109 free Cisco 300-710 SNCF practice questions from the CertStash pack of 435, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 109 free here, all 435 in the pack, and each step includes the one before it.
Get all 435 questions (US$39) · Download the first 10 as a PDF
Question 1
What is a result of enabling Cisco FTD clustering?
Show answer and explanation
Correct answer: C. Site-to-site VPN functionality is limited to the master unit, and all VPN connections are dropped if the master unit fails.
Site-to-site VPN functionality in Cisco FTD clustering is indeed limited to the master unit, and all VPN connections are dropped if the master unit fails. This is a known limitation of FTD clustering architecture where VPN state is not fully synchronized across cluster members, making VPN connections dependent on the master unit's availability.
Why the other options are wrong
- A. Dynamic routing connections are maintained when a new master is elected due to connection state synchronization in clustering.
- B. Integrated Routing and Bridging (IRB) is not supported on FTD master units regardless of clustering configuration.
- D. Not all Firepower appliances support FTD clustering; only certain models and form factors are compatible with clustering.
Question 2
Which two conditions are necessary for high availability to function between two Cisco FTD devices? (Choose two.)
Show answer and explanation
Correct answer: A, E. The units must be the same version; The units must be the same model.
For high availability to function between two Cisco FTD devices, the units must be the same version to ensure compatibility of state synchronization protocols and feature parity. Additionally, the units must be the same model to guarantee identical hardware capabilities, processing power, and interface configurations necessary for seamless failover.
Why the other options are wrong
- B. Both devices can be in the same group within the FMC; they do not need to be in different groups, and domain requirements are not a primary HA constraint.
- C. If units are part of the same series, they must be the same model for HA, not different models.
- D. High availability is supported in both routed and transparent modes; it is not limited to firewall routed mode only.
Question 3
On the advanced tab under inline set properties, which allows interfaces to emulate a passive interface?
Show answer and explanation
Correct answer: B. TAP mode
TAP mode (Traffic Access Point mode) on the advanced tab under inline set properties allows interfaces to emulate a passive interface. In TAP mode, the device passively monitors traffic without actively blocking or forwarding it, making it behave like a passive tap on the network rather than an active inline appliance.
Why the other options are wrong
- A. Transparent inline mode processes traffic actively between inline pairs but does not specifically emulate a passive interface.
- C. Strict TCP enforcement is a security policy setting for TCP connection handling, not an interface mode for passive emulation.
- D. Propagate link state is a feature for maintaining link status awareness across inline pairs, not for emulating passive interfaces.
Question 4
What are the minimum requirements to deploy a managed device inline?
Show answer and explanation
Correct answer: C. inline interfaces, MTU, and mode
The minimum requirements to deploy a managed device inline are inline interfaces (to define the paired interfaces for traffic inspection), MTU (Maximum Transmission Unit configuration to ensure proper packet handling), and mode (the operational mode of the inline deployment). These three elements are essential for establishing inline traffic inspection.
Why the other options are wrong
- A. Security zones are not mandatory for inline deployment; inline mode uses inline interface pairs rather than zone-based segmentation.
- B. Passive interface is not required for inline deployment; inline mode actively inspects traffic between paired interfaces.
- D. Passive interface is not a requirement for inline deployment, and security zones are not mandatory for inline configuration.
Question 5
What is the difference between inline and inline tap on Cisco Firepower?
Show answer and explanation
Correct answer: D. Inline mode can drop malicious traffic.
The key difference between inline and inline tap modes is that inline mode can drop malicious traffic by actively blocking connections, while inline tap mode operates passively and cannot drop traffic. Inline mode actively inspects and enforces security policies with the ability to block malicious packets, whereas inline tap mode only monitors and can alert but cannot enforce blocking.
Why the other options are wrong
- A. Inline tap mode receives a copy of traffic for monitoring but does not send copies to other devices; traffic flow is unidirectional to the appliance.
- B. Both inline and inline tap modes can perform full packet capture; packet capture capability is not a differentiator between these modes.
- C. Inline mode can perform SSL decryption if configured with appropriate certificates; SSL decryption is not limited in inline mode.
Question 6
With Cisco FTD software, which interface mode must be configured to passively receive traffic that passes through the appliance?
Show answer and explanation
Correct answer: D. inline tap
Inline tap mode is the interface mode that must be configured to passively receive traffic that passes through the appliance. In inline tap mode, the Cisco FTD device operates as a passive monitoring point, receiving copies of traffic for inspection without actively forwarding or blocking packets in the data path.
Why the other options are wrong
- A. Inline set mode actively forwards traffic between paired interfaces rather than passively receiving it.
- B. Passive mode is not a standard FTD interface mode designation in the software architecture.
- C. Routed mode actively routes traffic between interfaces rather than passively receiving or monitoring it.
Question 7
Which two deployment types support high availability? (Choose two.)
Show answer and explanation
Correct answer: A, B. transparent; routed
The two deployment types that support high availability in Cisco FTD are transparent and routed modes. Both of these deployment modes support active-standby HA configurations where a secondary device can take over if the primary device fails, maintaining continuous network connectivity and security services.
Why the other options are wrong
- C. Clustered deployments are a separate redundancy architecture from high availability and operate differently with multiple active units rather than active-standby HA pairs.
- D. Intra-chassis multi-instance deployments involve multiple logical instances on a single physical appliance and do not support traditional high availability between separate devices.
- E. Virtual appliances in public cloud environments have different HA mechanisms specific to cloud platforms and are not considered standard FTD HA deployment types.
Question 8
Which protocol establishes network redundancy in a switched Firepower device deployment?
Show answer and explanation
Correct answer: A. STP
Spanning Tree Protocol (STP) is the protocol that establishes network redundancy in a switched Firepower device deployment. STP prevents layer 2 loops in switched network topologies by blocking redundant paths and enabling failover when primary links fail, making it essential for maintaining network stability in switched environments with multiple connections.
Why the other options are wrong
- B. HSRP (Hot Standby Router Protocol) provides gateway redundancy for routed interfaces, not switched network redundancy.
- C. GLBP (Gateway Load Balancing Protocol) is used for load balancing between gateway redundancy pairs, not for switched infrastructure redundancy.
- D. VRRP (Virtual Router Redundancy Protocol) provides virtual router redundancy for routed gateways, not for switched layer 2 network redundancy.
Question 9
Which interface type allows packets to be dropped?
Show answer and explanation
Correct answer: B. inline
Inline interfaces operate in the data path where packets are actively inspected and can be dropped based on policy decisions. This is the fundamental characteristic of inline mode, traffic flows through the device and can be denied or allowed based on inspection results. Passive interfaces (TAP/SPAN) only monitor traffic without affecting the data path, and ERSPAN is a remote monitoring technology that doesn't drop packets.
Why the other options are wrong
- A. Passive interfaces only monitor traffic and cannot drop packets.
- C. ERSPAN is an encapsulated remote monitoring protocol that doesn't perform active packet dropping.
- D. TAP interfaces are passive monitoring points that cannot drop packets.
Question 10
Which Cisco Firepower Threat Defense, which two interface settings are required when configuring a routed interface? (Choose two.)
Show answer and explanation
Correct answer: C, E. Speed; Duplex
When configuring a routed interface on Cisco FTD, Speed and Duplex settings are required physical layer parameters that must be explicitly set to ensure proper interface operation. These are standard interface configuration requirements for routed mode. Redundant Interface and EtherChannel are optional features for specific scenarios, and Media Type is typically auto-detected.
Why the other options are wrong
- A. Redundant Interface is an optional feature for high availability, not a required setting.
- B. EtherChannel is an optional feature for link aggregation, not required for basic routed interfaces.
- D. Media Type is typically auto-detected and not a required configuration parameter.
What people say about the full 300-710 pack 5.0 from 5
Passed the 300-710! Solid dump. Real questions throughout. For a niche Cisco exam like this it is hard to find good material. This is the best I found.
Passed 300-710 exam smoothly. Great questions.
Used this and cleared the exam. Passed without having to dedicate huge amounts of time studying. I was studying for this while working full time.
Question 11
An engineer must deploy a Cisco FTD appliance via Cisco FMC to span a network segment to detect malware and threats. When setting the Cisco FTD interface mode, which sequence of actions meets this requirement?
Show answer and explanation
Correct answer: A. Set to passive, and configure an access control policy with an intrusion policy and a file policy defined.
To span a network segment for malware and threat detection, the FTD interface must be set to 'passive' mode, which allows it to monitor traffic without blocking or actively participating in forwarding. This passive monitoring configuration requires an access control policy with intrusion policy and file policy defined to detect threats and malware. Passive mode enables non-intrusive threat detection.
Why the other options are wrong
- B. A prefilter policy is not the primary detection mechanism for malware and threats.
- C. Setting to 'none' does not enable passive monitoring capability.
- D. Using 'none' mode with prefilter policy does not provide the passive detection posture needed.
Question 12
With Cisco FTD software, which interface mode must be configured to passively receive traffic that passes through the appliance?
Show answer and explanation
Correct answer: C. tap
TAP (Test Access Point) mode configures an interface to passively receive and analyze traffic without actively forwarding or filtering it. This mode is used for passive monitoring and inspection without impacting traffic flow through the appliance.
Why the other options are wrong
- A. ERSPAN is a Cisco protocol for remote traffic mirroring, not a passive interface mode on FTD.
- B. Firewall mode actively filters and forwards traffic; it does not passively receive.
- D. IPS-only mode focuses on intrusion prevention, not passive traffic reception.
Question 13
A network administrator reviews the file report for the last month and notices that all file types, except exe, show a disposition of unknown. What is the cause of this issue?
Show answer and explanation
Correct answer: A. Only Spero file analysis is enabled.
When only Spero file analysis is enabled, the system can only identify executable (.exe) files with known signatures. All other file types show as unknown disposition because Spero is a signature-based local analysis method that doesn't provide comprehensive coverage for non-executable files. To get disposition data for other file types, additional analysis methods like AMP cloud lookup or dynamic analysis would need to be enabled.
Why the other options are wrong
- B. If FMC couldn't reach the Internet, exe files would also show unknown disposition since cloud lookups would fail.
- C. A missing file policy would prevent any file inspection, not result in selectively unknown dispositions by file type.
- D. Without a malware license, file analysis would not function at all rather than showing unknown for specific file types.
Question 14
Which two dynamic routing protocols are supported in Cisco FTD without using FlexConfig? (Choose two.)
Show answer and explanation
Correct answer: B, E. OSPF; BGP
Cisco FTD natively supports OSPF and BGP as dynamic routing protocols without requiring FlexConfig. These are the standard interior and exterior gateway protocols integrated into the FTD platform. EIGRP, IS-IS, and static routing either require FlexConfig for advanced configurations or are not classified as dynamic routing protocols in this context.
Why the other options are wrong
- A. EIGRP requires FlexConfig to be implemented on FTD.
