Securing Networks with Cisco Firepower (SNCF)338 questions across 34 pages are complete and free, with no account or card.
338 questions in this bank
Free access · progress saved on this device
An administrator is attempting to add a new Cisco Secure Firewall Threat Defense device to Cisco Secure Firewall Management Center with a password of Cisco0481488187 481488187. The private IP address of the FMC server is 192.168.75.201. Which command must be used in order to accomplish this task?
Answer: B
Which component simplifies incident investigation with Cisco Threat Response?
Answer: D
An engineer must change the mode of a Cisco Secure Firewall Threat Defense (FTD) firewall in the Cisco Secure Firewall Management Center (FMC) inventory. The engineer must take these actions: • Register Secure FTD with Secure FMC. • Change the firewall mode. • Deregister the Secure FTD device from Secure FMC. How must the engineer take the actions?
Answer: A
An organization has implemented Cisco Firepower without IPS capabilities and now wants to enable inspection for their traffic. They need to be able to detect protocol anomalies and utilize the Snort rule sets to detect malicious behavior. How is this accomplished?
Answer: B
To enable inspection for traffic and detect protocol anomalies using Snort rule sets to detect malicious behavior in Cisco Firepower without IPS capabilities, both the access control policy and intrusion policy must be modified. The access control policy should be modified to redirect interesting traffic to the engine for inspection. The intrusion policy should be modified to enable intrusion and file policy, select the Snort rule sets to use for inspection, and configure the protocol inspection settings to detect anomalies. The minimum severity of an event to inspect is determined by the intrusion policy, but it is not the only modification required to enable inspection for traffic and utilize the Snort rule sets. Therefore, option C is not the correct answer. The correct answer is: A. Modify the access control policy to redirect interesting traffic to the engine, and C. Modify the intrusion policy to utilize Snort rule sets and detect malicious behavior.
Source: Adapted from community discussion — tanri04
An engineer must replace a Cisco Secure Firewall high-availability device due to a failure. When the replacement device arrives, the engineer must separate the high-availability pair from Cisco Secure Firewall Management Center. Which action must the engineer take first to restore high availability?
Answer: A
I don't know which of the HAs to replace, but in any case the first thing to do is break the HA pair. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/high-availability.html#id_14945
Source: Adapted from community discussion — tinyJoe
A network administrator is trying to configure an access rule to allow access to a specific banking site over HTTPS but not HTTP. Which method must the administrator use to meet the requirement?
Answer: C
Answer C meets the requirement. SSL Decryption is used to inspect traffic which otherwise is hidden in encryption. The question does not state anything about file or malware inspection. Also its a banking site which usually IRL is exempt form SSL decryption policies because of compliancy/privacy rules
Source: Adapted from community discussion — rbrain
A network administrator is configuring an FTD in transparent mode. A bridge group is set up and an access policy has been set up to allow all IP traffic. Traffic is not passing through the FTD. What additional configuration is needed?
Answer: A
Refer to the exhibit. A company is deploying a pair of Cisco Secure Firewall Threat Defense devices named FTD1 and FTD2. FTD1 and FTD2 have been configured as an active/standby pair with a failover link but without a stateful link. What must be implemented next to ensure that users on the internal network still communicate with outside devices if FTD1 fails?
Answer: A
When the HA in FTD fails over, the new active machine takes over the IP address and MAC address from the previous active machine. From the L2 switch's point of view, the MAC addresses connected to Gi0/2 and Gi0/12 will suddenly change, and Portsecurity will shutdown the ports. So either A or D is correct, but D says “interfaces on FTD”, so the correct answer is A.
Source: Adapted from community discussion — tinyJoe
Network users experience issues when accessing a server on a different network segment. An engineer investigates the issue by performing packet capture on Cisco Secure Firewall Threat Defense. The engineer expects more data and suspects that not all the traffic was collected during a 15-minute capture session. Which action must the engineer take to resolve the issue?
Answer: A
Which action must be taken to configure an isolated bridge group for IRB mode on a Cisco Secure Firewall device?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
300-710 practice, question 211. 338 questions available.
Version 1.0.0. How we source questions