300-710 practice questions 151–160

1. Question 151 · 338 in bank

   Network users are experiencing intermittent issues with internet access. An engineer identified that the issue is being caused by NAT exhaustion. How must the engineer change the dynamic NAT configuration to provide internet access for more users without running out of resources?

   • AConvert the dynamic auto NAT rule to dynamic manual NAT.
   • BAdd an identity NAT rule to handle the overflow of users.
   • CConfigure fallthrough to interface PAT on the Advanced tab.
   • DDefine an additional static NAT for the network object in use.

   Show answer

   Answer: C

   Explanation

   C is correct Fallthrough to Interface PAT (Destination Interface)—Whether to use the IP address of the destination interface as a backup method when the other mapped addresses are already allocated (interface PAT fallback). This option is available only if you select a destination interface that is not a member of a bridge group. https://www.cisco.com/c/en/us/td/docs/security/firepower/620/fdm/fptd-fdm-config-guide-620/fptd-fdm-nat.html

   Source: Adapted from community discussion — Doris8000

   References

   • Cisco documentation

   Next question

2. Question 152 · 338 in bank

   An engineer is configuring a custom intrusion rule on Cisco FMC. The engineer needs the rule to search the payload or stream for the string "|44 78 97 13 2 0A|". Which keyword must the engineer use with this string to create an argument for packet inspection?

   • Aprotected_content
   • Bcontent
   • Cdata
   • Dmetadata

   Show answer

   Answer: B

   Explanation

   "content When you use the content keyword, the rules engine searches the packet payload or stream for that string. For example, if you enter /bin/sh as the value for one of the content keywords, the rules engine searches the packet payload for the string /bin/sh. Match content using either an ASCII string, hexadecimal content (binary byte code), or a combination of both. Surround hexadecimal content with pipe characters (|) in the keyword value. For example, you can mix hexadecimal content and ASCII content using something that looks like |90C8 C0FF FFFF|/bin/sh." https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/intrusion-custom-rules.html

   Source: Adapted from community discussion — Stevens0103

   References

   • Cisco documentation

   Next question

3. Question 153 · 338 in bank

   An engineer must investigate a connectivity issue from an endpoint behind a Cisco FTD device and a public DNS server. The endpoint cannot perform name resolution queries. Which action must the engineer perform to troubleshoot the issue by simulating real DNS traffic on the Cisco FTD while verifying the Snort verdict?

   • AUse the Capture w/Trace wizard in Cisco FMC.
   • BRun the system support firewall-engine-debug command from the FTD CLI.
   • CCreate a Custom Workflow in Cisco FMC.
   • DPerform a Snort engine capture using tcpdump from the FTD CLI.

   Show answer

   Answer: A

   Explanation

   I would also say A. The requirements are "troubleshoot the issue by simulating real DNS traffic" .. this would indicate using optiong A which includes a Trace to simulate the traffic flow.

   Source: Adapted from community discussion — Joninjimbo

   References

   • Cisco documentation

   Next question

4. Question 154 · 338 in bank

   When an engineer captures traffic on a Cisco Secure Firewall Threat Defense device to troubleshoot a connectivity problem, they receive a large amount of output data in the GUI tool. The engineer found that viewing the captures this way is time-consuming and difficult to sort and filter. Which file type must the engineer export the data in so that it can be reviewed using a tool built for this type of analysis?

   • ANetFlow v9
   • BPCAP
   • CIPFIX
   • DNetFlow v5

   Show answer

   Answer: B

   Next question

5. Question 155 · 338 in bank

   An engineer is configuring a custom application detector for HTTP traffic and wants to import a file that was provided by a third party. Which type of files are advanced application detectors created and uploaded as?

   • APerl script
   • BNBAR protocol
   • CLUA script
   • DPython program

   Show answer

   Answer: C

   Explanation

   The type of detector, Basic or Advanced. Basic application detectors are created in the web interface as a series of fields. Advanced application detectors are created externally and uploaded as custom .lua files. https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Application_Detection.html

   Source: Adapted from community discussion — Bubu3k

   References

   • Cisco documentation

   Next question

6. Question 156 · 338 in bank

   An engineer is configuring Cisco FMC and wants to allow multiple physical interfaces to be part of the same VLAN. The managed devices must be able to perform Layer 2 switching between interfaces, including sub-interfaces. What must be configured to meet these requirements?

   • Ainter-chassis clustering VLAN
   • BCisco ISE Security Group Tag
   • Cinterface-based VLAN switching
   • Dintegrated routing and bridging

   Show answer

   Answer: D

   Next question

7. Question 157 · 338 in bank

   Network traffic coming from an organization's CEO must never be denied. Which access control policy configuration option should be used if the deployment engineer is not permitted to create a rule to allow all traffic?

   • AChange the intrusion policy from security to balance.
   • BConfigure a trust policy for the CEO.
   • CConfigure firewall bypass.
   • DCreate a NAT policy just for the CEO.

   Show answer

   Answer: B

   Explanation

   The correct answer is B. Configure a trust policy for the CEO. A trust policy is a special type of access control policy that identifies trusted hosts and networks that are exempt from certain intrusion policies. By creating a trust policy for the CEO, the engineer can ensure that traffic coming from the CEO is always allowed, regardless of any other rules or policies that may be in place. This is a more targeted and specific solution than simply changing the intrusion policy or creating a general firewall bypass. NAT policies, while useful for translating IP addresses, do not provide the same level of control over traffic as access control policies.

   Source: Adapted from community discussion — Joe_Blue

   Next question

8. Question 158 · 338 in bank

   An engineer must deploy a Cisco Secure Firewall Threat Defense device. Management wants to examine traffic without requiring network changes that will disrupt end users. Corporate security policy requires the separation of management traffic from data traffic and the use of SSH over Telnet for remote administration. How must the device be deployed to meet these requirements?

   • Ain transparent mode with a management interface
   • Bin routed mode with a bridge virtual interface
   • Cin transparent mode with a data interface
   • Din routed mode with a diagnostic interface

   Show answer

   Answer: A

   Next question

9. Question 159 · 338 in bank

   A network administrator reviews the attack risk report and notices several low-impact attacks. What does this type of attack indicate?

   • AAll attacks are listed as low until manually recategorized.
   • BThe host is not vulnerable to those attacks.
   • CThe host is not within the administrator's environment.
   • DThe attacks are not dangerous to the network.

   Show answer

   Answer: D

   Next question

10. Question 160 · 338 in bank

    What is a limitation to consider when running a dynamic routing protocol on a Cisco Secure Firewall Threat Defense device in IRB mode?

    • AOnly link-state routing protocols are supported.
    • BOnly nonbridge interfaces are supported.
    • COnly EtherChannel interfaces are supported.
    • DOnly distance vector routing protocols are supported.

    Show answer

    Answer: B

    Explanation

    Seems correct Dynamic routing protocols: You can, however, add static routes for BVIs. You can also allow dynamic routing protocols through the FTD device using an access rule. Non-bridge group interfaces support dynamic routing. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html

    Source: Adapted from community discussion — Bubu3k

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 151. 338 questions available.