- C. Static routing is not a dynamic routing protocol.
- D. IS-IS requires FlexConfig to be implemented on FTD.
Question 15
What is the disadvantage of setting up a site-to-site VPN in a clustered-units environment?
Show answer and explanation
Correct answer: C. VPN connections must be re-established when a new master unit is elected.
In a clustered environment, when a failover occurs and a new master unit is elected, site-to-site VPN connections must be re-established because the VPN state and context are tied to the specific master unit. The newly elected master does not automatically inherit the VPN sessions from its predecessor.
Why the other options are wrong
- A. VPN connections can be re-established with a new master unit; they are not limited to recovery of the original failed unit.
- B. Smart License is not a requirement for maintaining VPN connections across cluster units; clustering support is a feature independent of licensing.
- D. Established VPN connections are not automatically maintained during master failover; they must be re-established because the new master has different control plane context.
Question 16
A network administrator notices that inspection has been interrupted on all non-managed interfaces of a device. What is the cause of this?
Show answer and explanation
Correct answer: A. The value of the highest MTU assigned to any non-management interface was changed
When the highest MTU value assigned to any non-management interface changes, it affects the inspection engine's ability to process traffic on all non-managed interfaces. MTU mismatches can cause inspection interruption because the firewall cannot properly fragment or process packets that exceed the configured maximum transmission unit.
Why the other options are wrong
- B. MSS (Maximum Segment Size) is a TCP-level parameter that affects individual connections, not system-wide inspection.
- C. Associating a passive interface with a security zone would affect that specific interface, not all non-managed interfaces.
- D. Multiple inline interface pairs can be configured together; this is a supported configuration, not a cause of inspection interruption.
Question 17
A network administrator is implementing an active/passive high availability Cisco FTD pair. When adding the high availability pair, the administrator cannot select the secondary peer. What is the cause?
Show answer and explanation
Correct answer: C. The failover link must be defined on each Cisco FTD before adding the high availability pair.
When configuring active/passive HA on Cisco FTD devices, the failover link must be defined on each device before they can be paired together. The failover link is the dedicated communication channel between the primary and secondary devices for heartbeat and state synchronization. Without this link configured, the management interface cannot properly detect and select the secondary peer.
Why the other options are wrong
- A. FTD devices must be the same model, but this is not the immediate cause of inability to select the secondary peer.
- B. HA licensing is required but would prevent HA pairing entirely, not just selection of the secondary peer.
- D. Software version mismatch is a requirement but would not prevent initial selection of the secondary peer in the GUI.
Question 18
An engineer is creating an URL object on Cisco FMC. How must it be configured so that the object will match for HTTPS traffic in an access control policy?
Show answer and explanation
Correct answer: C. Use the subject common name from the website certificate.
When configuring URL objects in Cisco FMC for HTTPS traffic inspection, the system uses the subject common name (CN) extracted from the website's SSL/TLS certificate for matching. This is necessary because HTTPS traffic is encrypted, making the actual URL invisible at the network layer. The FTD performs SSL/TLS decryption and inspection, then matches against the certificate's subject CN.
Why the other options are wrong
- A. URL objects do not have a protocol field to specify HTTP vs HTTPS; protocol handling is managed through certificate inspection.
- B. FQDN matching alone is insufficient for HTTPS; the certificate CN is what is actually matched during encrypted traffic inspection.
- D. Individual webpage paths cannot be matched in HTTPS traffic as the path portion of URLs is encrypted and not visible without decryption.
Question 19
An engineer is tasked with deploying an internal perimeter firewall that will support multiple DMZs. Each DMZ has a unique private IP subnet range. How is this requirement satisfied?
Show answer and explanation
Correct answer: B. Deploy the firewall in routed mode with access control policies
Routed mode is the correct choice for supporting multiple DMZs with unique private IP subnet ranges. In routed mode, the firewall acts as a router and performs IP routing between different subnets, allowing it to manage traffic between multiple DMZs each with their own distinct subnet ranges. Access control policies are then applied to control traffic flow between these DMZs. This is the standard architecture for multi-DMZ deployments.
Why the other options are wrong
- A. Transparent mode acts as a Layer 2 bridge and cannot route between different subnets; it's not suitable for managing multiple unique IP subnet ranges.
- C. While routed mode with NAT could work, NAT is unnecessary and not required for the core requirement of supporting multiple DMZs with unique private subnets.
- D. Transparent mode does not perform routing and therefore cannot support multiple DMZs with different private subnet ranges.
Question 20
A network engineer is logged into the Cisco AMP for Endpoints console and sees a malicious verdict for an identified SHA-256 hash. Which configuration is needed to mitigate this threat?
Show answer and explanation
Correct answer: A. Add the hash to the simple custom detection list
When a malicious SHA-256 hash is identified in Cisco AMP for Endpoints console, adding it to the simple custom detection list creates a local detection rule that will block or quarantine files matching that hash across all managed endpoints. This is the direct mitigation step taken at the AMP console level.
Why the other options are wrong
- B. Regular expressions are not the appropriate mechanism for blocking specific file hashes in AMP; custom detection lists handle hash-based blocking.
- C. Enabling a personal firewall does not directly address malware detection or mitigation based on file hashes.
- D. Network block lists are not a feature of AMP for Endpoints; the mitigation is configured within the AMP console itself.
Question 21
An engineer is working on a LAN switch and has noticed that its network connection to the inline Cisco IPS has gone down. Upon troubleshooting, it is determined that the switch is working as expected. What must have been implemented for this failure to occur?
Show answer and explanation
Correct answer: B. Link-state propagation is enabled.
When a LAN switch loses network connection to an inline Cisco IPS but the switch itself is functioning correctly, link-state propagation must be enabled. This feature allows the switch to detect when the IPS connection is down and adjust its forwarding behavior accordingly, causing the described failure mode where the IPS connection appears to have failed from a traffic perspective.
Why the other options are wrong
- A. A misconfigured upstream routing protocol would not directly cause the switch-to-IPS connection to fail if the switch itself is functioning normally.
- C. Fail-open mode would allow traffic to pass even if the IPS goes down, rather than causing the connection to appear as failed.
- D. Detection mode on the IPS is a passive operating mode unrelated to physical connectivity failures between the switch and IPS.
Question 22
Which feature within the Cisco FMC web interface allows for detecting, analyzing, and blocking malware in network traffic?
Show answer and explanation
Correct answer: B. Cisco AMP for Networks
Cisco AMP for Networks is the FMC feature that enables detection, analysis, and blocking of malware within network traffic. It integrates with FMC to inspect files in motion, correlate against threat intelligence, and take blocking actions on identified malware. Intrusion events monitor network attacks, file policies govern file handling, and AMP for Endpoints is client-side technology.
Why the other options are wrong
- A. Intrusion and file events provide visibility but do not perform malware detection themselves.
- C. File policies are general file handling rules and do not provide malware detection analysis.
- D. AMP for Endpoints protects individual devices, not network traffic in transit.
Question 23
An engineer must define a URL object on Cisco FMC. What is the correct method to specify the URL without performing SSL inspection?
Show answer and explanation
Correct answer: B. Use Subject Common Name value.
Using the Subject Common Name (CN) value from the SSL certificate allows URL definition without performing SSL inspection. The Common Name is extracted from the certificate itself, enabling the firewall to identify URLs by the certificate attributes rather than decrypting and inspecting the SSL/TLS traffic, which would require SSL inspection to be enabled.
Why the other options are wrong
- A. CRL Distribution Points are certificate revocation list references, not a method for defining URLs without SSL inspection.
- C. Specifying all subdomains in an object group still requires SSL inspection to verify the domains in the certificate.
- D. Specifying the protocol alone does not prevent SSL inspection; the traffic would still need to be decrypted to enforce URL-based policies.
Question 24
The event dashboard within the Cisco FMC has been inundated with low priority intrusion drop events, which are overshadowing high priority events. An engineer has been tasked with reviewing the policies and reducing the low priority events. Which action should be configured to accomplish this task?
Show answer and explanation
Correct answer: B. generate events
The 'generate events' action allows events to be logged and displayed on the dashboard. To reduce low-priority events from overwhelming the dashboard, disabling event generation for low-priority rules prevents them from appearing while allowing high-priority events to remain visible. This action controls what gets reported without dropping traffic.
Why the other options are wrong
- A. Drop packet does not control event visibility on the dashboard.
- C. Drop connection terminates traffic but does not solve the event dashboard inundation issue.
- D. Drop and generate would still generate the low-priority events, perpetuating the problem.
Question 25
A network administrator is configuring an FTD in transparent mode. A bridge group is set up and an access policy has been set up to allow all IP traffic. Traffic is not passing through the FTD. What additional configuration is needed?
Show answer and explanation
Correct answer: A. An IP address must be assigned to the BVI.
In transparent mode, an IP address must be assigned to the Bridge Virtual Interface (BVI) to enable management traffic and allow the FTD to participate in the network. Without a BVI IP address, the FTD cannot properly handle Layer 3 operations and management connectivity, preventing traffic from passing through correctly.
Why the other options are wrong
- B. Transparent mode does not use security levels; interfaces operate at Layer 2.
- C. A default route is not the missing component; transparent mode handles bridged traffic without routing.
- D. MAC access control lists are not required for basic transparent mode operation with an allow-all IP policy.
Question 26
What is a feature of Cisco AMP private cloud?
Show answer and explanation
Correct answer: A. It disables direct connections to the public cloud.
A key feature of Cisco AMP private cloud deployment is that it disables direct connections to the public cloud, keeping threat intelligence analysis and malware detection within an on-premises environment. This provides organizations with isolated, air-gapped threat analysis capabilities. The other options describe features of cloud-based or hybrid deployments rather than private cloud-specific features.
Why the other options are wrong
- B. Security intelligence filtering is available in both public and private cloud configurations.
- C. Anonymized threat intelligence retrieval is a public cloud feature, not private cloud-specific.
- D. Dynamic analysis capabilities exist in cloud-based AMP, not exclusively in private cloud.
Question 27
An engineer has been tasked with using Cisco FMC to determine if files being sent through the network are malware. Which two configuration tasks must be performed to achieve this file lookup? (Choose two.)
Show answer and explanation
Correct answer: A, E. The Cisco FMC needs to include a SSL decryption policy; The Cisco FMC needs to include a file inspection policy for malware lookup.
To determine if files in network traffic are malware, FMC must be configured with both an SSL decryption policy (to inspect encrypted file transfers) and a file inspection policy for malware lookup (to analyze files and query threat intelligence). SSL decryption ensures FMC can inspect encrypted traffic, while the file inspection policy defines how and where files are analyzed. AMP for Endpoints, ThreatGrid direct connections, and FireAMP Cloud are optional integrations but not mandatory for basic file malware lookups.
Why the other options are wrong
- B. AMP for Endpoints is not required; it protects endpoints, not network file traffic.
