300-710 practice questions 61–70

1. Question 61 · 338 in bank

   A security engineer is configuring a remote Cisco FTD that has limited resources and internet bandwidth. Which malware action and protection option should be configured to reduce the requirement for cloud lookups?

   • ABlock File action and local malware analysis
   • BMalware Cloud Lookup and dynamic analysis
   • CBlock Malware action and dynamic analysis
   • DBlock Malware action and local malware analysis

   Show answer

   Answer: D

   Explanation

   Local Malware Analysis Local malware analysis allows a managed device to locally inspect executables, PDFs, office documents, and other types of files for the most common types of malware, using a detection rule set provided by the Cisco Talos Intelligence Group (Talos). Because local analysis does not query the AMP cloud, and does not run the file, local malware analysis saves time and system resources. Block Malware rules allow you to calculate the SHA-256 hash value of specific file types, query the AMP cloud to determine if files traversing your network contain malware, then block files that represent threats. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/file_policies_and_advanced_malware_protection.html#concept_9CE3D1F1572541C695CE5C7682780311

   Source: Adapted from community discussion — Cokamaniako

   References

   • Cisco documentation

   Next question

2. Question 62 · 338 in bank

   An administrator must use Cisco FMC to install a backup route within the Cisco FTD to route traffic in case of a routing failure with primary route. Which action accomplish this task?

   • AInstall the static backup route and modify the metric to be less than the primary route
   • BUse a default route in the FMC instead of having multiple routes contending for priority
   • CConfigure EIGRP routing on the FMC to ensure that dynamic routes are always updated
   • DCreate the backup route and use route tracking on both routes to a destination IP address in the network

   Show answer

   Answer: D

   References

   • Cisco documentation

   Next question

3. Question 63 · 338 in bank

   An administrator is adding a new URL-based category feed to the Cisco FMC for use within the policies. The intelligence source does not use STIX, but instead uses a .txt file format. Which action ensures that regular updates are provided?

   • AAdd a URL source and select the flat file type within Cisco FMC.
   • BAdd a TAXII feed source and input the URL for the feed.
   • CUpload the .txt file and configure automatic updates using the embedded URL.
   • DConvert the .txt file to STIX and upload it to the Cisco FMC.

   Show answer

   Answer: A

   Explanation

   • TID supports additional intelligence ingestion methods—With both Security Intelligence and TID, you can import threat intelligence into the system by either manually uploading flat files or configuring the system to retrieve flat files from a third-party host. TID provides increased flexibility in managing those flat files. In addition, TID can retrieve and ingest intelligence provided in Structured Threat Information eXpression (STIX™) format. Flat File Files must be ASCII text files with one observable value per line https://www.cisco.com/c/en/us/td/docs/security/firepower/622/configuration/guide/fpmc-config-guide-v622/threat_intelligence_director_tid.pdf

   Source: Adapted from community discussion — Cokamaniako

   References

   • Cisco documentation

   Next question

4. Question 64 · 338 in bank

   An engineer is configuring Cisco FMC and wants to limit the time allowed for processing packets through the interface. However, if the time is exceeded, the configuration must allow packets to bypass detection. What must be configured on the Cisco FMC to accomplish this task?

   • ACisco ISE Security Group Tag
   • BAutomatic Application Bypass
   • CInspect Local Traffic Bypass
   • DFast-Path Rules Bypass

   Show answer

   Answer: B

   References

   • Cisco documentation

   Next question

5. Question 65 · 338 in bank

   An engineer must define a URL object on Cisco FMC. What is the correct method to specify the URL without performing SSL inspection?

   • AInclude all URLs from CRL Distribution Points.
   • BUse Subject Common Name value.
   • CSpecify all subdomains in the object group.
   • DSpecify the protocol in the object.

   Show answer

   Answer: B

   Explanation

   B is the answer. "HTTPS filtering, unlike HTTP filtering, disregards subdomains within the subject common name. Do not include subdomain information when manually filtering HTTPS URLs" https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-access.html

   Source: Adapted from community discussion — matan24

   References

   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 66 · 338 in bank

   A network administrator is migrating from a Cisco ASA to a Cisco FTD. EIGRP is configured on the Cisco ASA but it is not available in the Cisco FMC. Which action must the administrator take to enable this feature on the Cisco FTD?

   • AConfigure EIGRP parameters using FlexConfig objects.
   • BAdd the command feature eigrp via the FTD CLI.
   • CCreate a custom variable set and enable the feature in the variable set.
   • DEnable advanced configuration options in the FMC.

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

7. Question 67 · 338 in bank

   An organization has noticed that malware was downloaded from a website that does not currently have a known bad reputation. How will this issue be addressed globally in the quickest way possible and with the least amount of impact?

   • Aby creating a URL object in the policy to block the website.
   • BCisco Talos will automatically update the policies.
   • Cby denying outbound web access
   • Dby isolating the endpoint

   Show answer

   Answer: A

   Explanation

   There are four keywords in the question: Organization, globally, quickest and least amount of impact Globally means worldwide, if it is referring to internal, it should say organizational Talos feeds are updated by default every hour. You can change the update frequency. I would go for B. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/fdm/fptd-fdm-config-guide-623/fptd-fdm-sec-intel.html

   Source: Adapted from community discussion — orotta

   References

   • Cisco documentation

   Next question

8. Question 68 · 338 in bank

   A Cisco FMC administrator wants to configure fastpathing of trusted network traffic to increase performance. In which type of policy would the administrator configure this feature?

   • ANetwork Analysis policy
   • BIdentity policy
   • CPrefilter policy
   • DIntrusion policy

   Show answer

   Answer: C

   Next question

9. Question 69 · 338 in bank

   DRAG DROP - Drag and drop the configuration steps from the left into the sequence on the right to enable external authentication on Cisco FMC to a RADIUS server.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Cisco documentation
   • Cisco documentation

   

   Next question

10. Question 70 · 338 in bank

    An engineer is creating an URL object on Cisco FMC. How must it be configured so that the object will match for HTTPS traffic in an access control policy?

    • ASpecify the protocol to match (HTTP or HTTPS).
    • BUse the FQDN including the subdomain for the website.
    • CUse the subject common name from the website certificate.
    • DDefine the path to the individual webpage that uses HTTPS.

    Show answer

    Answer: C

    Explanation

    The subject common name from the website certificate is used to match HTTPS traffic without performing SSL inspection. This allows the system to identify and match the URLs without decrypting the traffic, hence avoiding SSL inspection.

    Source: Adapted from community discussion — Stevens0103

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 61. 338 questions available.