300-710 practice questions 51–60

1. Question 51 · 338 in bank

   A network administrator cannot select the link to be used for failover when configuring an active/passive HA Cisco FTD pair. Which configuration must be changed before setting up the high availability pair?

   • AAn IP address in the same subnet must be added to each Cisco FTD on the interface.
   • BThe interface name must be removed from the interface on each Cisco FTD.
   • CThe name Failover must be configured manually on the interface on each Cisco FTD.
   • DThe interface must be configured as part of a LACP Active/Active EtherChannel.

   Show answer

   Answer: B

   Explanation

   No, the correct answer is B. The interface name must be removed from the interface on each Cisco FTD when configuring an active/passive HA pair. This is because when configuring failover, a dedicated interface is used for the failover link, and the interface name cannot be used for this purpose. Therefore, the interface name must be removed to allow the failover link to be configured properly.

   Source: Adapted from community discussion — tanri04

   References

   • Cisco documentation

   Next question

2. Question 52 · 338 in bank

   Which firewall design will allow it to forward traffic at layers 2 and 3 for the same subnet?

   • Arouted mode
   • BCisco Firepower Threat Defense mode
   • Ctransparent mode
   • Dintegrated routing and bridging

   Show answer

   Answer: D

   Explanation

   In routed mode you can have BVI and multiple interfaces are in that BVI. BVI the uses technology IRB to switch (l2) or route (l3) traffic.

   Source: Adapted from community discussion — Initial14

   References

   • cisco.com documentation

   Next question

3. Question 53 · 338 in bank

   An organization is configuring a new Cisco Firepower High Availability deployment. Which action must be taken to ensure that failover is as seamless as possible to end users?

   • ASet the same FQDN for both chassis.
   • BSet up a virtual failover MAC address between chassis.
   • CLoad the same software version on both chassis.
   • DUse a dedicated stateful link between chassis.

   Show answer

   Answer: D

   Explanation

   To ensure that failover is as seamless as possible to end users when configuring a new Cisco Firepower High Availability deployment, the organization must D. Use a dedicated stateful link between chassis. Configuring high availability, also called failover, requires two identical Firepower Threat Defense devices connected to each other through a dedicated failover link and, optionally, a state link1. The system uses the state link to pass connection state information to the standby device, so that if a failover occurs, user connections are preserved2. Is there anything else you would like to know?

   Source: Adapted from community discussion — aaInman

   Next question

4. Question 54 · 338 in bank

   A company is in the process of deploying intrusion prevention with Cisco FTDs managed by a Cisco FMC. An engineer must configure policies to detect potential intrusions but not block the suspicious traffic. Which action accomplishes this task?

   • AConfigure IPS mode when creating or editing a policy rule under the Cisco FMC Intrusion tab in Access Policies section by checking the “Drop when inline” option.
   • BConfigure IPS mode when creating or editing a policy rule under the Cisco FMC Intrusion tab in Access Policies section by unchecking the “Drop when inline” option.
   • CConfigure IDS mode when creating or editing a policy rule under the Cisco FMC Intrusion tab in Access Policies section by checking the “Drop when inline” option.
   • DConfigure IDS mode when creating or editing a policy rule under the Cisco FMC Intrusion tab in Access Policies section by unchecking the “Drop when inline” option.

   Show answer

   Answer: D

   Explanation

   Curse Cisco and their semantic pitfalls. I think you start with a neutral inspection policy. Then, the keyword is "by": By unchecking "drop when inline" in the inspection policy, you create an IDS policy, instead of an IPS policy. So I choose D But that could be wrong, depending on how Cisco want to interpret things...

   Source: Adapted from community discussion — z6st2a1jv

   Next question

5. Question 55 · 338 in bank

   An engineer is using the configure manager add Cisc404225383 command to add a new Cisco FTD device to the Cisco FMC; however, the device is not being added. Why is this occurring?

   • ADONOTRESOLVE must be added to the command
   • BThe IP address used should be that of the Cisco FTD, not the Cisco FMC
   • CThe registration key is missing from the command
   • DThe NAT ID is required since the Cisco FMC is behind a NAT device

   Show answer

   Answer: C

   Explanation

   "If the FMC is behind a NAT device, enter a unique NAT ID along with the registration key, and specify DONTRESOLVE instead of the hostname, for example: Example: > configure manager add DONTRESOLVE regk3y78 natid90 Manager successfully configured. If the FTD is behind a NAT device, enter a unique NAT ID along with the FMC IP address or hostname, for example: Example: > configure manager add 10.70.45.5 regk3y78 natid56 Manager successfully configured. " Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/device_management_basics.html So, according to this phrase from the cisco material, answer C seems to make more sense due to the fact that if DONTRESOLVE is missing then a NAT_ID is for sure required as well, so both of them are missing. Since we have only one option, it is more likely that the reg_key is missing, in my opinion.