- C. Direct ThreatGrid connection is optional; FMC can use cloud-based analysis without direct connection.
- D. FireAMP Cloud integration is not a required configuration task for basic file malware lookup.
Question 28
Which action should you take when Cisco Threat Response notifies you that AMP has identified a file as malware?
Show answer and explanation
Correct answer: A. Add the malicious file to the block list.
When Cisco Threat Response notifies you that AMP has identified a file as malware, the appropriate action is to add the malicious file to the block list. This ensures the file is prevented from execution across the organization and stops the threat from spreading. This is a direct, proactive security measure.
Why the other options are wrong
- B. Sending a snapshot to Cisco for support is unnecessary when the malware has already been identified and a clear course of action exists.
- C. Forwarding to an external engine duplicates analysis already performed by AMP and Threat Response.
- D. Waiting for automatic blocking introduces unnecessary delay and risk; manual blocking should be initiated immediately when malware is confirmed.
Question 29
A network administrator is migrating from a Cisco ASA to a Cisco FTD. EIGRP is configured on the Cisco ASA but it is not available in the Cisco FMC. Which action must the administrator take to enable this feature on the Cisco FTD?
Show answer and explanation
Correct answer: A. Configure EIGRP parameters using FlexConfig objects.
When migrating from Cisco ASA to FTD and a feature like EIGRP is not available directly in FMC, FlexConfig objects provide the mechanism to apply CLI configurations directly to the FTD device. FlexConfig allows administrators to configure advanced features that are not exposed in the FMC GUI by specifying the underlying CLI commands.
Why the other options are wrong
- B. Direct CLI access via FTD CLI bypasses the management capabilities of FMC and is not the recommended enterprise approach.
- C. Custom variable sets are used for different deployment scenarios but do not enable unavailable features like EIGRP.
- D. Advanced configuration options in FMC do not add support for protocols like EIGRP that require direct CLI configuration through FlexConfig.
Question 30
Which command-line mode is supported from the Cisco FMC CLI?
Show answer and explanation
Correct answer: C. configuration
Configuration mode is the command-line mode supported from the Cisco FMC CLI, allowing administrators to configure system settings and parameters through command-line interface access.
Why the other options are wrong
- A. Privileged mode is not the specific mode terminology used for Cisco FMC CLI.
- B. User mode is not the supported CLI mode for Cisco FMC configuration.
- D. Admin mode is not the standard FMC CLI mode terminology.
Question 31
Which object type supports object overrides?
Show answer and explanation
Correct answer: C. network object
Network objects in Cisco FMC support object overrides, allowing administrators to define base network objects at the global level and then override their values at specific device or cluster levels. This enables flexible policy deployment across heterogeneous environments while maintaining a common policy structure.
Why the other options are wrong
- A. Time range objects do not support overrides; they are defined globally and applied uniformly.
- B. Security group tag objects do not support the override mechanism.
- D. DNS server group objects do not support object-level overrides in the same way network objects do.
Question 32
An engineer currently has a Cisco FTD device registered to the Cisco FMC and is assigned the address of 10.10.50.12. The organization is upgrading the addressing schemes and there is a requirement to convert the addresses to a format that provides an adequate amount of addresses on the network. What should the engineer do to ensure that the new addressing takes effect and can be used for the Cisco FTD to Cisco FMC connection?
Show answer and explanation
Correct answer: D. Delete and reregister the device to Cisco FMC.
When changing the IP address of an FTD device registered to FMC (whether upgrading from IPv4 to IPv6 or changing within the same protocol), the device must be deleted from FMC and then re-registered with the new address. This ensures that FMC properly recognizes the new addressing and can establish the management connection correctly. Simply updating the address without deletion can result in connection inconsistencies.
Why the other options are wrong
- A. Updating IP addresses without deletion will not properly register the new address with FMC.
- B. Formatting is not necessary; deletion and re-registration is the correct procedure.
- C. Cisco FMC fully supports IPv4 addresses; the upgrade to IPv6 is optional based on organizational requirements.
Question 33
An engineer is using the configure manager add Cisc404225383 command to add a new Cisco FTD device to the Cisco FMC; however, the device is not being added. Why is this occurring?
Show answer and explanation
Correct answer: C. The registration key is missing from the command
The registration key is a critical component required in the configure manager command to add a Cisco FTD device to the FMC. Without the registration key, the FTD cannot authenticate and establish trust with the FMC, preventing successful device registration.
Why the other options are wrong
- A. DONOTRESOLVE is not a standard requirement for the configure manager command.
- B. The command requires the IP address of the FMC (management server), not the FTD being registered.
- D. While NAT ID may be needed in certain deployments, the registration key is the fundamental missing component in the command itself.
Question 34
An administrator is configuring their transparent Cisco FTD device to receive ERSPAN traffic from multiple switches on a passive port, but the Cisco FTD is not processing the traffic. What is the problem?
Show answer and explanation
Correct answer: C. The Cisco FTD must be in routed mode to process ERSPAN traffic.
ERSPAN interfaces on Cisco Secure Firewall Threat Defense are supported only when the device is in routed firewall mode. The FTD in this question is in transparent mode, so it cannot process the ERSPAN traffic that arrives from the switches. Change the firewall mode to routed.
Why the other options are wrong
- A. The switches do need Layer 3 connectivity to send GRE traffic, but the scenario points to the firewall mode, because ERSPAN is not supported on a transparent mode FTD.
- B. A flow ID mismatch is not the issue here, because ERSPAN cannot be used at all while the FTD is in transparent mode.
- D. An ERSPAN interface is itself a kind of passive interface, and it cannot be used while the device is in transparent mode, so the firewall mode must change first.
Question 35
An organization does not want to use the default Cisco Firepower block page when blocking HTTP traffic. The organization wants to include information about its policies and procedures to help educate the users whenever a block occurs. Which two steps must be taken to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: C, D. Create HTML code with the information for the policies and procedures; Change the HTTP response in the access control policy to custom
To implement a custom block page, the organization must create the HTML code containing policy and procedure information (option C), and then configure the access control policy to use a custom HTTP response instead of the default block page (option D). Together, these steps allow for both creating the custom content and configuring the firewall to serve it when blocking HTTP traffic.
Why the other options are wrong
- A. The access control policy uses HTTP response settings, not request handling, for block page customization.
- B. Python is not the mechanism for modifying block pages in Cisco Firepower; HTML and CSS are used.
- E. While CSS can be part of block page styling, it is not one of the two primary steps required; HTML code creation and policy configuration are essential.
Question 36
What are two application layer preprocessors? (Choose two.)
Show answer and explanation
Correct answer: B, C. IMAP; SSL
IMAP and SSL are application layer preprocessors that inspect and analyze application-level protocols. IMAP handles email protocol inspection, while SSL performs encrypted traffic analysis and decryption processing. These operate at Layer 7 to detect threats at the application level. CIFS, DNP3, and ICMP are network protocols but not classified as application layer preprocessors in Firepower's inspection engine.
Why the other options are wrong
- A. CIFS is a file-sharing protocol but not classified as an application layer preprocessor.
- D. DNP3 is an industrial control protocol but not classified as an application layer preprocessor.
- E. ICMP is a network layer protocol, not an application layer preprocessor.
Question 37
Which command is entered in the Cisco FMC CLI to generate a troubleshooting file?
Show answer and explanation
Correct answer: D. sudo sf_troubleshoot.pl
The sudo sf_troubleshoot.pl command is the correct Cisco FMC CLI command used to generate comprehensive troubleshooting files. This Perl script collects system diagnostics, logs, and configuration information needed for support and analysis.
Why the other options are wrong
- A. show running-config displays current configuration but does not generate troubleshooting diagnostic files
- B. show tech-support chassis is not a valid FMC command for generating troubleshooting output
- C. system support diagnostic-cli is not the correct command syntax for FMC troubleshooting file generation
Question 38
An engineer is implementing Cisco FTD in the network and is determining which Firepower mode to use. The organization needs to have multiple virtual Firepower devices working separately inside of the FTD appliance to provide traffic segmentation. Which deployment mode should be configured in the Cisco Firepower Management Console to support these requirements?
Show answer and explanation
Correct answer: A. multi-instance
Multi-instance mode allows multiple independent virtual Firepower devices to operate within a single FTD appliance, each with separate configurations and policies for traffic segmentation. This deployment mode is specifically designed for scenarios requiring logical separation of firewall instances. Single deployment, single-context, and multiple deployment are not valid Firepower deployment mode terms.
Why the other options are wrong
- B. Multiple deployment is not a standard Firepower deployment mode.
- C. Single deployment does not support multiple virtual devices on one appliance.
- D. Single-context refers to running one instance, not multiple separate instances.
Question 39
An analyst is investigating a potentially compromised endpoint within the network and pulls a host report for the endpoint in question to collect metrics and documentation. What information should be taken from this report for the investigation?
Show answer and explanation
Correct answer: D. intrusion events, host connections, and user sessions
When investigating a potentially compromised endpoint, a host report should provide intrusion events (attack attempts detected), host connections (network communications), and user sessions (active users and their activities). This information is essential for understanding what activity occurred on the compromised host, who was using it, and what connections were established, which are critical for forensic investigation and incident response.
Why the other options are wrong
- A. Client applications by user and web applications are useful for inventory but not specifically for identifying compromise indicators.
- B. Attacked machines and attack sources relate to network-wide attack metrics, not individual host compromise investigation.
- C. While threat detections are relevant, application protocols transferring malware is better captured in more specific malware or threat reports rather than general host reports.
Question 40
Which command must be run to generate troubleshooting files on an FTD?
Show answer and explanation
Correct answer: C. system generate-troubleshoot all
The system generate-troubleshoot all command is the correct method to generate comprehensive troubleshooting files on Cisco FTD units, collecting all necessary diagnostic information for support and analysis.
Why the other options are wrong
- A. system support view-files is used to view existing files, not generate troubleshooting bundles
- B. sudo sf_troubleshoot.pl is the FMC command, not the FTD equivalent
- D. show tech-support displays information but does not generate bundled troubleshooting files on FTD
Question 41
After using Firepower for some time and learning about how it interacts with the network, an administrator is trying to correlate malicious activity with a user. Which widget should be configured to provide this visibility on the Cisco Firepower dashboards?
Show answer and explanation
Correct answer: B. Correlation Events
The Correlation Events widget provides visibility into events that have been correlated by the system, allowing administrators to track malicious activity associated with specific users. This widget displays the results of Firepower's correlation engine, which connects various security events to identify patterns of malicious behavior and attribute them to users on the network.
Why the other options are wrong
- A. Current Sessions widget shows active connections but does not correlate malicious activity with users.
- C. Current Status widget displays system health and operational status, not user-correlated malicious activity.
- D. Custom Analysis is a general capability but not specifically designed to correlate malicious activity with users.
Question 42
A network engineer is tasked with minimizing traffic interruption during peak traffic times. When the SNORT inspection engine is overwhelmed, what must be configured to alleviate this issue?
