300-710 practice questions 271–280

1. Question 271 · 338 in bank

   An organization wants to secure traffic from their branch office to the headquarters building using Cisco Firepower devices. They want to ensure that their Cisco Firepower devices are not wasting resources on inspecting the VPN traffic. What must be done to meet these requirements?

   • AConfigure the Cisco Firepower devices to bypass the access control policies for VPN traffic.
   • BTune the intrusion policies in order to allow the VPN traffic through without inspection.
   • CConfigure the Cisco Firepower devices to ignore the VPN traffic using prefilter policies.
   • DEnable a flexconfig policy to re-classify VPN traffic so that it no longer appears as interesting traffic.

   Show answer

   Answer: A

   Explanation

   A is correct answer. Check the following article. https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/prefiltering_and_prefilter_policies.html#id_31063 According to the article there are limitations to what type of traffic can be offloaded to fastpath. In the above article it is stated that "IPsec and TLS/DTLS VPN connections that terminate on the device" cannot be offloaded.

   Source: Adapted from community discussion — ThanosAth

   References

   • Cisco documentation
   • Cisco documentation

   Next question

2. Question 272 · 338 in bank

   An administrator is working on a migration from Cisco ASA to the Cisco FTD appliance and needs to test the rules without disrupting the traffic. Which policy type should be used to configure the ASA rules during this phase of the migration?

   • APrefilter
   • BIntrusion
   • CAccess Control
   • DIdentity

   Show answer

   Answer: A

   Explanation

   I change my mind to A after reading this document --> https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/prefiltering_and_prefilter_policies.html Fastpath vs Trust discussion Fastpath and there for prefilter wins because it bypasses all further inspection and handling instead of only exempt from deep inspection and discovery, aka Trust function in ACL. On top of that you only have to configure it once in the ACL policy instead on per rule base

   Source: Adapted from community discussion — rbrain

   References

   • Cisco documentation
   • cisco.com documentation
   • cisco.com documentation
   • cisco.com documentation

   Next question

3. Question 273 · 338 in bank

   A network administrator is seeing an unknown verdict for a file detected by Cisco FTD. Which malware policy configuration option must be selected in order to further analyze the file in the Talos cloud?

   • Amalware analysis
   • Bdynamic analysis
   • Csandbox analysis
   • DSpero analysis

   Show answer

   Answer: B

   Explanation

   MY Answer: A It is possible that A, "Malware analysis," could also be a valid option for further analyzing the file in the Talos cloud when an unknown verdict is encountered for a file detected by Cisco FTD. Malware analysis involves analyzing known malware to identify its characteristics and behavior, and this could also be useful in identifying unknown malware. However, sandbox analysis is generally considered to be a more comprehensive option for analyzing unknown files, as it involves executing the file in a controlled environment and monitoring its behavior to detect any malicious activity. So while A could be a valid option in some cases, C, "Sandbox analysis," is typically the more appropriate option for further analyzing unknown files in the Talos cloud.

   Source: Adapted from community discussion — tanri04

   Next question

4. Question 274 · 338 in bank

   An engineer has been tasked with providing disaster recovery for an organization's primary Cisco FMC. What must be done on the primary and secondary Cisco FMCs to ensure that a copy of the original corporate policy is available if the primary Cisco FMC fails?

   • ARestore the primary Cisco FMC backup configuration to the secondary Cisco FMC device when the primary device fails.
   • BConnect the primary and secondary Cisco FMC devices with Category 6 cables of not more than 10 meters in length.
   • CConfigure high-availability in both the primary and secondary Cisco FMCs.
   • DPlace the active Cisco FMC device on the same trusted management network as the standby device.

   Show answer

   Answer: C

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/firepower_management_center_high_availability.html

   Next question

5. Question 275 · 338 in bank

   An engineer is attempting to add a new FTD device to their FMC behind a NAT device with a NAT ID of ACME001 and a password of Cisco0391521107. Which command set must be used in order to accomplish this?

   • Aconfigure manager add<FMC IP> <registration key>ACME001
   • Bconfigure manager add ACME001<registration key> <FMC IP>
   • Cconfigure manager add <FMC IP>ACME001<registration key>
   • Dconfigure manager add DONTRESOLVE <FMC IP> AMCE001<registration key>

   Show answer

   Answer: A

   Explanation

   I agree that there is no right answer. I read the question as if the FMC is behind nat. In this case Kaka is correct. If it means that the FTD is behind nat, then A is correct.