   Source: Adapted from community discussion — artgen

   References

   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 56 · 338 in bank

   Select 2

   An organization does not want to use the default Cisco Firepower block page when blocking HTTP traffic. The organization wants to include information about its policies and procedures to help educate the users whenever a block occurs. Which two steps must be taken to meet these requirements? (Choose two.)

   • AEdit the HTTP request handling in the access control policy to customized block
   • BModify the system-provided block page result using Python
   • CCreate HTML code with the information for the policies and procedures
   • DChange the HTTP response in the access control policy to custom
   • EWrite CSS code with the information for the policies and procedures

   Show answer

   Answer: CD

   References

   • cisco.com documentation

   Next question

7. Question 57 · 338 in bank

   A company has many Cisco FTD devices managed by a Cisco FMC. The security model requires that access control rule logs be collected for analysis. The security engineer is concerned that the Cisco FMC will not be able to process the volume of logging that will be generated. Which configuration addresses concern this?

   • ASend Cisco FTD connection events directly to a SIEM system and forward security events from Cisco FMC to the SIEM system for storage and analysis
   • BSend Cisco FTD connection events and security events directly to SIEM system for storage and analysis
   • CSend Cisco FTD connection events and security events to a cluster of Cisco FMC devices for storage and analysis
   • DSend Cisco FTD connection events and security events to Cisco FMC and configure it to forward logs to SIEM for storage and analysis

   Show answer

   Answer: A

   Explanation

   If the FMC cannot handle the load, A makes no sense. Also, in the ACP, you can just decide to log to FMC, Syslog, or both. Direct Syslog is the only thing that makes sense for me here. I go with the original answer.

   Source: Adapted from community discussion — freho

   References

   • Cisco documentation

   Next question

8. Question 58 · 338 in bank

   A network administrator reviews the file report for the last month and notices that all file types, except exe, show a disposition of unknown. What is the cause of this issue?

   • AOnly Spero file analysis is enabled.
   • BThe Cisco FMC cannot reach the Internet to analyze files.
   • CA file policy has not been applied to the access policy.
   • DThe malware license has not been applied to the Cisco FTD.

   Show answer

   Answer: A

   Explanation

   A is the answer. First Time File Analysis: Determines what to do when you see a file for the first time. This likely means that the file has not been seen on the internet before, and so its disposition is unknown. Most new files will be clean, but you can send them to the ThreatGRID® Cloud for analysis, to increase global awareness, and our own. The file must match a rule configured to perform a malware cloud lookup and Spero, local malware, or dynamic analysis. If you disable this option, files detected for the first time are marked with an Unknown disposition. First Time File Analysis: Determines what to do when you see a file for the first time. This likely means that the file has not been seen on the internet before, and so its disposition is unknown. Most new files will be clean, but you can send them to the ThreatGRID® Cloud for analysis, to increase global awareness, and our own. The file must match a rule configured to perform a malware cloud lookup and Spero, local malware, or dynamic analysis. If you disable this option, files detected for the first time are marked with an Unknown disposition.

   Source: Adapted from community discussion — matan24

   References

   • Cisco documentation

   Next question

9. Question 59 · 338 in bank

   An engineer is configuring a Cisco FTD appliance in IPS-only mode and needs to utilize fail-to-wire interfaces. Which interface mode should be used to meet these requirements?

   • Apassive
   • Brouted
   • Ctransparent
   • Dinline set

   Show answer

   Answer: D

   Next question

10. Question 60 · 338 in bank

    An engineer wants to connect a single IP subnet through a Cisco FTD firewall and enforce policy. There is a requirement to present the internal IP subnet to the outside as a different IP address. What must be configured to meet these requirements?

    • AConfigure the Cisco FTD firewall in routed mode with NAT enabled.
    • BConfigure the upstream router to perform NAT.
    • CConfigure the Cisco FTD firewall in transparent mode with NAT enabled.
    • DConfigure the downstream router to perform NAT.

    Show answer

    Answer: A

    Explanation

    To meet the requirements of presenting the internal IP subnet as a different IP address while enforcing policy, the engineer needs to configure the Cisco FTD firewall with NAT. Option A is the correct answer: Configure the Cisco FTD firewall in routed mode with NAT enabled. Option D is also not the best solution because it would require configuring the downstream router to perform NAT, which may not be desirable or feasible in some environments.

    Source: Adapted from community discussion — Joe_Blue

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 51. 338 questions available.