Show answer and explanation
Correct answer: D. Enable Automatic Application Bypass
Automatic Application Bypass allows Firepower to bypass inspection for applications when the SNORT engine becomes overwhelmed or experiences latency, preventing traffic interruption during peak times. This feature automatically diverts traffic around the inspection engine under stress conditions rather than dropping packets or causing congestion.
Why the other options are wrong
- A. IPS inline link state propagation is used for failover mechanisms, not for handling inspection engine overload.
- B. Pre-filter policies help optimize traffic flow but do not specifically alleviate SNORT engine overwhelm issues.
- C. Setting a Trust ALL policy would disable all security controls, which is not an appropriate solution for load management.
Question 43
With Cisco FTD integrated routing and bridging, which interface does the bridge group use to communicate with a routed interface?
Show answer and explanation
Correct answer: C. bridge virtual
In Cisco FTD integrated routing and bridging (IRB), a bridge virtual interface is created to serve as the layer 3 interface for the bridge group. This virtual interface allows communication between the bridged (layer 2) interfaces and routed interfaces, enabling the bridge group to participate in routing.
Why the other options are wrong
- A. Subinterfaces are used for VLAN trunking on routed interfaces, not for bridge group communication.
- B. Switch virtual interfaces are associated with VLANs in traditional switching, not FTD bridging.
- D. Bridge group members are the physical interfaces in the bridge, not the interface used for inter-bridge communication.
Question 44
What is the maximum bit size that Cisco FMC supports for HTTPS certificates?
Show answer and explanation
Correct answer: C. 4096
Cisco FMC supports a maximum of 4096-bit certificates for HTTPS. This is the current industry standard for secure communications and provides adequate cryptographic strength for management traffic between FMC and managed devices. Larger bit sizes like 8192 are not supported by FMC, while smaller sizes like 1024 and 2048 are considered insufficient for modern security requirements.
Why the other options are wrong
- A. 1024-bit certificates are too weak and no longer recommended for secure communications.
- B. 8192-bit certificates exceed the maximum supported size in Cisco FMC.
- D. While 2048-bit is acceptable in some contexts, FMC specifically supports up to 4096-bit as the maximum.
Question 45
An engineer is building a new access control policy using Cisco FMC. The policy must inspect a unique IPS policy as well as log rule matching. Which action must be taken to meet these requirements?
Show answer and explanation
Correct answer: A. Configure an IPS policy and enable per-rule logging
Configuring an IPS policy and enabling per-rule logging meets both requirements. A custom IPS policy allows inspection with unique rules specific to the organization's needs, while per-rule logging enables tracking of individual rule matches for detailed auditing and troubleshooting. This provides both the specialized IPS inspection and granular logging visibility required.
Why the other options are wrong
- B. Disabling the default IPS policy is unnecessary; policies can be customized while keeping defaults available.
- C. Global logging does not provide the per-rule granularity needed to understand which specific access control rules matched.
- D. Disabling the default IPS policy unnecessarily removes a functional baseline.
Question 46
Which report template field format is available in Cisco FMC?
Show answer and explanation
Correct answer: C. bar chart
Bar charts are a supported report template field format in Cisco FMC, allowing administrators to visualize security data and metrics in graphical format for reporting and analysis purposes.
Why the other options are wrong
- A. Box lever chart is not a valid report format in FMC.
- B. Arrow chart is not a standard report format supported by Cisco FMC.
- D. Benchmark chart is not a supported report template field format in FMC.
Question 47
An administrator receives reports that users cannot access a cloud-hosted web server. The access control policy was recently updated with several new policy additions and URL filtering. What must be done to troubleshoot the issue and restore access without sacrificing the organization's security posture?
Show answer and explanation
Correct answer: B. Identify the blocked traffic in the Cisco FMC connection events to validate the block, and modify the policy to allow the traffic to the web server.
When users cannot access a cloud-hosted web server after policy updates, the administrator must first validate what traffic is being blocked. Cisco FMC connection events provide visibility into blocked traffic, allowing the administrator to verify the specific blocks and then modify the policy with precision to allow only the required traffic. This balances troubleshooting accuracy with security posture maintenance by making targeted policy changes rather than broad allowances.
Why the other options are wrong
- A. While PCAPs can show traffic, flexconfig objects are not the standard method for managing access control rules in Cisco FMC; connection events in FMC are the proper tool.
- C. Creating a blanket rule to allow ports 80 and 443 to an FQDN without first validating what is actually blocked is inefficient and skips proper troubleshooting methodology.
- D. Setting rules to monitor without first validating the blocks leaves the access issue unresolved and doesn't address the immediate user access problem.
Question 48
An engineer is configuring Cisco FMC and wants to allow multiple physical interfaces to be part of the same VLAN. The managed devices must be able to perform Layer 2 switching between interfaces, including sub-interfaces. What must be configured to meet these requirements?
Show answer and explanation
Correct answer: D. integrated routing and bridging
Integrated Routing and Bridging (IRB) enables multiple physical interfaces and sub-interfaces to operate as part of the same VLAN while performing Layer 2 switching between them. This feature allows the firewall to bridge traffic at Layer 2 while maintaining separate routing domains, meeting the requirement for VLAN-based Layer 2 switching including sub-interfaces.
Why the other options are wrong
- A. Inter-chassis clustering VLAN is used for cluster communication, not for Layer 2 switching between user-facing interfaces.
- B. Cisco ISE Security Group Tag is an identity and access control feature, not a Layer 2 switching mechanism.
- C. Interface-based VLAN switching is not a standard Cisco Firepower configuration term for achieving these requirements.
Question 49
The network administrator wants to enhance the network security posture by enabling machine learning for malware detection due to a concern with suspicious Microsoft executable file types that were seen while creating monthly security reports for the CIO. Which feature must be enabled to accomplish this goal?
Show answer and explanation
Correct answer: C. Spero
Spero is Cisco AMP's machine learning detection engine that analyzes files using predictive indicators to identify previously unknown malware variants and polymorphic threats. It uses behavioral analysis and machine learning to detect malicious characteristics in executable files that have not been previously seen.
Why the other options are wrong
- A. Ethos is used for threat profiling and detection of malware families, but Spero is the primary ML engine for unknown malware.
- B. Static analysis examines file structure without execution and does not leverage machine learning for detection.
- D. Dynamic analysis observes file behavior during execution but is not the specific ML feature referenced for unknown malware detection.
Question 50
A network administrator is seeing an unknown verdict for a file detected by Cisco FTD. Which malware policy configuration option must be selected in order to further analyze the file in the Talos cloud?
Show answer and explanation
Correct answer: B. dynamic analysis
Dynamic analysis is the malware policy configuration option that sends files with unknown verdicts to the Talos cloud for further analysis. This leverages Cisco's cloud-based threat intelligence infrastructure to analyze suspicious files and return a definitive verdict.
Why the other options are wrong
- A. Malware analysis is too generic and not the specific configuration option name for cloud-based analysis.
- C. Sandbox analysis typically refers to local sandboxing on the device itself, not cloud-based Talos analysis.
- D. Spero analysis relates to advanced malware protection but is not the correct configuration option for sending files to Talos cloud.
Question 51
An organization has a compliancy requirement to protect servers from clients, however, the clients and servers all reside on the same Layer 3 network. Without readdressing IP subnets for clients or servers, how is segmentation achieved?
Show answer and explanation
Correct answer: D. Deploy a firewall in transparent mode between the clients and servers.
A firewall in transparent mode operates at Layer 2, allowing it to segment traffic between clients and servers on the same Layer 3 subnet without requiring IP readdressing. Transparent mode acts as a bridge while enforcing security policies, making it the ideal solution when Layer 3 readdressing is prohibited but segmentation is required.
Why the other options are wrong
- A. Changing server IP addresses while remaining on the same subnet does not achieve segmentation without additional enforcement mechanisms.
- B. A firewall in routed mode requires separate subnets and would necessitate IP readdressing, which violates the stated requirement.
- C. Changing client IP addresses while remaining on the same subnet does not achieve segmentation without additional enforcement mechanisms.
Question 52
The CIO asks a network administrator to present to management a dashboard that shows custom analysis tables for the top DNS queries URL category statistics, and the URL reputation statistics. Which action must the administrator take to quickly produce this information for management?
Show answer and explanation
Correct answer: B. Create a new dashboard and add three custom analysis widgets that specify the tables needed.
To quickly produce custom analysis tables for top DNS queries, URL category statistics, and URL reputation statistics, the administrator should create a new dashboard and add three custom analysis widgets configured with the specific data tables needed. This is the most direct and flexible approach to meeting the CIO's requirements for management presentation.
Why the other options are wrong
- A. The Attack report is designed for attack-related data and filtering on DNS would not provide the URL category and URL reputation statistics needed.
- C. Modifying the Connection Events dashboard is less efficient than creating a new dedicated dashboard for management's specific needs.
- D. Copying the intrusion events dashboard tab would require extensive modification and the intrusion events data is not aligned with DNS queries and URL statistics requirements.
Question 53
A company has many Cisco FTD devices managed by a Cisco FMC. The security model requires that access control rule logs be collected for analysis. The security engineer is concerned that the Cisco FMC will not be able to process the volume of logging that will be generated. Which configuration addresses concern this?
Show answer and explanation
Correct answer: A. Send Cisco FTD connection events directly to a SIEM system and forward security events from Cisco FMC to the SIEM system for storage and analysis
To address concerns about FMC processing volume, connection events should be sent directly from FTD devices to the SIEM system, while security events from FMC are forwarded separately. This distribution offloads the high-volume connection logging from the FMC, allowing it to handle security event analysis while the SIEM system manages the bulk of connection event storage and analysis.
Why the other options are wrong
- B. Sending all events directly to SIEM bypasses the FMC's analysis capabilities and may not meet the requirement for FMC-based analysis.
- C. A cluster of FMC devices would increase complexity and cost without directly solving the processing volume concern.
- D. Forwarding all logs through FMC before sending to SIEM defeats the purpose of offloading the FMC's processing burden.
Question 54
An organization has implemented Cisco Firepower without IPS capabilities and now wants to enable inspection for their traffic. They need to be able to detect protocol anomalies and utilize the Snort rule sets to detect malicious behavior. How is this accomplished?
Show answer and explanation
Correct answer: B. Modify the access control policy to redirect interesting traffic to the engine.
Modifying the access control policy to redirect interesting traffic to the inspection engine enables IPS functionality on a previously non-IPS deployment. The access control policy determines which traffic flows are sent to the intrusion engine for Snort rule evaluation and protocol anomaly detection.
Why the other options are wrong
- A. Network discovery policy is used for asset discovery and visibility, not for enabling inspection.
- C. Intrusion policy settings control alert severity thresholds but do not enable inspection itself.
- D. Network analysis policy is for advanced analytics and visibility, not for redirecting traffic to the inspection engine.