   Source: Adapted from community discussion — SanchezEldorado

   References

   • Cisco documentation

   Next question

6. Question 276 · 338 in bank

   

   Refer to the exhibit. An organization has an access control rule with the intention of sending all social media traffic for inspection. After using the rule for some time, the administrator notices that the traffic is not being inspected, but is being automatically allowed. What must be done to address this issue?

   • AAdd the social network URLs to the block list.
   • BChange the intrusion policy to connectivity over security.
   • CModify the selected application within the rule.
   • DModify the rule action from trust to allow.

   Show answer

   Answer: D

   Explanation

   Correct answer is D indeed. Rule 4: Allow is the final rule. For this rule, matching traffic is allowed; however, prohibited files, malware, intrusions, and exploits within that traffic are detected and blocked. Remaining non-prohibited, non-malicious traffic is allowed to its destination, though it is still subject to identity requirements and rate limiting. You can configure Allow rules that perform only file inspection, or only intrusion inspection, or neither. https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/access_control_rules.html

   Source: Adapted from community discussion — Bobster02

   References

   • Cisco documentation

   Next question

7. Question 277 · 338 in bank

   A user within an organization opened a malicious file on a workstation which in turn caused a ransomware attack on the network. What should be configured within the Cisco FMC to ensure the file is tested for viruses on a sandbox system?

   • ASpero analysis
   • Bcapacity handling
   • Clocal malware analysis
   • Ddynamic analysis

   Show answer

   Answer: D

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/ file_policies_and_advanced_malware_protection.html#ID-2199-000005d8

   Source: Adapted from community discussion — tanri04

   References

   • Cisco documentation

   Next question

8. Question 278 · 338 in bank

   An engineer configures a network discovery policy on Cisco FMC. Upon configuration, it is noticed that excessive and misleading events are filling the database and overloading the Cisco FMC. A monitored NAT device is executing multiple updates of its operating system in a short period of time. What configuration change must be made to alleviate this issue?

   • AExclude load balancers and NAT devices.
   • BLeave default networks.
   • CIncrease the number of entries on the NAT device.
   • DChange the method to TCP/SYN.

   Show answer

   Answer: A

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Network_Discovery_Policies.html

   Next question

9. Question 279 · 338 in bank

   A network administrator notices that remote access VPN users are not reachable from inside the network. It is determined that routing is configured correctly; however, return traffic is entering the firewall but not leaving it. What is the reason for this issue?

   • AA manual NAT exemption rule does not exist at the top of the NAT table
   • BAn external NAT IP address is not configured
   • CAn external NAT IP address is configured to match the wrong interface
   • DAn object NAT exemption rule does not exist at the top of the NAT table

   Show answer

   Answer: A

   Explanation

   "The NAT exemption is a preferred translation method used to prevent traffic to be routed to the internet when it is intended to flow over a VPN tunnel (Remote Access or Site-to-Site). This is needed when the traffic from your internal network is intended to flow over the tunnels without any translation." https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215875-configure-anyconnect-vpn-client-on-ftd.html#toc-hId-809586599

   Source: Adapted from community discussion — Stevens0103

   References

   • Cisco documentation
   • Cisco documentation

   Next question

10. Question 280 · 338 in bank

    An administrator is creating interface objects to better segment their network but is having trouble adding interfaces to the objects. What is the reason for this failure?

    • AThe interfaces are being used for NAT for multiple networks
    • BThe administrator is adding interfaces of multiple types
    • CThe administrator is adding an interface that is in multiple zones
    • DThe interfaces belong to multiple interface groups

    Show answer

    Answer: B

    Explanation

    B is correct. https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/reusable_objects.html#ID-2243-000009b4 "All interfaces in an interface object must be of the same type: all inline, passive, switched, routed, or ASA FirePOWER. After you create an interface object, you cannot change the type of interfaces it contains." C can't be correct because you can't have one interface in multiple zones to begin with.

    Source: Adapted from community discussion — dariol

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 271. 338 questions available.