300-710 practice questions 251–260

1. Question 251 · 338 in bank

   When creating a report template, how are the results limited to show only the activity of a specific subnet?

   • ACreate a custom search in Cisco FMC and select it in each section of the report.
   • BAdd an Input Parameter in the Advanced Settings of the report, and set the type to Network/IP.
   • CAdd a Table View section to the report with the Search field defined as the network in CIDR format.
   • DSelect IP Address as the X-Axis in each section of the report.

   Show answer

   Answer: B

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401/Reports.html#87267

   Next question

2. Question 252 · 338 in bank

   What is the disadvantage of setting up a site-to-site VPN in a clustered-units environment?

   • AVPN connections can be re-established only if the failed master unit recovers.
   • BSmart License is required to maintain VPN connections simultaneously across all cluster units.
   • CVPN connections must be re-established when a new master unit is elected.
   • DOnly established VPN connections are maintained when a new master unit is elected.

   Show answer

   Answer: C

   Explanation

   "VPN functionality is limited to the control unit and does not take advantage of the cluster high availability capabilities. If the control unit fails, all existing VPN connections are lost, and VPN users will see a disruption in service. When a new control unit is elected, you must reestablish the VPN connections." reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/clustering/ftd-4100-9300-cluster.html

   Source: Adapted from community discussion — matan24

   References

   • Cisco documentation

   Next question

3. Question 253 · 338 in bank

   Select 2

   What are two features of bridge-group interfaces in Cisco FTD? (Choose two.)

   • AThe BVI IP address must be in a separate subnet from the connected network.
   • BBridge groups are supported in both transparent and routed firewall modes.
   • CBridge groups are supported only in transparent firewall mode.
   • DBidirectional Forwarding Detection echo packets are allowed through the FTD when using bridge-group members.
   • EEach directly connected network must be on the same subnet.

   Show answer

   Answer: BE

   Explanation

   C and D are the wrong answers. Must be B and E. Cisco FMC config guide v 6.2 states that: Bridge Group Guidelines (Transparent and Routed Mode): You can create up to 250 bridge groups, with 64 interfaces per bridge group. Each directly-connected network must be on the same subnet.

   Source: Adapted from community discussion — Bobster02

   References

   • Cisco documentation
   • Cisco documentation

   Next question

4. Question 254 · 338 in bank

   Which command is run on an FTD unit to associate the unit to an FMC manager that is at IP address 10.0.0.10, and that has the registration key Cisco123?

   • Aconfigure manager local 10.0.0.10 Cisco123
   • Bconfigure manager add Cisco123 10.0.0.10
   • Cconfigure manager local Cisco123 10.0.0.10
   • Dconfigure manager add 10.0.0.10 Cisco123

   Show answer

   Answer: D

   Explanation

   D with 100% certainty. I've done this 4 times in production and the first time took me 4 hours to figure out. I will never forget this command, lol.

   Source: Adapted from community discussion — aaInman

   References

   • Cisco documentation
   • Cisco documentation

   Next question

5. Question 255 · 338 in bank

   Select 2

   Which two actions can be used in an access control policy rule? (Choose two.)

   • ABlock with Reset
   • BMonitor
   • CAnalyze
   • DDiscover
   • EBlock ALL

   Show answer

   Answer: AB

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/firesight/541/firepower-module-user-guide/asa-firepower-module-user-guide-v541/AC-Rules-Tuning- Overview.html#71854

   Next question

6. Question 256 · 338 in bank

   Select 2

   Which two routing options are valid with Cisco FTD? (Choose two.)

   • ABGPv6
   • BECMP with up to three equal cost paths across multiple interfaces
   • CECMP with up to three equal cost paths across a single interface
   • DBGPv4 in transparent firewall mode
   • EBGPv4 with nonstop forwarding

   Show answer

   Answer: AB

   Explanation

   A : https://www.cisco.com/c/en/us/td/docs/security/firepower/660/fdm/fptd-fdm-config-guide-660/fptd-fdm-bgp.html " BGP IPv4 is supported both on global and user-defined virtual routers. However, only BGP IPv6 configuration is supported on a global virtual router." Its about Cisco FTD devices and not Cisco FTDv appliance B : https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/routing-ecmp.html " You can have up to 8 equal cost static or dynamic routes across up to 8 interfaces within each zone." I read this as 1 equal cost route per interface. So 3 equal cost paths means 3 interfaces, not 1. So B must be valid and not C.

   Source: Adapted from community discussion — rbrain

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

7. Question 257 · 338 in bank

   Which object type supports object overrides?

   • Atime range
   • Bsecurity group tag
   • Cnetwork object
   • DDNS server group

   Show answer

   Answer: C

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/ Reusable_Objects.html#concept_8BFE8B9A83D742D9B647A74F7AD50053

   References

   • Cisco documentation

   Next question

8. Question 258 · 338 in bank

   Which Cisco Firepower rule action displays an HTTP warning page?

   • AMonitor
   • BBlock
   • CInteractive Block
   • DAllow with Warning

   Show answer

   Answer: C

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401/AC-Rules-Tuning-Overview.html#76698

   Next question

9. Question 259 · 338 in bank

   What is the result a specifying of QoS rule that has a rate limit that is greater than the maximum throughput of an interface?

   • AThe rate-limiting rule is disabled.
   • BMatching traffic is not rate limited.
   • CThe system rate-limits all traffic.
   • DThe system repeatedly generates warnings.

   Show answer

   Answer: B

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/quality_of_service_qos.pdf

   Source: Adapted from community discussion — ASherbiny_1604

   References

   • Cisco documentation

   Next question

10. Question 260 · 338 in bank

    What is the difference between inline and inline tap on Cisco Firepower?

    • AInline tap mode can send a copy of the traffic to another device.
    • BInline tap mode does full packet capture.
    • CInline mode cannot do SSL decryption.
    • DInline mode can drop malicious traffic.

    Show answer

    Answer: D

    Explanation

    INLINE TAP Copies the data to the SNORT Engine to be checked but then dropped while the actual data flow continues uninterrupted. Therefore, INLINE TAP does not send traffic to another device. The Data is copied but not captured. You still would need to enable packet capture to capture packets (AKA Save PCAP). INLINE: Both inline and Inline Tap mode do not support SSL Decryption-resign... Although im a bit conflicted by this.... Truth is that Inline Mode can DROP malicious traffic but remember that Inline TAP mode CANNOT. Agan this is because tap mode sends a copy of the data to be inspected but not the actual data. Best Answer is D.

    Source: Adapted from community discussion — Grandslam

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 251. 338 questions available.