Question 55
In which two places are thresholding settings configured? (Choose two.)
Show answer and explanation
Correct answer: A, C. on each IPS rule; globally, per intrusion policy
Thresholds are set on individual intrusion rules and globally in each intrusion policy, using the Global Rule Thresholding setting in its Advanced Settings. They are not set in the network analysis policy or on access control rules.
Why the other options are wrong
- B. The network analysis policy configures preprocessors. The global threshold belongs to the intrusion policy.
- D. Access control rules only select the intrusion policy. They have no threshold settings.
- E. Preprocessor settings do not include thresholding.
Question 56
An engineer is attempting to create a new dashboard within the Cisco FMC to have a single view with widgets from many of the other dashboards. The goal is to have a mixture of threat and security related widgets along with Cisco Firepower device health information. Which two widgets must be configured to provide this information? (Choose two.)
Show answer and explanation
Correct answer: A, C. Intrusion Events; Appliance Status
To create a comprehensive dashboard with threat information and device health, you need Intrusion Events (which shows threat-related data from intrusion detection) and Appliance Status (which displays health information about Cisco Firepower devices). These two widgets together provide both security/threat visibility and device infrastructure health monitoring.
Why the other options are wrong
- B. Correlation Information is not a standard FMC dashboard widget for this purpose.
- D. Current Sessions provides network activity data but doesn't address device health or comprehensive threat visibility.
- E. Network Compliance relates to policy adherence rather than threat events or appliance health status.
Question 57
Which policy rule is included in the deployment of a local DMZ during the initial deployment of a Cisco NGFW through the Cisco FMC GUI?
Show answer and explanation
Correct answer: C. no policy rule is included
When deploying a local DMZ on Cisco NGFW through the Cisco FMC GUI during initial deployment, no default policy rule is automatically included. The administrator must explicitly create and configure policy rules for the DMZ traffic. This ensures the administrator has full control over what traffic is permitted or denied, rather than relying on default rules.
Why the other options are wrong
- A. A default DMZ policy is not provided with only IP address customization available.
- B. No deny rule is automatically created for DMZ deployment.
- D. No permit rule is automatically created for DMZ deployment.
Question 58
A network engineer is receiving reports of users randomly getting disconnected from their corporate applications which traverse the data center FTD appliance. Network monitoring tools show that the FTD appliance utilization is peaking above 90% of total capacity. What must be done in order to further analyze this issue?
Show answer and explanation
Correct answer: B. Use the Packet Capture feature to collect real-time network traffic.
Packet Capture is the appropriate feature to collect real-time network traffic data to analyze why users are being disconnected when FTD utilization peaks above 90%. This allows detailed inspection of actual traffic patterns and potential packet loss or corruption occurring during high-load conditions.
Why the other options are wrong
- A. Packet Export is for saving already-captured data to external storage, not for initial traffic collection and analysis.
- C. Packet Tracer simulates traffic flow through policies but does not capture actual real-time network traffic.
- D. Packet Analysis is not a standard FTD feature name; Packet Capture is the correct terminology.
Question 59
A company is in the process of deploying intrusion protection with Cisco FTDs managed by a Cisco FMC. Which action must be selected to enable fewer rules detect only critical conditions and avoid false positives?
Show answer and explanation
Correct answer: B. Balanced Security and Connectivity
To enable fewer rules that detect only critical conditions while avoiding false positives, the 'Balanced Security and Connectivity' option is the correct choice. This setting reduces the number of active rules to focus on critical threats while maintaining acceptable connectivity. 'Connectivity Over Security' prioritizes connectivity over detection, 'Maximum Detection' enables all rules causing false positives, and 'No Rules Active' disables all protection.
Why the other options are wrong
- A. Prioritizes connectivity over security, allowing too many threats through.
- C. Enables maximum rules resulting in excessive false positives.
- D. Disables all intrusion protection rules entirely.
Question 60
An engineer is configuring Cisco FMC and wants to limit the time allowed for processing packets through the interface. However, if the time is exceeded, the configuration must allow packets to bypass detection. What must be configured on the Cisco FMC to accomplish this task?
Show answer and explanation
Correct answer: B. Automatic Application Bypass
Automatic Application Bypass allows traffic to bypass detection if it exceeds the configured processing time limit. This feature ensures that packets are not dropped or delayed indefinitely; instead, they are permitted to pass through if the inspection timeout is exceeded, maintaining network performance while applying detection where possible.
Why the other options are wrong
- A. Cisco ISE Security Group Tag is used for identity-based access control, not for managing inspection timeouts.
- C. Inspect Local Traffic Bypass is for bypassing local traffic inspection, not for managing detection processing time limits.
- D. Fast-Path Rules Bypass is not a standard Cisco FMC feature for managing packet processing time limits.
Question 61
While integrating Cisco Umbrella with Cisco Threat Response, a network security engineer wants to automatically push blocking of domains from the Cisco Threat Response interface to Cisco Umbrella. Which API meets this requirement?
Show answer and explanation
Correct answer: D. enforcement
The enforcement API in Cisco Threat Response is specifically designed to automatically push security actions, including domain blocking, to integrated security tools like Cisco Umbrella. This API enables automated enforcement of threats detected in Threat Response directly to Umbrella's blocking lists without manual intervention.
Why the other options are wrong
- A. The investigate API is used for querying and analyzing threat data, not for pushing enforcement actions to external systems.
- B. REST is a general architectural style; while Umbrella APIs use REST, the specific API that handles enforcement actions is the enforcement API.
- C. The reporting API is used for retrieving reports and analytics data, not for pushing blocking actions to Umbrella.
Question 62
An organization has a Cisco IPS running in inline mode and is inspecting traffic for malicious activity. When traffic is received by the Cisco IPS, if it is not dropped, how does the traffic get to its destination?
Show answer and explanation
Correct answer: A. It is retransmitted from the Cisco IPS inline set
In inline mode, when a Cisco IPS does not drop traffic, it retransmits the packet from the inline interface pair back out to its destination. The IPS acts as a transparent bump-in-the-wire, inspecting bidirectional traffic and forwarding non-malicious packets along their original path.
Why the other options are wrong
- B. Packets are not duplicated; the IPS processes the original packet and forwards it if it passes inspection.
- C. The traffic is not retransmitted only out the outside interface; it follows the inline path through the interface pair.
- D. Inline IPS devices do not route traffic back to ASA interfaces; they operate independently as inspection points.
Question 63
A network administrator is trying to convert from LDAP to LDAPS for VPN user authentication on a Cisco FTD. Which action must be taken on the Cisco FTD objects to accomplish this task?
Show answer and explanation
Correct answer: D. Create a Certificate Enrollment object to get the LDAPS certificate needed.
To convert from LDAP to LDAPS for VPN user authentication on Cisco FTD, a Certificate Enrollment object must be created to obtain and manage the LDAPS certificate required for the secure connection. This enables the FTD to establish encrypted LDAPS sessions for authentication.
Why the other options are wrong
- A. Cipher Suite List objects define encryption algorithms but do not acquire the necessary LDAPS certificate.
- B. Policy List objects define session requirements but are not used to obtain LDAPS certificates.
- C. Key Chain objects are used for routing protocol authentication, not for LDAPS certificate acquisition.
Question 64
A Cisco FTD device is running in transparent firewall mode with a VTEP bridge group member ingress interface. What must be considered by an engineer tasked with specifying a destination MAC address for a packet trace?
Show answer and explanation
Correct answer: C. The destination MAC address is optional if a VLAN ID value is entered.
When configuring a packet trace on a Cisco FTD in transparent mode with a VTEP bridge group member as the ingress interface, the destination MAC address becomes optional if a VLAN ID is specified. The VLAN ID can uniquely identify the traffic flow, making the MAC address specification unnecessary in that case.
Why the other options are wrong
- A. Output format options for packet logs remain available regardless of the interface type.
- B. Multiple packet types are supported in packet trace functionality, not just UDP.
- D. While VLAN ID is optional, the destination MAC address is not optional in all cases, it becomes optional only when VLAN ID is provided.
Question 65
What is an advantage of adding multiple inline interface pairs to the same inline interface set when deploying an asynchronous routing configuration?
Show answer and explanation
Correct answer: A. Allows the IPS to identify inbound and outbound traffic as part of the same traffic flow.
When multiple inline interface pairs are added to the same inline interface set in asynchronous routing configuration, it enables the IPS to correlate traffic across different interface pairs and identify inbound and outbound traffic as part of the same traffic flow. This allows for more accurate bidirectional inspection and threat detection across the multiple interface pairs.
Why the other options are wrong
- B. Autonegotiation settings and speed configuration are independent of inline interface set membership and do not relate to multiple pairs.
- C. Snort process restart behavior is not affected by the number of inline interface pairs in the same set.
- D. MDIX (media-independent interface crossover) configuration is a physical layer setting unrelated to inline interface set membership.
Question 66
Which two routing options are valid with Cisco FTD? (Choose two.)
Show answer and explanation
Correct answer: A, B. BGPv6; ECMP with up to three equal cost paths across multiple interfaces
Cisco FTD supports BGPv4 (and its extension BGPv6) as dynamic routing protocols, and ECMP (Equal-Cost Multi-Path) with up to three equal-cost paths across multiple interfaces for load balancing. BGPv4 works in routed mode, and ECMP distributes traffic across multiple equal-cost paths on different interfaces.
Why the other options are wrong
- C. ECMP with paths across a single interface is not a valid configuration; ECMP requires multiple interfaces to function.
- D. BGP is not supported in transparent firewall mode; it requires routed mode operation.
- E. Nonstop forwarding is not a supported BGP feature in Cisco FTD; graceful restart may be available but not this specific variant.
Question 67
An engineer runs the command restore remote-manager-backup location 2.2.2.2 admin/Volume/home/admin FTD411247145.zip on a Cisco FMC. After connecting to the repository, the Cisco FTD device is unable to accept the backup file. What is the reason for this failure?
Show answer and explanation
Correct answer: D. The backup file extension was changed from .tar to .zip.
The command attempts to restore a backup file with a .zip extension, but Cisco FTD requires backup files to be in .tar format for restoration. The backup file extension was incorrectly changed from .tar to .zip, causing the FTD device to reject the file during the restore process.
Why the other options are wrong
- A. If the IP address 2.2.2.2 were wrong, the command would fail at the connection stage, not after successfully connecting to the repository.
- B. The directory path admin/Volume/home/admin is specified in the command; if incorrect, it would fail before attempting file acceptance.
- C. The file format issue is the file extension (.zip vs .tar), not the internal format, as FTD requires tar archives for restoration.
Question 68
An engineer is investigating connectivity problems on Cisco Firepower that is using service group tags. Specific devices are not being tagged correctly, which is preventing clients from using the proper policies when going through the firewall. How is this issue resolved?
