300-710 practice questions 201–210

1. Question 201 · 338 in bank

   A network administrator is deploying a new Cisco Secure Firewall Threat Defense (FTD) firewall. After Cisco Secure FTD is deployed, inside clients have intermittent connectivity to each other. When reviewing the packet capture on the Secure FTD firewall, the administrator sees that Secure FTD is responding to all the ARP requests on the inside network. Which action must the network administrator take to resolve the issue?

   • AReview the access policy and verify that ARP is allowed from inside to inside.
   • BReview NAT policy and disable incorrect proxy ARP configuration.
   • CConvert the FTD to transparent mode to allow ARP requests.
   • DHardcode the MAC address of the FTD to IP mapping on client machines.

   Show answer

   Answer: B

   Explanation

   The answer is definitely B. I completely agree with Alex_morgan. I'd like to add something. First of all, the “incorrect proxy ARP configuraiton” is specifically the “Do not proxy ARP on Destination Interface” checkbox in the Advanced tab of the FMC's NAT policy. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config -76/interfaces-settings-nat.html#:~:text=Do%20not%20proxy%20ARP%20on%20Destination%20Interface As an example, this option is used when identity NAT is used to identify VPN traffic. In that case, if this checkbox is not turned on, the local LAN will attempt to respond to ARP even for requests that can be handled by the local LAN.

   Source: Adapted from community discussion — tinyJoe

   References

   • Cisco documentation
   • Cisco documentation

   Next question

2. Question 202 · 338 in bank

   A network administrator wants to configure a Cisco Secure Firewall Threat Defense instance managed by Cisco Secure Firewall Management Center to block traffic to known cryptomining networks. Which system settings must the administrator configure in Secure Firewall Management Center to meet the requirement?

   • AIntrusion Policy, Security Intelligence
   • BAccess Policy, Security Intelligence
   • CMalware Policy, Rules
   • DAccess Policy, Rules

   Show answer

   Answer: B

   Explanation

   APC and SI . My choice is B Security Intelligence Feed Categories The following table describes the categories available in the Cisco Talos Intelligence Group (Talos) feeds. These categories are available for both network and URL blocking. These categories can change over time, so a newly-downloaded feed might have category changes. When configuring Security Intelligence, you can click the info icon next to a category name to see a description. Cryptomining Hosts providing remote access to pools and wallets for the purpose of mining cryptocurrency

   Source: Adapted from community discussion — gwb

   Next question

3. Question 203 · 338 in bank

   Select 2

   A network engineer detects a connectivity issue between Cisco Secure Firewall Management Center and Cisco Secure Firewall Threat Defense. Initial troubleshooting indicates that heartbeats and events are not being received. The engineer re-establishes the secure channels between both peers. Which two commands must the engineer run to resolve the issue? (Choose two.)

   • Amanage_procs.pl
   • Bshow disk-manager
   • Cshow history
   • Dsudo perfstats -Cq < /var/sf/rna/correlator-stats/now
   • Esudo stats_unified.pl

   Show answer

   Answer: AE

   Explanation

   AE are correct The command stats_unified.pl can help you to determine if the managed device does have some data which needs to be sent to FMC. This condition can happen when the managed device and the FMC experience a connectivity issue. The managed device stores the log data onto a hard drive. admin@FMC:~$ sudo stats_unified.pl The manage_proc.pl command can reconfigure the correlator on the FMC side. root@FMC:~# manage_procs.pl https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/troubleshooting_the_system.html

   Source: Adapted from community discussion — Kris92

   References

   • Cisco documentation

   Next question

4. Question 204 · 338 in bank

   A network administrator is reviewing a packet capture. The packet capture from inside of Cisco Secure Firewall Threat Defense shows the inbound TCP traffic. However, the outbound TCP traffic is not seen in the packet capture from outside Secure Firewall Threat Defense. Which configuration change resolves the issue?

   • APacket capture must include UDP traffic.
   • BInside interface must be assigned a higher security level.
   • CRoute to the destination must be added.
   • DInside interface must be assigned a lower security level.

   Show answer

   Answer: C

   Explanation

   I am not sure, but the only option available is C. First of all, A is totally WTF. As for B and D, the security level, this is a value that must be set for each interface in ASA, but is not used for anything at all in FTD. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/760/management-center-admin-76/health-troubleshoot.html#:~:text=The%20threat%20defense%20does%20not%20use%20the%20security%20level%20for%20anything

   Source: Adapted from community discussion — tinyJoe

   References

   • Cisco documentation

   Next question

5. Question 205 · 338 in bank

   An engineer is troubleshooting an intermittent connectivity issue on a Cisco Secure Firewall Threat Defense appliance and must collect 24 hours' worth of data. The engineer started a packet capture, however it stops prematurely during this time period. The engineer notices that the packet capture buffer size is set to the default of 32 MB. Which buffer size is the maximum that the engineer must set to enable the packet capture to run successfully?

   • A64 MB
   • B1 GB
   • C10 GB
   • D100 GB

   Show answer

   Answer: C

   Explanation

   should be C This allows you to capture much more many packets in the capture buffer. Additionally, you can increase the size of the capture buffer (by default is 500Kbytes) to a value up 32 Mbytes (buffer option). Finally, as from FTD version 6.3, the file-size option allows you to configure a capture file up to 10GBytes. https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/215092-analyze-firepower-firewall-captures-to-e.html#:~:text=This%20allows%20you%20to%20capture,capture%20file%20up%20to%2010GBytes.

