300-710 practice questions 331–338

1. Question 331 · 338 in bank

   What is the purpose of the IRB feature in next-generation firewall?

   • Ato enable transparent bridging between two Layer 2 interfaces
   • Bto block routing between two Layer 3 interfaces
   • Cto allow multiple physical interfaces to be part of the same VLAN
   • Dto configure NAT in transparent mode

   Show answer

   Answer: A

   Next question

2. Question 332 · 338 in bank

   How should a high-availability pair of Cisco Secure Firewall Threat Defense Virtual appliances be deployed to Cisco Secure Firewall Management Center?

   • AAdd the primary appliance to Cisco Secure Firewall Management Center first, then configure high availability.
   • BConfigure high availability first, then add only the primary Cisco Secure Firewall Threat Defense Virtual appliance to Cisco Secure Firewall Management Center.
   • CAdd the primary and secondary Cisco Secure Firewall Threat Defense Virtual appliances to Cisco Secure Firewall Management Center first, then configure high availability.
   • DConfigure high availability first, then add the primary and secondary appliances to Cisco Secure Firewall Management Center.

   Show answer

   Answer: C

   Next question

3. Question 333 · 338 in bank

   An engineer is implementing clustering in Cisco Secure Firewall Management Center. The configuration must ensure that the cluster has a designated control unit node with more resources than the other nodes. What must the engineer set for the priority value of the node?

   • Avalue lower than the other units in the cluster
   • Bvalue higher than the other units in the cluster
   • C0
   • D255

   Show answer

   Answer: A

   Next question

4. Question 334 · 338 in bank

   Select 2

   An engineer must configure an ERSPAN passive interface on a Cisco Secure IPS by using the Cisco Secure Firewall Management Center. These configurations have been performed already: • Configure the passive interface. • Configure the ERSPAN IP address. Which two additional settings must be configured to complete the configuration? (Choose two.)

   • ADestination MAC
   • BTCP Intercept
   • CBypass Mode
   • DFlow Id
   • ESource IP

   Show answer

   Answer: DE

   Next question

5. Question 335 · 338 in bank

   Select 2

   An engineer must configure the encrypted visibility engine for a Cisco Secure Firewall Threat Defense device in Cisco Secure Firewall Management Center. The engineer already configured an access control policy, Cisco vulnerability database updates, and the Cisco Success Network. Which two actions must be taken to complete the Secure Firewall Threat Defense device configuration? (Choose two.)

   • AConfigure an SSL/TLS policy.
   • BEnable encrypted traffic inspection.
   • CEnable Snort 3.
   • DInstall a Threat license.
   • EConfigure an identity policy.

   Show answer

   Answer: CD

   Next question

6. Question 336 · 338 in bank

   An engineer is analyzing a risk report generated by using Cisco Secure Firewall Management Center. The report contains these fields: • Total Attacks • Events Requiring Attention • Hosts Targeted • Hosts Connected to CnC Servers Which type of risk report is the engineer analyzing?

   • Aattacks
   • Bnetwork
   • Cevents
   • Dhosts

   Show answer

   Answer: A

   Next question

7. Question 337 · 338 in bank

   An engineer is reviewing an existing custom server fingerprint on a Cisco Secure Firewall because the current information is inaccurate. Which action must the engineer take to improve the accuracy of the network discovery rules?

   • AAdd NetFlow monitoring for the network segment
   • BExclude the ports that must be skipped.
   • CSet one common rule to override the reports in the multidomain environment.
   • DExclude the IP address that is used to communicate with the monitored host.

   Show answer

   Answer: D

   Next question

8. Question 338 · 338 in bank

   An engineer is configuring Cisco Security Devices by using Cisco Secure Firewall Management Center. Which configuration command must be run to compare the CA certificate bundle on the local system to the latest CA bundle from the Cisco server?

   • Aconfigure cert-update run-now
   • Bconfigure cert-update test
   • Cconfigure cert-update compare
   • Dconfigure cert-update auto-update enable

   Show answer

   Answer: C

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 331. 338 questions available.