Show answer and explanation
Correct answer: C. Use a packet capture with match criteria
A packet capture with match criteria allows filtering to specific devices and traffic patterns, enabling the engineer to verify whether service group tags are being applied correctly to the appropriate traffic. This targeted capture reveals tagging issues at the packet level without excessive noise.
Why the other options are wrong
- A. Traceroute is a routing tool that shows path to destinations, not device tagging or policy application verification.
- B. Wireshark with IP subnet filters shows traffic but doesn't specifically diagnose service group tag assignment issues.
- D. A generic packet sniffer without specific match criteria produces too much data to effectively diagnose tagging problems.
Question 69
Which Firepower feature allows users to configure bridges in routed mode and enables devices to perform Layer 2 switching between interfaces?
Show answer and explanation
Correct answer: D. IRB
IRB (Integrated Routing and Bridging) is the Firepower feature that allows configuration of bridges in routed mode, enabling devices to perform Layer 2 switching between interfaces while maintaining routing capabilities.
Why the other options are wrong
- A. FlexConfig is used for custom configurations and advanced policy settings, not specifically for bridging in routed mode.
- B. BDI (Bridge Domain Interface) is a concept in some platforms but is not the Firepower-specific feature for this functionality.
- C. SGT (Security Group Tag) is used for identity and access control, not for Layer 2 switching configuration.
Question 70
The administrator notices that there is malware present with an .exe extension and needs to verify if any of the systems on the network are running the executable file. What must be configured within Cisco AMP for Endpoints to show this data?
Show answer and explanation
Correct answer: D. prevalence
Prevalence is the Cisco AMP feature that shows how widespread a file is across the customer base and the global threat intelligence network. This feature enables administrators to see if a suspicious .exe file is running on systems within their network by checking its prevalence data, whether it's seen on many systems, few systems, or is unique. This helps determine if the file is genuinely malicious or a legitimate but uncommon application.
Why the other options are wrong
- A. Vulnerable software detection identifies known vulnerable applications, not whether specific executables are running on systems.
- B. File analysis examines file properties and behavior but does not specifically show the distribution of running executables across the network.
- C. Threat root cause analysis investigates the origin and spread of threats, not whether a specific executable is currently running on systems.
Question 71
There is an increased amount of traffic on the network and for compliance reasons, management needs visibility into the encrypted traffic. What is a result of enabling TLS/SSL decryption to allow this visibility?
Show answer and explanation
Correct answer: A. It prompts the need for a corporate managed certificate.
Enabling TLS/SSL decryption requires a corporate-managed certificate to perform the man-in-the-middle decryption of encrypted traffic. The Firepower device must present a certificate to clients, which necessitates having a properly managed certificate infrastructure in place.
Why the other options are wrong
- B. Certificate pinning, when enforced by applications, can actually block decryption, but its absence doesn't cause decryption to fail.
- C. TLS/SSL decryption has significant performance impact due to the CPU-intensive cryptographic operations required.
- D. TLS/SSL decryption is absolutely subject to privacy regulations like GDPR, CCPA, and others, and requires proper policy and consent.
Question 72
IT management is asking the network engineer to provide high-level summary statistics of the Cisco FTD appliance in the network. The business is approaching a peak season so the need to maintain business uptime is high. Which report type should be used to gather this information?
Show answer and explanation
Correct answer: C. Standard Report
A Standard Report provides high-level summary statistics and performance metrics of Cisco FTD appliances, making it the appropriate choice for management-level summaries needed during peak business seasons when uptime monitoring is critical.
Why the other options are wrong
- A. Risk Report focuses on security risks and vulnerabilities, not general appliance statistics.
- B. SNMP Report is for SNMP-specific data collection, not general summary statistics.
- D. Malware Report focuses specifically on malware detections, not overall appliance performance summary.
Question 73
An engineer is troubleshooting application failures through an FTD deployment. While using the FMC CLI, it has been determined that the traffic in question is not matching the desired policy. What should be done to correct this?
Show answer and explanation
Correct answer: C. Use the system support application-identification-debug command to determine which rules the traffic matching and modify the rule accordingly.
The `system support application-identification-debug` command is used to determine which rules traffic is matching by enabling application identification debugging. This allows engineers to see how the system identifies applications and which rules are being applied, enabling them to modify rules accordingly to ensure proper application flow through the firewall.
Why the other options are wrong
- A. The firewall-engine-debug command is not the appropriate tool for determining application-specific rule matching.
- B. The firewall-engine-dump-user-identity-data command is for user identity troubleshooting, not policy rule matching.
- D. The network-options command is for network configuration, not for debugging application policy matching.
Question 74
A network engineer is configuring URL Filtering on Cisco FTD. Which two port requirements on the FMC must be validated to allow communication with the cloud service? (Choose two.)
Show answer and explanation
Correct answer: A, E. outbound port TCP/443; outbound port TCP/80
URL Filtering on Cisco FTD requires outbound TCP/443 (HTTPS) for secure encrypted communication with the cloud service and outbound TCP/80 (HTTP) for general cloud connectivity and updates.
Why the other options are wrong
- B. inbound port TCP/80 is not required; FTD initiates outbound connections to cloud services
- C. outbound TCP/8080 is not a standard port requirement for Cisco URL Filtering cloud communication
- D. inbound TCP/443 is not needed; the FTD device makes outbound connections to the cloud service
Question 75
Which CLI command is used to control special handling of ClientHello messages?
Show answer and explanation
Correct answer: A. system support ssl-client-hello-tuning
The system support ssl-client-hello-tuning command controls special handling and tuning of ClientHello messages in Cisco FTD/FMC systems, allowing administrators to adjust how SSL/TLS client hellos are processed.
Why the other options are wrong
- B. ssl-client-hello-display is not a valid command for controlling ClientHello message handling
- C. ssl-client-hello-force-reset is not the correct syntax for ClientHello tuning
- D. ssl-client-hello-reset does not provide the tuning control functionality needed for special ClientHello handling
Question 76
A network administrator is configuring a Cisco AMP public cloud instance and wants to capture infections and polymorphic variants of a threat to help detect families of malware. Which detection engine meets this requirement?
Show answer and explanation
Correct answer: A. Ethos
Ethos is Cisco AMP's detection engine specifically designed to identify and capture polymorphic variants and malware families. It uses threat profiling and heuristic analysis to recognize families of malware based on common characteristics and behavioral patterns, enabling detection of variants that may not have been previously encountered.
Why the other options are wrong
- B. Tetra is not a standard Cisco AMP detection engine.
- C. RBAC (Role-Based Access Control) is an access control mechanism, not a malware detection engine.
- D. Spero focuses on unknown malware detection through machine learning but Ethos is better suited for polymorphic variant and family detection.
Question 77
Which Cisco Firepower feature is used to reduce the number of events received in a period of time?
Show answer and explanation
Correct answer: D. thresholding
Thresholding is the Cisco Firepower feature used to reduce the number of events received in a period of time by setting minimum thresholds for event generation, preventing alert fatigue from repetitive low-level events.
Why the other options are wrong
- A. Rate-limiting is a network traffic control mechanism, not an event reduction feature in Firepower.
- B. Suspending is not a standard Firepower feature for managing event volume.
- C. Correlation combines related events but does not specifically reduce the total number of events received.
Question 78
An administrator is working on a migration from Cisco ASA to the Cisco FTD appliance and needs to test the rules without disrupting the traffic. Which policy type should be used to configure the ASA rules during this phase of the migration?
Show answer and explanation
Correct answer: C. Access Control
Access Control policies are used during ASA-to-FTD migration to test rules in a non-disruptive manner. Access Control policies can be set to alert or log-only modes, allowing administrators to validate that converted ASA rules function correctly on FTD without actually blocking traffic during the transition phase.
Why the other options are wrong
- A. Prefilter policies are for early-stage traffic filtering and DoS protection, not for testing migrated access control rules.
- B. Intrusion policies focus on detecting malicious activity and are not the appropriate mechanism for testing basic firewall rules.
- D. Identity policies manage user and device identification, not firewall rule conversion or testing.
Question 79
When creating a report template, how are the results limited to show only the activity of a specific subnet?
Show answer and explanation
Correct answer: B. Add an Input Parameter in the Advanced Settings of the report, and set the type to Network/IP.
Input Parameters in Advanced Settings allow report creators to define dynamic filters. Setting the type to Network/IP creates a parameter that accepts subnet/IP input, which is then applied throughout the report to limit results to that specific subnet. This approach is more flexible and reusable than hardcoding a search or using table views.
Why the other options are wrong
- A. Custom searches are applied to individual sections but don't provide a parameterized way to filter by subnet across the entire report template.
- C. Table View sections display data but defining a search field in CIDR format doesn't create a dynamic parameter for limiting subnet activity across all report sections.
- D. Using IP Address as the X-Axis is for chart visualization and doesn't filter results to a specific subnet.
Question 80
Which command is typed at the CLI on the primary Cisco FTD unit to temporarily stop running high-availability?
Show answer and explanation
Correct answer: D. configure high-availability suspend
The configure high-availability suspend command temporarily stops running high-availability on the primary Cisco FTD unit without permanently disabling the HA configuration, allowing it to be resumed later.
Why the other options are wrong
- A. configure high-availability resume is used to restart HA, not to stop it
- B. configure high-availability disable permanently disables HA rather than temporarily stopping it
- C. system support network-options does not control high-availability operations
Question 81
Which two features of Cisco AMP for Endpoints allow for an uploaded file to be blocked? (Choose two.)
Show answer and explanation
Correct answer: A, B. application blocking; simple custom detection
Application blocking and simple custom detection are both features that allow Cisco AMP for Endpoints to block uploaded files. Application blocking can prevent execution of malicious applications, while simple custom detection enables administrators to create custom detections based on file characteristics or hashes to identify and block specific files.
Why the other options are wrong
- C. File repository is a storage feature for captured files, not a blocking mechanism.
- D. Exclusions are used to bypass inspection for trusted files, the opposite of blocking.
- E. Application allow listing creates a whitelist of permitted applications, allowing rather than blocking files.
Question 82
Which two packet captures does the FTD LINA engine support? (Choose two.)
Show answer and explanation
Correct answer: C, E. application ID; protocol
The FTD LINA engine supports packet captures filtered by application ID and protocol. These two capture types allow engineers to isolate traffic based on identified applications and the underlying transport protocols used. This granular capture capability is essential for detailed troubleshooting and analysis of specific application behaviors.
Why the other options are wrong
- A. Layer 7 network ID is not a supported packet capture filter in the LINA engine.
- B. Source IP filtering is not listed as a supported packet capture type for LINA.
- D. Dynamic firewall importing is not a packet capture capability of the LINA engine.
Question 83
A connectivity issue is occurring between a client and a server which are communicating through a Cisco Firepower device. While troubleshooting, a network administrator sees that traffic is reaching the server, but the client is not getting a response. Which step must be taken to resolve this issue without initiating traffic from the client?
