Securing Networks with Cisco Firepower (SNCF)338 questions across 34 pages are complete and free, with no account or card.
338 questions in this bank
Free access · progress saved on this device
What are two application layer preprocessors? (Choose two.)
Answer: BC
Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Application_Layer_Preprocessors.html
Source: Adapted from community discussion — gwb
Which license type is required on Cisco ISE to integrate with Cisco FMC pxGrid?
Answer: B
Yes, (B) should be it regarding https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_0101.html Please refer to section: "Table 1. Cisco ISE License Packages": - ISE License Packages == Plus AND - ISE Functionality Covered == Cisco pxGrid ALSO: Within chapter "Traditional License Consumption" it says: "pxGrid is used to share context collected by ISE with other products. A Plus license is required to enable pxGrid functionality. There is no session count decrement when context for session is shared. However, to use pxGrid, the number of Plus sessions licensed must be equal to the number of Base sessions licensed. For more information, see Cisco ISE Licenses and Services section in Cisco Identity Services Engine Ordering Guide."
Source: Adapted from community discussion — MB2222
What is a feature of Cisco AMP private cloud?
Answer: A
Correct Answer is A. Please, read this line from the referenced article: "Connecting a Firepower Management Center to an AMP private cloud disables existing direct connections to the public AMP cloud."
Source: Adapted from community discussion — Bobster02
Which feature within the Cisco FMC web interface allows for detecting, analyzing, and blocking malware in network traffic?
Answer: B
https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/file_policies_and_advanced_malware_protection.html#concept_5DC63E0AC3794E3FB7D59A52D7A337C2 About File Policies and Advanced Malware Protection To detect and block malware, use file policies. You can also use file policies to detect and control traffic by file type. Advanced Malware Protection (AMP) for Firepower can detect, capture, track, analyze, log, and optionally block the transmission of malware in network traffic. In the Firepower Management Center web interface, this feature is called AMP for Networks, formerly called AMP for Firepower. Since they also want to analyse, AMP is needed.
Source: Adapted from community discussion — z6st2a1jv
A network administrator discovers that a user connected to a file server and downloaded a malware file. The Cisco FMC generated an alert for the malware event, however the user still remained connected. Which Cisco AMP file rule action within the Cisco FMC must be set to resolve this issue?
Answer: B
Cisco recommends that you enable Reset Connection for the Block Files and Block Malware actions to prevent blocked application sessions from remaining open until the TCP connection resets. If you do not reset connections, the client session will remain open until the TCP connection resets itself. Answer - Reset connection
Source: Adapted from community discussion — Heorhiiyatskovskyi
An engineer has been tasked with using Cisco FMC to determine if files being sent through the network are malware. Which two configuration tasks must be performed to achieve this file lookup? (Choose two.)
Answer: DE
I believe the correct answers are A and E. Bobster is referencing local malware analysis requirements, but we have no information that local malware analysis is begin used. By default theat grid is used, and threat grid needs no configuration on the FMC to connect to the cloud. The question states "which configuration tasks" - we dont need to do anything related to threat grid afaik. Also, if all file downloads going through the firewall are encrypted, then C and E would accomplish nothing.
Source: Adapted from community discussion — netwguy
A network engineer wants to add a third-party threat feed into the Cisco FMC for enhanced threat detection. Which action should be taken to accomplish this goal?
Answer: D
Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/cisco_threat_intelligence_director__tid_.html
A network engineer is logged into the Cisco AMP for Endpoints console and sees a malicious verdict for an identified SHA-256 hash. Which configuration is needed to mitigate this threat?
Answer: A
A network administrator is concerned about the high number of malware files affecting users' machines. What must be done within the access control policy in Cisco FMC to address this concern?
Answer: C
correct it should be C Access control rules: Rule 3: Block evaluates traffic third. Matching traffic is blocked without further inspection. Traffic that does not match continues to the final rule. Rule 4: Allow is the final rule. For this rule, matching traffic is allowed; however, prohibited files, malware, intrusions, and exploits within that traffic are detected and blocked. Remaining non-prohibited, non-malicious traffic is allowed to its destination, though it is still subject to identity requirements and rate limiting. You can configure Allow rules that perform only file inspection, or only intrusion inspection, or neither.
Source: Adapted from community discussion — Doris8000
Within an organization’s high availability environment where both firewalls are passing traffic, traffic must be segmented based on which department it is destined for. Each department is situated on a different LAN. What must be configured to meet these requirements?
Answer: D
segmentation means separation. Redundant interface is backup, not separation. EtherChannel is to bump up throughput and redundant path. HA active/standby - does NOT allow both firewalls passing traffic
Source: Adapted from community discussion — gwb
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
300-710 practice, question 31. 338 questions available.
Version 1.0.0. How we source questions