300-710 practice questions 21–30

1. Question 21 · 338 in bank

   Which policy rule is included in the deployment of a local DMZ during the initial deployment of a Cisco NGFW through the Cisco FMC GUI?

   • Aa default DMZ policy for which only a user can change the IP addresses.
   • Bdeny ip any
   • Cno policy rule is included
   • Dpermit ip any

   Show answer

   Answer: C

   Explanation

   There is no DMZ setup during initial deployment of a CISCO NGFW using the FMC GUI... You would have to specify an interface designated to receive DMZ traffic, associate it to a security zone designated to DMZ traffic and lastly configure a policy to act on the DMZ traffic.... However, when creating a NEW access control policy you have to choose from one of the 3 default actions: Block all traffic Intrusion Prevention Network Discovery So Technical C would be correct because there is no DMZ deployment during initial setup but if you were to setup a DMZ after initial setup you would most likely block all traffic by default and change it after to allow all traffic... Because it's a DMZ... I would say C.

   Source: Adapted from community discussion — Grandslam

   Next question

2. Question 22 · 338 in bank

   A network engineer is tasked with minimizing traffic interruption during peak traffic times. When the SNORT inspection engine is overwhelmed, what must be configured to alleviate this issue?

   • AEnable IPS inline link state propagation
   • BEnable Pre-filter policies before the SNORT engine failure
   • CSet a Trust ALL access control policy
   • DEnable Automatic Application Bypass

   Show answer

   Answer: D

   Explanation

   When the SNORT inspection engine is overwhelmed, to minimize traffic interruption during peak traffic times, a network engineer can configure the IPS (Intrusion Prevention System) to alleviate this issue by enabling Automatic Application Bypass. Therefore, the correct answer is D, Enable Automatic Application Bypass. When the SNORT inspection engine is overwhelmed, enabling Automatic Application Bypass allows the IPS to bypass specific applications or protocols that are causing the bottleneck. This ensures that critical traffic is not dropped, and network performance is not degraded during peak traffic times. Enabling IPS inline link state propagation (Option A) is a mechanism that ensures link state information is propagated to the inline security device, such as IPS. It helps ensure that the IPS does not forward traffic to an interface that is down. However, it does not directly address the issue of SNORT engine overload.

   Source: Adapted from community discussion — tanri04

   References

   • Cisco documentation

   Next question

3. Question 23 · 338 in bank

   Select 2

   Which two features of Cisco AMP for Endpoints allow for an uploaded file to be blocked? (Choose two.)

   • Aapplication blocking
   • Bsimple custom detection
   • Cfile repository
   • Dexclusions
   • Eapplication allow listing

   Show answer

   Answer: AB

   Explanation

   answers are correct: configure custom malware detection policies and profiles for your entire organization, as well as perform flash and full scans on all your users’ files perform malware analysis, including view heat maps, detailed file information, network file trajectory, and threat root causes configure multiple aspects of outbreak control, including automatic quarantines, application blocking to stop non-quarantined executables from running, and exclusion lists https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Reference_a_wrapper_Chapter_topic_here.html#id_96014

   Source: Adapted from community discussion — Doris8000

   References

   • Cisco documentation

   Next question

4. Question 24 · 338 in bank

   Which Cisco AMP for Endpoints policy is used only for monitoring endpoint activity?

   • AWindows domain controller
   • Baudit
   • Ctriage
   • Dprotection

   Show answer

   Answer: B

   Explanation

   Reference: https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/214933-amp-for-endpoints-deployment-methodology.html

   Source: Adapted from community discussion — gwb

   References

   • Cisco documentation
   • Cisco documentation

   Next question

5. Question 25 · 338 in bank

   What is a valid Cisco AMP file disposition?

   • Anon-malicious
   • Bmalware
   • Cknown-good
   • Dpristine

   Show answer

   Answer: B

   References

   • Cisco documentation

   Next question

6. Question 26 · 338 in bank

   In a Cisco AMP for Networks deployment, which disposition is returned if the cloud cannot be reached?

   • Aunavailable
   • Bunknown
   • Cclean
   • Ddisconnected

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

7. Question 27 · 338 in bank

   Select 2

   Which two remediation options are available when Cisco FMC is integrated with Cisco ISE? (Choose two.)

   • Adynamic null route configured
   • BDHCP pool disablement
   • Cquarantine
   • Dport shutdown
   • Ehost shutdown

   Show answer

   Answer: CD

   Explanation

   Firepower 6.1 Remediation module allows Firepower system to use ISE EPS capabilities (quarantine, unquarantine, port shutdown) as a remediation when correlation rule is matched.

   Source: Adapted from community discussion — Doris8000

   References

   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 28 · 338 in bank

   Which connector is used to integrate Cisco ISE with Cisco FMC for Rapid Threat Containment?

   • ApxGrid
   • BFTD RTC
   • CFMC RTC
   • DISEGrid

   Show answer

   Answer: A

   Explanation

   ignore the previous one the FireSIGHT Management Center (FMC) is configured for using self-signed certificates for ISE pxGrid node operation.

   Source: Adapted from community discussion — Doris8000

   Next question

9. Question 29 · 338 in bank

   What is the maximum SHA level of filtering that Threat Intelligence Director supports?

   • ASHA-1024
   • BSHA-4096
   • CSHA-512
   • DSHA-256

   Show answer

   Answer: D

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/cisco_threat_intelligence_director__tid_.html

   Source: Adapted from community discussion — gwb

   Next question

10. Question 30 · 338 in bank

    What is the advantage of having Cisco Firepower devices send events to Cisco Threat Response via the security services exchange portal directly as opposed to using syslog?

    • AFirepower devices do not need to be connected to the Internet.
    • BAn on-premises proxy server does not need to set up and maintained.
    • CAll types of Firepower devices are supported.
    • DSupports all devices that are running supported versions of Firepower

    Show answer

    Answer: B

    Explanation

    Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/integrations/CTR/Firepower_and_Cisco_Threat_Response_Integration_Guide.pdf

    Source: Adapted from community discussion — tinyJoe

    References

    • Cisco documentation
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 21. 338 questions available.