Show answer and explanation
Correct answer: D. Use packet-tracer to validate that the packet passes through the firewall and is NATed to the corrected IP address
Packet-tracer is the correct tool for simulating traffic through a Cisco Firepower device without actually sending real traffic from the client. It validates that packets pass through the firewall and confirms NAT translations are applied correctly, which is essential when traffic reaches the server but responses don't return to the client, a classic symptom of NAT or asymmetric routing issues.
Why the other options are wrong
- A. Packet-tracer is not used to check access lists; it traces traffic flow through policies and NAT.
- B. Packet capture requires actual traffic initiation and doesn't simulate traffic paths without real packets.
- C. Packet capture requires real traffic to be initiated, whereas the requirement is to troubleshoot without initiating client traffic.
Question 84
When is the file-size command needed while troubleshooting with packet capture?
Show answer and explanation
Correct answer: D. when capture packets exceed 32 MB
The file-size command is needed during packet capture troubleshooting when captured packets exceed 32 MB, as this limit requires explicit configuration to allow larger capture files.
Why the other options are wrong
- A. packets less than 16 MB do not require file-size command configuration
- B. capture packets being restricted from secondary memory is not the criterion for file-size command usage
- C. the file-size command is needed at 32 MB threshold, not at the 10 GB level
Question 85
An organization has noticed that malware was downloaded from a website that does not currently have a known bad reputation. How will this issue be addressed globally in the quickest way possible and with the least amount of impact?
Show answer and explanation
Correct answer: B. Cisco Talos will automatically update the policies.
Cisco Talos is the threat intelligence engine that automatically updates threat data across Cisco security products, including URL reputation databases. This provides the quickest global response to newly identified malicious websites without manual intervention or broad access restrictions. Talos automatically feeds reputation updates to FMC policies, making this the fastest and least impactful solution.
Why the other options are wrong
- A. Creating URL objects requires manual configuration and only affects the specific organization, not a global solution.
- C. Denying all outbound web access is too broad and causes significant business impact.
- D. Isolating the endpoint is reactive containment rather than a proactive global prevention measure.
Question 86
A VPN user is unable to connect to web resources behind the Cisco FTD device terminating the connection. While troubleshooting, the network administrator determines that the DNS response are not getting through the Cisco FTD. What must be done to address this issue while still utilizing Snort IPS rules?
Show answer and explanation
Correct answer: B. Modify the Snort rules to allow legitimate DNS traffic to the VPN users
DNS responses are being blocked by Snort IPS rules. To resolve this while maintaining IPS protection, the administrator must modify the Snort rules to explicitly allow legitimate DNS traffic destined for VPN users. This preserves intrusion detection capabilities while unblocking necessary DNS responses.
Why the other options are wrong
- A. Unchecking 'Drop when Inline' would disable the inline protection mechanism entirely, not selectively allow DNS.
- C. Disabling threshold settings would degrade IPS performance and detection sensitivity, not solve the DNS blocking issue.
- D. Decrypting packets after VPN termination bypasses inspection and compromises security monitoring of VPN traffic.
Question 87
An engineer is monitoring network traffic from their sales and product development departments, which are on two separate networks. What must be configured in order to maintain data privacy for both departments?
Show answer and explanation
Correct answer: B. Use a dedicated IPS inline set for each department to maintain traffic separation.
Using a dedicated IPS inline set for each department maintains complete traffic separation and logical isolation, ensuring that sales and product development department data cannot cross-contaminate or be accidentally inspected by the wrong monitoring system. This provides the strongest privacy guarantee for sensitive departmental data.
Why the other options are wrong
- A. Passive IDS ports do not maintain separation for data privacy; they only observe traffic.
- C. While 802.1Q trunks with VLANs provide logical separation, they do not guarantee the same level of physical/logical enforcement as dedicated inline sets.
- D. Using a single inline set in TAP mode for both departments would mix traffic and compromise data privacy separation.
Question 88
A network administrator notices that remote access VPN users are not reachable from inside the network. It is determined that routing is configured correctly; however, return traffic is entering the firewall but not leaving it. What is the reason for this issue?
Show answer and explanation
Correct answer: A. A manual NAT exemption rule does not exist at the top of the NAT table
Return traffic from remote VPN users entering the firewall but not leaving indicates that the traffic is being incorrectly translated by NAT rules. A manual NAT exemption rule placed at the top of the NAT table ensures VPN return traffic is excluded from NAT translation, allowing it to exit properly. Without this exemption, the return traffic gets translated incorrectly and is blocked.
Why the other options are wrong
- B. An external NAT IP address is typically already configured for the firewall interface.
- C. Configuring the external NAT IP to the wrong interface would prevent outbound translation, not specifically block return VPN traffic.
- D. Object NAT exemptions and manual NAT exemptions serve the same purpose in this context; the issue requires a manual NAT rule at the top of the table.
Question 89
An engineer is troubleshooting a file that is being blocked by a Cisco FTD device on the network. The user is reporting that the file is not malicious. Which action does the engineer take to identify the file and validate whether or not it is malicious?
Show answer and explanation
Correct answer: A. Identify the file in the intrusion events and submit it to Threat Grid for analysis.
The correct approach is to identify the file in the intrusion events log on FTD and submit it to Threat Grid for analysis. Threat Grid provides comprehensive file analysis including behavioral analysis, static analysis, and threat disposition determination. This allows the engineer to validate whether the file is genuinely malicious or a false positive without manually handling potentially dangerous files.
Why the other options are wrong
- B. FMC file analysis is limited compared to Threat Grid's comprehensive analysis capabilities.
- C. Downloading suspicious files to a local machine is unsafe and not a proper incident response procedure.
- D. Sending to AMP for Endpoints via context menu is not a standard workflow for validating file disposition from FTD blocks; Threat Grid is the proper analysis platform.
Question 90
Which group within Cisco does the Threat Response team use for threat analysis and research?
Show answer and explanation
Correct answer: D. Cisco Talos
Cisco Talos is the group within Cisco that the Threat Response team uses for threat analysis and research. Talos is Cisco's renowned threat intelligence organization that provides security research and analysis across multiple security domains.
Why the other options are wrong
- A. Cisco Deep Analytics is not the primary threat research group used by Threat Response.
- B. OpenDNS Group, while related to Cisco security, is not the group used for threat analysis and research.
- C. Cisco Network Response is not the established threat intelligence group for analysis and research.
Question 91
An administrator must use Cisco FMC to install a backup route within the Cisco FTD to route traffic in case of a routing failure with primary route. Which action accomplish this task?
Show answer and explanation
Correct answer: D. Create the backup route and use route tracking on both routes to a destination IP address in the network
Route tracking monitors the health of both primary and backup routes to a destination and automatically fails over when the primary route becomes unavailable. By creating both routes with tracking enabled, the FTD can detect routing failures and seamlessly switch to the backup route without manual intervention. This is the proper method for automatic failover in Cisco FTD routing configuration.
Why the other options are wrong
- A. Modifying metrics would affect route preference but doesn't provide dynamic failover capability or monitoring of route health.
- B. Using only a default route eliminates the ability to use a specific backup route and reduces network efficiency.
- C. EIGRP on the FMC itself is not the solution; routing must be configured on the FTD, and EIGRP alone doesn't provide the tracking mechanism needed.
Question 92
An engineer integrates Cisco FMC and Cisco ISE using pxGrid. Which role is assigned for Cisco FMC?
Show answer and explanation
Correct answer: D. client
In a pxGrid integration between Cisco FMC and Cisco ISE, FMC assumes the role of a client. The pxGrid framework defines roles as publisher (shares data) and subscriber/client (receives data). FMC connects to ISE to consume context and policy information about endpoints and threats, making it a client in this relationship. ISE typically acts as a publisher of endpoint context and posture information.
Why the other options are wrong
- A. Server is not a standard pxGrid role; pxGrid uses publisher/subscriber or client architecture.
- B. Controller is not a pxGrid role designation; FMC is managed separately from pxGrid role assignments.
- C. Publisher is the role ISE assumes when sharing endpoint data; FMC consumes this data as a client.
Question 93
With a recent summer time change, system logs are showing activity that occurred to be an hour behind real time. Which action should be taken to resolve this issue?
Show answer and explanation
Correct answer: C. Configure the system clock settings to use NTP.
Configuring the system clock to use NTP (Network Time Protocol) automatically handles time synchronization across all managed devices and will correct the one-hour discrepancy caused by the summer time change without requiring manual adjustment.
Why the other options are wrong
- A. Manual adjustment on all devices is not scalable and does not address the root cause of time drift.
- B. Daylight Savings should not be manually 'checked' in NTP configuration; NTP handles time zones automatically.
- D. Adjusting only the FMC does not synchronize all managed devices in the network.
Question 94
A mid-sized company is experiencing higher network bandwidth utilization due to a recent acquisition. The network operations team is asked to scale up their one Cisco FTD appliance deployment to higher capacities due to the increased network bandwidth. Which design option should be used to accomplish this goal?
Show answer and explanation
Correct answer: B. Deploy multiple Cisco FTD appliances in firewall clustering mode to increase performance.
Firewall clustering mode in FTD allows multiple appliances to work together to increase throughput and performance capacity. This design distributes traffic across multiple FTD units, enabling the organization to scale performance to handle increased bandwidth from the acquisition.
Why the other options are wrong
- A. HA pairs are for redundancy, not performance scaling; clustering alone provides performance benefits.
- C. VPN load-balancing is used for VPN connections specifically, not general bandwidth capacity scaling.
- D. HA pairs provide failover but do not increase aggregate performance capacity.
Question 95
Within Cisco Firepower Management Center, where does a user add or modify widgets?
Show answer and explanation
Correct answer: A. dashboard
Within Cisco Firepower Management Center, users add or modify widgets on the dashboard, which is the main interface for viewing and customizing monitoring information and analytics.
Why the other options are wrong
- B. reporting is a separate section for generating reports, not for adding widgets
- C. context explorer is used for threat investigation and analysis, not widget management
- D. summary tool is not a standard FMC interface for widget configuration
Question 96
A network administrator is troubleshooting access to a website hosted behind a Cisco FTD device. External clients cannot access the web server via HTTPS. The IP address configured on the web server is 192.168.7.46. The administrator is running the command capture CAP interface outside match ip any 192.168.7.46 255.255.255.255 but cannot see any traffic in the capture. Why is this occurring?
Show answer and explanation
Correct answer: A. The capture must use the public IP address of the web server.
The packet capture is not seeing traffic because the command is filtering on the internal IP address (192.168.7.46) on the outside interface. External clients access the web server using its public IP address (after NAT translation), so the capture must filter on the public IP to see inbound HTTPS traffic. Internal addresses are not visible on external interfaces.
Why the other options are wrong
- B. Packet captures show all traffic, not only blocked traffic.
- C. If there were no route, the issue would manifest differently; the capture filter is the actual problem.
- D. Access policy blocking would occur, but the primary issue is the incorrect filter using internal IP on the outside interface.
