300-710 practice questions 71–80

1. Question 71 · 338 in bank

   An engineer is configuring multiple Cisco FTD appliances for use in the network. Which rule must the engineer follow while defining interface objects in Cisco FMC for use with interfaces across multiple devices?

   • ATwo security zones can contain the same interface.
   • BInterface groups can contain interfaces from many devices.
   • CAn interface cannot belong to a security zone and an interface group.
   • DInterface groups can contain multiple interface types.

   Show answer

   Answer: B

   Explanation

   B. Interface groups can contain interfaces from many devices. When defining interface objects in Cisco FMC for use with interfaces across multiple devices, the engineer must follow the rule that interface groups can contain interfaces from many devices. This allows an administrator to manage multiple devices and interfaces as a single entity, simplifying configuration and management.

   Source: Adapted from community discussion — tanri04

   References

   • cisco.com documentation

   Next question

2. Question 72 · 338 in bank

   An administrator is adding a QoS policy to a Cisco FTD deployment. When a new rule is added to the policy and QoS is applied on “Interfaces in Destination Interface Objects”, no interface objects are available. What is the problem?

   • AThe FTD is out of available resources for use, so QoS cannot be added.
   • BThe network segments that the interfaces are on do not have contiguous IP space.
   • CA conflict exists between the destination interface types that is preventing QoS from being added.
   • DQoS is available only on routed interfaces, and this device is in transparent mode.

   Show answer

   Answer: D

   Explanation

   Introduction to QoS Quality of Service, or QoS, rate limits (polices) network traffic that is allowed or trusted by access control. The system does not rate limit traffic that was fastpathed. QoS is supported for routed interfaces on Firepower Threat Defense devices only.

   Source: Adapted from community discussion — gwb

   References

   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 73 · 338 in bank

   A network administrator wants to block traffic to a known malware site at https:/www.badsite.com and all subdomains while ensuring no packets from any internal client are sent to that site. Which type of policy must the network administrator use to accomplish this goal?

   • AAccess Control policy with URL filtering
   • BPrefilter policy
   • CDNS policy
   • DSSL policy

   Show answer

   Answer: C

   Explanation

   Hard requirement to not permit ANY packets from internal clients from reaching the site in the question. Regarging ACP URL Filters: "It takes 3 to 5 packets for the system to identify the application or URL in a connection. Thus, the correct access control rule might not be matched immediately for a given connection. However, once the application/URL is known, the connection is handled based on the matching rule. For encrypted connections, this happens after the server certificate exchange in the SSL handshake." https://www.cisco.com/c/en/us/td/docs/security/firepower/623/fdm/fptd-fdm-config-guide-623/fptd-fdm-access.html#concept_AA0463A9912F4868B33694E7C0C5648A Means a DNS Policy with a manually-created custom list is likely it.

   Source: Adapted from community discussion — Gabranch

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

4. Question 74 · 338 in bank

   An analyst is investigating a potentially compromised endpoint within the network and pulls a host report for the endpoint in question to collect metrics and documentation. What information should be taken from this report for the investigation?

   • Aclient applications by user, web applications, and user connections
   • Bnumber of attacked machines, sources of the attack, and traffic patterns
   • Cthreat detections over time and application protocols transferring malware
   • Dintrusion events, host connections, and user sessions

   Show answer

   Answer: D

   Explanation

   The Firepower System correlates various types of data (intrusion events, Security Intelligence, connection events, and file or malware events) to determine whether a host on your monitored network is likely to be compromised by malicious means. Certain combinations and frequencies of event data trigger indications of compromise (IOC) tags on affected hosts. https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/using_host_profiles.html#ID-2218-000003be

   Source: Adapted from community discussion — SegaMasterSystemAdmin

   References

   • Cisco documentation

   Next question

5. Question 75 · 338 in bank

   An engineer must investigate a connectivity issue and decides to use the packet capture feature on Cisco FTD. The goal is to see the real packet going through the Cisco FTD device and see Snort detection actions as a part of the output. After the capture-traffic command is issued, only the packets are displayed. Which action resolves this issue?

   • ASpecify the trace using the -T option after the capture-traffic command
   • BPerform the trace within the Cisco FMC GUI instead of the Cisco FMC CLI
   • CUse the verbose option as a part of the capture-traffic command
   • DUse the capture command and specify the trace option to get the required information

   Show answer

   Answer: D

   Explanation

   To see the real packets going through the Cisco FTD device and the Snort detection actions as part of the output, the engineer should use the following command: capture-traffic trace snort This command will capture traffic and display the real packets along with the Snort detection actions. If the engineer is already using this command, but only the packets are being displayed, the issue may be that the trace is not specified. To resolve this issue, the engineer should use option A: specify the trace using the -T option after the capture-traffic command. The engineer should add -T snort or -T raw to the end of the command. -T snort specifies that the output should include Snort intrusion events, while -T raw specifies that the output should include the raw packets. Therefore, the correct answer to this question is: A. Specify the trace using the -T option after the capture-traffic command.