   Source: Adapted from community discussion — Kris92

   References

   • Cisco documentation

   Next question

6. Question 206 · 338 in bank

   A network administrator is setting up a new highly available Cisco Secure Firewall Threat Defense (FTD) pair. The administrator wants to monitor that the interfaces on the secondary Secure FTD are reachable not just up. What must the administrator configure?

   • AThis happens by default when high availability is enabled.
   • Bsecondary IP address
   • CEUI 64 address on a high-availability link
   • Dseparate high-availability and failover links

   Show answer

   Answer: B

   Explanation

   Although recommended, the standby address is not required. Without a standby IP address, the active unit cannot perform network tests to check the standby interface health; it can only track the link state. You also cannot connect to the standby unit on that interface for management purposes. https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/firepower_threat_defense_high_availability.html

   Source: Adapted from community discussion — Kris92

   References

   • Cisco documentation

   Next question

7. Question 207 · 338 in bank

   An administrator must fix a network problem whereby traffic from the inside network to a webserver is not getting through an instance of Cisco Secure Firewall Threat Defense. Which command must the administrator use to capture packets to the webserver that are dropped by Secure Firewall Threat Defense and resolve the issue?

   • Acapture CAP int INSIDE match ip any host WEBSERVERIP
   • Bcapture CAP int OUTSIDE match ip any host WEBSERVERIP
   • Ccapture CAP int INSIDE match tcp any 80 host WEBSERVERIP 80
   • Dcapture CAP type asp-drop all headers-only

   Show answer

   Answer: D

   Explanation

   The asp-drop type of capture is used to identify and capture packets that are dropped by the Cisco Secure Firewall Threat Defense (FTD) appliance due to the Accelerated Security Path (ASP) process. This type of capture helps troubleshoot issues where traffic is being dropped by the firewall, which is the case in this scenario. The other options (A, B, and C) are for general packet captures, but they don't specifically capture dropped packets, which is the key part of this issue.

   Source: Adapted from community discussion — Alex_morgan

   Next question

8. Question 208 · 338 in bank

   Users report that Cisco Duo 2FA fails when they attempt to connect to the VPN on a Cisco Secure Firewall Threat Defense (FTD) device. IT staff have VPN profiles that do not require multifactor authentication and they can connect to the VPN without any issues. When viewing the VPN troubleshooting log in Cisco Secure Firewall Management Center (FMC), the network administrator sees an error that the Cisco Duo AAA server has been marked as failed. What is the root cause of the issue?

   • AAD Trust certificates are missing from the Secure FTD device.
   • BMultifactor authentication is not supported on Secure FMC managed devices.
   • CThe internal AD server is unreachable from the Secure FTD device.
   • DDuo trust certificates are missing from the Secure FTD device.

   Show answer

   Answer: D

   Explanation

   D. Duo trust certificates are missing from the Secure FTD device. The issue described—where the Cisco Duo AAA server is marked as failed and 2FA (two-factor authentication) fails—typically happens when the trust certificates for Cisco Duo are missing or not properly installed on the Cisco Secure Firewall Threat Defense (FTD) device. Without the necessary certificates, the FTD device cannot securely communicate with the Duo servers, resulting in the failure of multifactor authentication.

   Source: Adapted from community discussion — Alex_morgan

   Next question

9. Question 209 · 338 in bank

   A hospital network needs to upgrade their Cisco FMC managed devices and needs to ensure that a disaster recovery process is in place. What must be done in order to minimize downtime on the network?

   • AConfigure a second circuit to an ISP for added redundancy.
   • BKeep a copy of the current configuration to use as backup.
   • CConfigure the Cisco FMCs for failover.
   • DConfigure the Cisco FMC managed devices for clustering.

   Show answer

   Answer: D

   Explanation

   B is correct answer: https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/firepower_management_center_high_availability.html Cisco Threat Intelligence Director (TID) and High Availability Configurations If you host TID on the active Firepower Management Center in a high availability configuration, the system does not synchronize TID configurations and TID data to the standby Firepower Management Center. We recommend performing regular backups of TID data on your active Firepower Management Center so that you can restore the data after failover.

   Source: Adapted from community discussion — Bobster02

   References

   • Cisco documentation
   • Cisco documentation

   Next question

10. Question 210 · 338 in bank

    Select 2

    An engineer must integrate a third-party security intelligence feed with Cisco Secure Firewall Management Center. Secure Firewall Management Center is running Version 6.2.3 and has 8 GB of memory. Which two actions must be taken to implement Threat Intelligence Director? (Choose two.)

    • AAdd a TAXI I server.
    • BAdd the URL of the TAXII server.
    • CUpgrade to version 6.6.
    • DEnable REST API access.
    • EAdd 7 GB of memory.

    Show answer

    Answer: DE

    Explanation

    You can host TID on physical and virtual Firepower Management Centers: running Version 6.2.2 or later of the Firepower System. configured with a minimum of 15 GB of memory. configured with REST API access enabled. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/cisco_threat_intelligence_director__tid_.html

    Source: Adapted from community discussion — Kris92

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 201. 338 questions available.