Question 97
After deploying a network-monitoring tool to manage and monitor networking devices in your organization, you realize that you need to manually upload an MIB for the Cisco FMC. In which folder should you upload the MIB file?
Show answer and explanation
Correct answer: C. /etc/sf/DCEALERT.MIB
MIB files for Cisco FMC must be uploaded to the /etc/sf/DCEALERT.MIB directory. This is the standard location where the FMC looks for custom and additional MIB files to use for SNMP trap processing and device monitoring. The other paths either have incorrect directory structures or file naming conventions.
Why the other options are wrong
- A. The path /etc/sf/DCMIB.ALERT has incorrect file naming and is not the standard MIB directory.
- B. The path /sf/etc/DCEALERT.MIB has the directory structure reversed from the correct location.
- D. The path system/etc/DCEALERT.MIB does not represent a valid FMC directory structure for MIB files.
Question 98
A Cisco FTD has two physical interfaces assigned to a BVI. Each interface is connected to a different VLAN on the same switch. Which firewall mode is the Cisco FTD set up to support?
Show answer and explanation
Correct answer: C. transparent
When a Cisco FTD has two physical interfaces assigned to a Bridge Virtual Interface (BVI) with each interface connected to different VLANs on the same switch, the device is operating in transparent mode. Transparent mode operates as a Layer 2 bridge, allowing traffic between VLANs while applying security policies, without requiring traditional routed mode configuration.
Why the other options are wrong
- A. High availability clustering is a deployment model for redundancy, not a firewall mode determined by BVI configuration.
- B. Active/active failover is a redundancy strategy, not the firewall mode indicated by BVI bridge configuration.
- D. Routed mode uses traditional IP routing with separate interfaces per subnet, not BVI bridging across VLANs.
Question 99
A network security engineer must replace a faulty Cisco FTD device in a high availability pair. Which action must be taken while replacing the faulty unit?
Show answer and explanation
Correct answer: D. Unregister the faulty Cisco FTD device from the Cisco FMC
When replacing a faulty Cisco FTD device in a high availability pair, the faulty device must be unregistered from Cisco FMC before powering up the replacement unit. This prevents management conflicts, ensures clean registration of the new device, and allows FMC to properly manage the new unit without ghost registrations from the failed device.
Why the other options are wrong
- A. Leaving the faulty device registered would create management conflicts and prevent proper registration of the replacement.
- B. Shutting down the active device is not necessary; unregistering the faulty device handles the transition.
- C. There is no requirement to shut down the FMC during device replacement; only FTD device management is affected.
Question 100
Which connector is used to integrate Cisco ISE with Cisco FMC for Rapid Threat Containment?
Show answer and explanation
Correct answer: A. pxGrid
pxGrid (Platform Exchange Grid) is Cisco's standard connector technology that enables real-time information sharing between ISE and FMC for rapid threat containment. It allows these platforms to exchange context and coordinate responses to security threats. FTD RTC, FMC RTC, and ISEGrid are not standard Cisco integration connectors for this purpose.
Why the other options are wrong
- B. FTD RTC is not a recognized connector for ISE-FMC integration.
- C. FMC RTC is not a standard Cisco connector technology.
- D. ISEGrid is not a valid Cisco connector name; the correct term is pxGrid.
Question 101
A network engineer implements a new Cisco Firepower device on the network to take advantage of its intrusion detection functionality. There is a requirement to analyze the traffic going across the device, alert on any malicious traffic, and appear as a bump in the wire. How should this be implemented?
Show answer and explanation
Correct answer: D. Configure a bridge group in transparent mode
Configuring a bridge group in transparent mode is the correct implementation. Transparent mode makes the firewall act as a 'bump in the wire' by operating at Layer 2 without appearing as a routing hop. The bridge group allows traffic to pass through the device while it analyzes, alerts on malicious traffic via IDS functionality, and remains transparent to the network topology.
Why the other options are wrong
- A. Specifying a BVI IP address is used in routed mode, which would make the firewall visible as a router rather than functioning as a transparent bump in the wire.
- B. Enabling routing converts the firewall to routed mode, which makes it a visible routing hop rather than transparent.
- C. Adding IP addresses to physical interfaces indicates routed mode operation, making the firewall visible in the network rather than transparent.
Question 102
A company is in the process of deploying intrusion prevention with Cisco FTDs managed by a Cisco FMC. An engineer must configure policies to detect potential intrusions but not block the suspicious traffic. Which action accomplishes this task?
Show answer and explanation
Correct answer: B. Configure IPS mode when creating or editing a policy rule under the Cisco FMC Intrusion tab in Access Policies section by unchecking the “Drop when inline” option.
To detect intrusions without blocking traffic, the firewall must operate in IDS (Intrusion Detection System) mode rather than IPS mode. In the FMC Intrusion policy configuration, unchecking the 'Drop when inline' option ensures that suspicious traffic is detected and logged but not blocked, which is the definition of IDS operation.
Why the other options are wrong
- A. Checking 'Drop when inline' enables blocking, which contradicts the requirement to only detect without blocking.
- C. While this mentions IDS mode correctly, checking 'Drop when inline' would block traffic, defeating the purpose.
- D. Although unchecking 'Drop when inline' is correct, the question specifies IDS mode should be used, not IPS mode.
Question 103
What is a valid Cisco AMP file disposition?
Show answer and explanation
Correct answer: B. malware
Malware is a valid Cisco AMP file disposition that indicates a file has been identified as malicious. AMP disposition classifications include clean, malware, unknown, and other specific categories used to categorize files based on threat analysis.
Why the other options are wrong
- A. Non-malicious is not a standard AMP disposition; the standard designation is clean.
- C. Known-good is not a standard AMP disposition classification.
- D. Pristine is not a valid AMP file disposition term.
Question 104
An administrator is adding a QoS policy to a Cisco FTD deployment. When a new rule is added to the policy and QoS is applied on “Interfaces in Destination Interface Objects”, no interface objects are available. What is the problem?
Show answer and explanation
Correct answer: D. QoS is available only on routed interfaces, and this device is in transparent mode.
QoS in Cisco FTD is only supported on routed interfaces. In transparent mode, the FTD does not have routed interfaces because it operates as a bridge between two networks. Since transparent mode uses bridged interfaces rather than routed interfaces, QoS policies cannot be applied, and no destination interface objects are available for QoS configuration.
Why the other options are wrong
- A. Resource limitations would prevent QoS from being added, but the issue described specifically relates to interface availability, not device resources.
- B. IP address space contiguity is not a prerequisite for QoS configuration or interface object availability.
- C. Interface type conflicts would not result in zero available interfaces; some interfaces would still be selectable even with conflicts.
Question 105
A network administrator needs to create a policy on Cisco Firepower to fast-path traffic to avoid Layer 7 inspection. The rate at which traffic is inspected must be optimized. What must be done to achieve this goal?
Show answer and explanation
Correct answer: B. Configure a prefilter policy
A prefilter policy in Cisco Firepower allows administrators to fast-path traffic and bypass Layer 7 inspection for specific flows, optimizing inspection rates by reducing unnecessary deep packet inspection. Prefilter policies are applied before the standard access control policy and can significantly improve performance by identifying and bypassing traffic that does not require full inspection.
Why the other options are wrong
- A. FXOS multi-instance is used for resource isolation and multi-tenancy, not for fast-pathing or optimizing Layer 7 inspection rates.
- C. Modular policy framework organizes policies hierarchically but does not specifically fast-path traffic or bypass Layer 7 inspection.
- D. Disabling TCP inspection would degrade security posture and is not a recommended approach for optimization.
Question 106
A network administrator configured a NAT policy that translates a public IP address to an internal web server IP address. An access policy has also been created that allows any source to reach the public IP address on port 80. The web server is still not reachable from the Internet on port 80. Which configuration change is needed?
Show answer and explanation
Correct answer: B. The access policy must allow traffic to the internal web server IP address.
The access policy rules are checked against the destination IP address after NAT translation occurs. Since the NAT policy translates the public IP to the internal web server IP, the access policy must allow traffic to the internal (translated) IP address, not the public IP address. The access policy is evaluating the post-NAT traffic, so it must match the internal IP.
Why the other options are wrong
- A. The source IP address translation is not needed for inbound traffic; only the destination needs to be translated.
- C. Disabling the intrusion policy is a security bypass and not the correct solution for a NAT/access policy misconfiguration.
- D. The trust action is not appropriate for web server access; allow is the correct action, and the issue is the destination IP specified in the rule.
Question 107
An administrator is adding a new URL-based category feed to the Cisco FMC for use within the policies. The intelligence source does not use STIX, but instead uses a .txt file format. Which action ensures that regular updates are provided?
Show answer and explanation
Correct answer: A. Add a URL source and select the flat file type within Cisco FMC.
Cisco FMC supports adding custom URL sources in flat file format (.txt), which allows the administrator to configure automatic updates from the feed source. This is the standard method for integrating non-STIX intelligence feeds that use simple text file formats with scheduled updates.
Why the other options are wrong
- B. TAXII is a specific protocol for structured data sharing; a .txt flat file is not a TAXII feed.
- C. Uploading a static .txt file manually does not enable automatic updates; it must be configured as a URL source.
- D. Converting the file to STIX format is unnecessary when FMC supports flat file format directly.
Question 108
Which protocol is needed to exchange threat details in rapid threat containment on Cisco FMC?
Show answer and explanation
Correct answer: D. pxGrid
pxGrid (Platform Exchange Grid) is Cisco's platform for secure real-time exchange of threat details and context between Cisco security products including FMC, ISE, and AMP. It enables rapid threat containment by allowing these products to share indicators of compromise and threat intelligence in real-time.
Why the other options are wrong
- A. SGT (Security Group Tag) is used for group-based access control in ISE, not for threat detail exchange.
- B. SNMP v3 is a network management protocol, not designed for threat intelligence exchange.
- C. BFD (Bidirectional Forwarding Detection) is a network protocol for detecting link failures, unrelated to threat containment.
Question 109
An organization is configuring a new Cisco Firepower High Availability deployment. Which action must be taken to ensure that failover is as seamless as possible to end users?
Show answer and explanation
Correct answer: D. Use a dedicated stateful link between chassis.
A dedicated stateful link between chassis is essential for seamless failover in Cisco Firepower High Availability deployments. This link synchronizes connection state information between the active and standby units, enabling stateful failover where existing connections are maintained without interruption when failover occurs.
Why the other options are wrong
- A. Setting the same FQDN on both chassis would cause conflicts rather than enabling failover.
- B. Virtual failover MAC addresses are helpful but not as critical as the dedicated stateful link for seamless failover.
- C. While matching software versions is best practice, it is not the primary action that ensures seamless failover; the stateful link is.
That was 109 of 435.
The full Cisco 300-710 SNCF pack has all 435 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 217 free as one PDF by email. Get the Half Pack →