300-710 practice questions 181–190

1. Question 181 · 338 in bank

   Select 2

   Which two features can be used with Cisco Secure Firewall Threat Defense remote access VPN? (Choose two.)

   • Aenable Duo two-factor authentication using LDAPS
   • Bsupport for Cisco Secure Firewall 4100 Series in cluster mode
   • CSSL remote access VPN supports port sharing with other Cisco FTD features using SSL port 443
   • Duse of license utilization for zero-touch network deployment
   • Esupport for Rapid Threat Containment using RADIUS dynamic authorization

   Show answer

   Answer: AE

   Explanation

   A. Now LDAPS with Cisco Duo went to End Of Live. But until February 20, 2025 this bundle worked. "VPN users logging into existing LDAPS applications can still complete two-factor authentication. Duo Support teams will continue to troubleshoot LDAPS applications." https://help.duo.com/s/article/8019?language=en_US E. Rapid Threat Containment support using RADIUS CoA or RADIUS dynamic authorization. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/vpn-remote-access.html#concept_kkw_sv2_2hb

   Source: Adapted from community discussion — artilling

   References

   • Cisco documentation
   • Cisco documentation

   Next question

2. Question 182 · 338 in bank

   Which rule action is only available in Snort 3?

   • APass
   • BGenerate
   • CAlert
   • DRewrite

   Show answer

   Answer: D

   Explanation

   That is incorrect. Both "Pass" and "Rewrite" are snort 3 rules. "Rewrite" in snort 3 is the equivalent of "Alert" in snort 2. Rewrite only exists in snort 3, not in snort 2. I posted a link to a "Cisco" Youtube video in my other comment. At 5:45 in the video, they literally show a slide explaining snort 2 and snort 3 rules.

   Source: Adapted from community discussion — aaInman

   Next question

3. Question 183 · 338 in bank

   Select 2

   A company is deploying a Cisco Secure IPS device configured in inline mode with a single Interface set that contains four interface pairs. Which two configurations must be implemented to allow the IPS device to uniquely identify packet flows and prevent the reporting of duplicate traffic and false positives? (Choose two.)

   • ASet the source SPAN ports to tx only on the switches connected to the IPS interfaces
   • BModify the security zones used by the Cisco Secure IPS device
   • CChange the MTU for the inline set to at least 1518
   • DReconfigure access rules to drop all but the first occurrence of the packet
   • EReassign the interface pairs to separate inline sets

   Show answer

   Answer: BE

   Explanation

   "If you assign multiple interface pairs to a single inline interface set but you experience issues with duplicate traffic, reconfigure to help the system uniquely identify packets.For example, you could reassign your interface pairs to separate inline sets or modify your security zones." https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/ips_device_deployments_and_configuration.pdf

   Source: Adapted from community discussion — Stevens0103

   References

   • Cisco documentation

   Next question

4. Question 184 · 338 in bank

   Cisco SecureX is classified as which type of threat detection and response solution?

   • AMDR
   • BEDR
   • CXDR
   • DNDR

   Show answer

   Answer: C

   Explanation

   What Is XDR? Extended Detection and Response (XDR) is a cybersecurity solution that unifies threat data, gathering it from previously isolated security tools within an organization’s technology stack. This enables more efficient and rapid threat investigation, hunting, and response. XDR is a cybersecurity architecture that integrates security tools across multiple layers, allowing for faster threat detection and improved investigation and response times.

   Source: Adapted from community discussion — gwb

   Next question

5. Question 185 · 338 in bank

   An administrator configures new threat intelligence sources and must validate that the feeds are being downloaded and that the intelligence is being used within the Cisco Secure Firewall system. Which action accomplishes the task?

