 · 338 in bank

   Which process should be checked when troubleshooting registration issues between Cisco FMC and managed devices to verify that secure communication is occurring?

   • Afpcollect
   • Bdhclient
   • Csfrmgr
   • Dsftunnel

   Show answer

   Answer: D

   Explanation

   sftunnel-status-brief To view a brief status of the connection (tunnel) between the device and the managing management center, use the sftunnel-status-brief command. sftunnel-status-brief > sftunnel-status-brief PEER:10.10.17.202 Registration: Completed. Connection to peer '10.10.17.202' Attempted at Mon Jun 15 09:21:57 2020 UTC Last disconnect time : Mon Jun 15 09:19:09 2020 UTC Last disconnect reason : Both control and event channel connections with peer went down

   Source: Adapted from community discussion — gwb

   Next question

4. Question 134 · 338 in bank

   A security engineer must integrate an external feed containing STIX/TAXII data with Cisco FMC. Which feature must be enabled on the Cisco FMC to support this connection?

   • AThreat Intelligence Director
   • BCisco Success Network
   • CSecurity Intelligence Feeds
   • DCisco Secure Endpoint Integration

   Show answer

   Answer: A

   Explanation

   The correct answer is A. To integrate an external feed containing STIX/TAXII data with Cisco FMC, the Threat Intelligence Director feature must be enabled. The Threat Intelligence Director is a feature of Cisco FMC that allows for the integration of external threat intelligence feeds, including those that use STIX/TAXII. The Threat Intelligence Director allows the Cisco FMC to receive threat intelligence data from external sources and use that data to inform security policies and block malicious traffic.

   Source: Adapted from community discussion — Joe_Blue

   Next question

5. Question 135 · 338 in bank

   In a multi-tenant deployment where multiple domains are in use, which update should be applied outside of the Global Domain?

   • Aminor upgrade
   • Blocal import of intrusion rules
   • CCisco Geolocation Database
   • Dlocal import of major upgrade

   Show answer

   Answer: B

   Explanation

   https://www.cisco.com/c/en/us/td/docs/security/firepower/670/configuration/guide/fpmc-config-guide-v67/system_software_updates.html B fits better In a multidomain deployment, you can import local intrusion rules in any domain. You can view local intrusion rules imported in the current domain and ancestor domains.

   Source: Adapted from community discussion — kakakayayaya

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 136 · 338 in bank

   A network administrator is configuring a site-to-site IPsec VPN to a router sitting behind a Cisco FTD. The administrator has configured an access policy to allow traffic to this device on UDP 500, 4500, and ESP. VPN traffic is not working. Which action resolves this issue?

   • AChange the access policy to allow all ports.
   • BEnable IPsec Inspection on the access policy.
   • CSet the allow action in the access policy to trust.
   • DModify the NAT policy to use the interface PAT.

   Show answer

   Answer: C

   Explanation

   A - necessary ports (and ESP protocol) are allowed already B - 'inspect ipsec-pass-thru' can be configured in policy-map so it is not part of access policy C - Ensures there are no further inspections just in case SNORT dropped the traffic. D - NAT detection during VPN negotiation will detect NAT anyway. It does not matter if 1:1 or PAT

   Source: Adapted from community discussion — spambox730

   Next question

7. Question 137 · 338 in bank

   When using Cisco Threat Response, which phase of the Intelligence Cycle publishes the results of the investigation?

   • Aprocessing
   • Bdirection
   • Cdissemination
   • Danalysis

   Show answer

   Answer: C

   Explanation

   Disseminate: The dissemination phase publishes the results of the investigation or threat hunt. This information is disseminated with a focus on the receivers of the information. At the tactical level, this information feeds back into the beginning of the F3EAD model, Find. Figure 3 illustrates the F3EAD model. https://cloudmanaged.ca/wp-content/uploads/2020/05/CTR_White_Paper.pdf

   Source: Adapted from community discussion — Bubu3k

   Next question

8. Question 138 · 338 in bank

   Select 2

   A security engineer is adding three Cisco FTD devices to a Cisco FMC. Two of the devices have successfully registered to the Cisco FMC. The device that is unable to register is located behind a router that translates all outbound traffic to the router’s WAN IP address. Which two steps are required for this device to register to the Cisco FMC? (Choose two.)

   • AReconfigure the Cisco FMC to use the device’s private IP address instead of the WAN address.
   • BConfigure a NAT ID on both the Cisco FMC and the device.
   • CReconfigure the Cisco FMC to use the device’s hostname instead of IP address.
   • DRemove the IP address defined for the device in the Cisco FMC.
   • EAdd the port number being used for PAT on the router to the device’s IP address in the Cisco FMC.

   Show answer

   Answer: BD

   Explanation

   PAT lets you use a single public IP address and unique ports to access the public network; these ports are dynamically assigned as needed, so you cannot initiate a connection to a device behind a PAT router. Normally, you need both IP addresses (along with a registration key) for both routing purposes and for authentication: the FMC specifies the device IP address when you add a device, and the device specifies the FMC IP address. However, if you only know one of the IP addresses, which is the minimum requirement for routing purposes, then you must also specify a unique NAT ID on both sides of the connection to establish trust for the initial communication and to look up the correct registration key. The FMC and device use the registration key and NAT ID (instead of IP addresses) to authenticate and authorize for initial registration. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/device_management_basics.html

   Source: Adapted from community discussion — Kris92

   References

   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation

   Next question

9. Question 139 · 338 in bank

   An engineer is setting up a remote access VPN on a Cisco FTD device and wants to define which traffic gets sent over the VPN tunnel. Which named object type in Cisco FMC must be used to accomplish this task?

   • Acrypto map
   • Bsplit tunnel
   • Caccess list
   • Droute map

   Show answer

   Answer: C

   Next question

10. Question 140 · 338 in bank

    An engineer needs to configure remote storage on Cisco FMC. Configuration backups must be available from a secure location on the network for disaster recovery. Reports need to back up to a shared location that auditors can access with their Active Directory logins. Which strategy must the engineer use to meet these objectives?

    • AUse NFS for both backups and reports.
    • BUse SSH for backups and NFS for reports.
    • CUse SMB for backups and NFS for reports.
    • DUse SMB for both backups and reports.

    Show answer

    Answer: D

    Explanation

    I take it back, answer would be D: "You cannot send backups to one remote system and reports to another, but you can choose to send either to a remote system and store the other on the Firepower Management Center." https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/system_configuration.html

    Source: Adapted from community discussion — Joninjimbo

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 131. 338 questions available.