   Source: Adapted from community discussion — thegreenhousesl

   References

   • Cisco documentation

   Next question

6. Question 76 · 338 in bank

   The event dashboard within the Cisco FMC has been inundated with low priority intrusion drop events, which are overshadowing high priority events. An engineer has been tasked with reviewing the policies and reducing the low priority events. Which action should be configured to accomplish this task?

   • Adrop packet
   • Bgenerate events
   • Cdrop connection
   • Ddrop and generate

   Show answer

   Answer: A

   Explanation

   This had me really confused for a bit, because I didn't see an option to just drop packet anywhere. I appears there is a difference between the versions of when this question was originally posted and now. The only Drop option in newer versions is Drop and generate events. I think the correct answer now would be to add a threshold to limit the number of events. Here's a link for version 6.2 that doesn't show a drop and generate events option: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/working_with_intrusion_events.html Here's a link for 7.0 that doesn't show a drop option: https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/working_with_intrusion_events.html

   Source: Adapted from community discussion — SanchezEldorado

   References

   • Cisco documentation
   • Cisco documentation

   Next question

7. Question 77 · 338 in bank

   An analyst using the security analyst account permissions is trying to view the Correlations Events Widget but is not able to access it. However, other dashboards are accessible. Why is this occurring?

   • AThe widget is configured to display only when active events are present
   • BThe security analyst role does not have permission to view this widget
   • CAn API restriction within the Cisco FMC is preventing the widget from displaying
   • DThe widget is not configured within the Cisco FMC

   Show answer

   Answer: D

   Explanation

   B is definitely wrong, see: https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/firepower_system_user_management.html As I cant find an option to configure A and API seems kind of ... weird? I would go with D

   Source: Adapted from community discussion — Baumb

   References

   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 78 · 338 in bank

   An engineer is troubleshooting connectivity to the DNS servers from hosts behind a new Cisco FTD device. The hosts cannot send DNS queries to servers in the DMZ. Which action should the engineer take to troubleshoot this issue using the real DNS packets?

   • AUse the packet capture tool to check where the traffic is being blocked and adjust the access control or intrusion policy as needed
   • BUse the Connection Events dashboard to check the block reason and adjust the inspection policy as needed
   • CUse the packet tracer tool to determine at which hop the packet is being dropped
   • DUse the show blocks command in the Threat Defense CLI tool and create a policy to allow the blocked traffic

   Show answer

   Answer: A

   Explanation

   Artificial Intelligence says "A" gathered from 40 sources: "The engineer should use the packet capture tool to check where the traffic is being blocked and adjust the access control or intrusion policy as needed. This is option A. The packet capture tool can be used to capture and analyze real DNS packets to determine where the traffic is being blocked. Once the source of the blockage is identified, the engineer can adjust the access control or intrusion policy as needed to allow DNS traffic to pass through to the servers in the DMZ."

   Source: Adapted from community discussion — aaInman

   References

   • Cisco documentation

   Next question

9. Question 79 · 338 in bank

   A network engineer sets up a secondary Cisco FMC that is integrated with Cisco Security Packet Analyzer. What occurs when the secondary Cisco FMC synchronizes with the primary Cisco FMC?

   • AThe existing configuration for integration of the secondary Cisco FMC the Cisco Security Packet Analyzer is overwritten.
   • BThe synchronization between the primary and secondary Cisco FMC fails.
   • CThe existing integration configuration is replicated to the primary Cisco FMC.
   • DThe secondary Cisco FMC must be reintegrated with the Cisco Security Packet Analyzer after the synchronization.

   Show answer

   Answer: A

   Explanation

   "Note that any existing configurations on the intended secondary Firepower Management Center for integrations with Cisco Security Packet Analyzer will be overwritten when synchronization occurs. If necessary, recreate any such configurations on the intended primary Firepower Management Center." https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/firepower_management_center_high_availability.html#id_32288

   Source: Adapted from community discussion — Mevijil

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

10. Question 80 · 338 in bank

    An analyst is reviewing the Cisco FMC reports for the week. They notice that some peer-to-peer applications are being used on the network and they must identify which poses the greatest risk to the environment. Which report gives the analyst this information?

    • AUser Risk Report
    • BAdvanced Malware Risk Report
    • CAttacks Risk Report
    • DNetwork Risk Report

    Show answer

    Answer: D

    Explanation

    User Risk Report is not a valid option, the rest of them are. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/710/management-center-admin-71/report-reports.html Network Risk Report sounds correct here. Attacks Risk Report is focused more on IPS events.

    Source: Adapted from community discussion — Kris92

    References

    • Cisco documentation
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 71. 338 questions available.