   • ALook at the connection security intelligence events
   • BUse the source status indicator to validate the usage
   • CView the threat intelligence observables to see the downloaded data
   • DLook at the access control policy to validate that the intelligence is being used

   Show answer

   Answer: B

   Explanation

   Two requirements. First, validate the feeds are being downloaded: "Step 3. Under the Indicator tab, you can confirm if indicators were downloaded property from the configured sources:" Second, validate that the intelligence is being used: "Step 4. Once you select the name of an indicator you can see more details about it. Indicator Details NAME ZeuS Tracker (offline)| 13d.pp.ru/global/config.jp (2017-08-16) | This domain has been identified as malicious by zeustracker.abuse.ch DESCRIPTION This domain 13d.pp.ru has been identified as malicious by zeustracker.abuse.ch. For more detailed infomation about this indicator go to [CAUTION !! Read-URL-Before-Click] [https://zeustracker.abuse.ch/monitor.php?host=13d.pp.ru]." https://www.cisco.com/c/en/us/support/docs/storage-networking/security/214859-configure-and-troubleshoot-cisco-threat.html

   Source: Adapted from community discussion — Stevens0103

   References

   • Cisco documentation

   Next question

6. Question 186 · 338 in bank

   Cisco Security Analytics and Logging SaaS licenses come with how many days of data retention by default?

   • A60
   • B90
   • C120
   • D365

   Show answer

   Answer: B

   Explanation

   Answer is correct https://www.cisco.com/c/en/us/products/collateral/security/security-analytics-logging/guide-c07-742707.html The Cisco Security Analytics and Logging licenses are available in three tiers and follow a nested model in which a specific license contains all features of all lower-level licenses. Each license quantity entitles the user to send a volume of 1 GB/day for the term of the subscription, which could be 1-, 3-, or 5-year terms. SAL (SaaS) licenses come with 90 days of rolling cloud retention by default.

   Source: Adapted from community discussion — NZhang

   References

   • Cisco documentation

   Next question

7. Question 187 · 338 in bank

   An organization created a custom application that is being flagged by Cisco Secure Endpoint. The application must be exempt from being flagged. What is the process to meet the requirement?

   • AConfigure the custom application to use the information-store paths.
   • BAdd the custom application to the DFC list and update the policy.
   • CPrecalculate the hash value of the custom application and add it to the allowed applications.
   • DModify the custom detection list to exclude the custom application.

   Show answer

   Answer: C

   References

   • Cisco documentation
   • cisco.com documentation

   Next question

8. Question 188 · 338 in bank

   An engineer is configuring a new dashboard within Cisco Secure Firewall Management Center and is having trouble implementing a custom widget. When a custom analysis widget is configured, which option is mandatory for the system to display the information?

   • Atable
   • Btitle
   • Cfilter
   • Dresults

   Show answer

   Answer: A

   Explanation

   Yes, answer (A) is correct. Please refer to "Table 2" within this article: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/dashboards.html Table 2. Custom Analysis Widget Preferences The following items are required: - Table (required): The table of events or assets that contains the data the widget displays. - Field (required): The specific field of the event type you want to display. To show data over time (line graphs), choose Time. To show relative occurrences of events (bar graphs), choose another option. - Aggregate (required): The aggregation method configures how the widget groups the data it displays. For most event types, the default option is Count.

   Source: Adapted from community discussion — MB2222

   References

   • Cisco documentation

   Next question

9. Question 189 · 338 in bank

   With Cisco FTD software, which interface mode must be configured to passively receive traffic that passes through the appliance?

   • AERSPAN
   • Bfirewall
   • Ctap
   • DIPS-only

   Show answer

   Answer: C

   Explanation

   Correct C With tap mode, the FTD is deployed inline, but the network traffic flow is undisturbed. Instead, the FTD makes a copy of each packet so that it can analyze the packets. Note that rules of these types do generate intrusion events when they are triggered, and the table view of intrusion events indicates that the triggering packets would have dropped in an inline deployment. There are benefits to using tap mode with FTDs that are deployed inline

   Source: Adapted from community discussion — johanhc20

   References

   • Cisco documentation

   Next question

10. Question 190 · 338 in bank

    Select 2

    A network engineer is planning on deploying a Cisco Secure Firewall Threat Defense Virtual appliance in transparent mode. Which two virtual environments support this configuration? (Choose two.)

    • AOSI
    • BAWS
    • CGCP
    • DKVM
    • EESXi

    Show answer

    Answer: DE

    Explanation

    I believe the answer is DE Looking at the link below it does state that both ESXi and KVM support Transparent Mode https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/consolidated_ftdv_gsg/ftdv-gsg/m-ftdv-vmware-gsg.html

    Source: Adapted from community discussion — Dash_888

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 181. 338 questions available.