Cisco CCNP Security 300-710 Questions & Answers

• Question 91:

  An engineer defines a new rule while configuring an Access Control Policy. After deploying the policy, the rule is not working as expected and the hit counters associated with the rule are showing zero. What is causing this error?

  A. Logging is not enabled for the rule.

  B. The rule was not enabled after being created.

  C. The wrong source interface for Snort was selected in the rule.

  D. An incorrect application signature was used in the rule.

  Correct Answer: D

• Question 92:

  An administrator needs to configure Cisco FMC to send a notification email when a data transfer larger than 10 MB is initiated from an internal host outside of standard business hours. Which Cisco FMC feature must be configured to accomplish this task?

  A. file and malware policy

  B. application detector

  C. intrusion policy

  D. correlation policy

  Correct Answer: D

• Question 93:

  When a Cisco FTD device is configured in transparent firewall mode, on which two interface types can an IP address be configured? (Choose two.)

  A. Diagnostic

  B. EtherChannel

  C. BVI

  D. Physical

  E. Subinterface

  Correct Answer: AC

• Question 94:

  An organization is installing a new Cisco FTD appliance in the network. An engineer is tasked with configuring access between two network segments within the same IP subnet. Which step is needed to accomplish this task?

  A. Assign an IP address to the Bridge Virtual Interface.

  B. Permit BPDU packets to prevent loops.

  C. Specify a name for the bridge group.

  D. Add a separate bridge group for each segment.

  Correct Answer: A

• Question 95:

  An engineer is configuring two new Cisco FTD devices to replace the existing high availability firewall pair in a highly secure environment. The information exchanged between the FTD devices over the failover link must be encrypted. Which protocol supports this on the Cisco FTD?

  A. IPsec

  B. SSH

  C. SSL

  D. MACsec

  Correct Answer: A

• Question 96:

  A security engineer needs to configure a network discovery policy on a Cisco FMC appliance and prevent excessive network discovery events from overloading the FMC database. Which action must be taken to accomplish this task?

  A. Change the network discovery method to TCP/SYN.

  B. Configure NetFlow exporters for monitored networks.

  C. Monitor only the default IPv4 and IPv6 network ranges.

  D. Exclude load balancers and NAT devices in the policy.

  Correct Answer: D

• Question 97:

  A security engineer is adding three Cisco FTD devices to a Cisco FMC. Two of the devices have successfully registered to the Cisco FMC. The device that is unable to register is located behind a router that translates all outbound traffic to the router's WAN IP address. Which two steps are required for this device to register to the Cisco FMC? (Choose two.)

  A. Reconfigure the Cisco FMC lo use the device's private IP address instead of the WAN address.

  B. Configure a NAT ID on both the Cisco FMC and the device.

  C. Add the port number being used for PAT on the router to the device's IP address in the Cisco FMC.

  D. Reconfigure the Cisco FMC to use the device's hostname instead of IP address.

  E. Remove the IP address defined for the device in the Cisco FMC.

  Correct Answer: AB

• Question 98:

  An engineer needs to configure remote storage on Cisco FMC. Configuration backups must be available from a secure location on the network for disaster recovery. Reports need to back up to a shared location that auditors can access with their Active Directory logins. Which strategy must the engineer use to meet these objectives?

  A. Use SMB for backups and NFS for reports.

  B. Use NFS for both backups and reports.

  C. Use SMB for both backups and reports.

  D. Use SSH for backups and NFS for reports.

  Correct Answer: C

  https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/ system_configuration.html#ID-2241-00000551 "You cannot send backups to one remote system and reports to another, but you can choose to send either to a remote system and store the other on the Firepower Management Center."

• Question 99:

  A network administrator is configuring a site-to-site IPsec VPN to a router sitting behind a Cisco FTD. The administrator has configured an access policy to allow traffic to this device on UDP 500, 4500, and ESP VPN traffic is not working. Which action resolves this issue?

  A. Set the allow action in the access policy to trust.

  B. Enable IPsec inspection on the access policy.

  C. Modify the NAT policy to use the interface PAT.

  D. Change the access policy to allow all ports.

  Correct Answer: A

• Question 100:

  A security engineer is deploying a pair of primary and secondary Cisco FMC devices. The secondary must also receive updates from Cisco Talos. Which action achieves this goal?

  A. Manually import rule updates onto the secondary Cisco FMC device.

  B. Force failover for the secondary Cisco FMC to synchronize the rule updates from the primary.

  C. Configure the primary Cisco FMC so that the rules are updated.

  D. Configure the secondary Cisco FMC so that it receives updates from Cisco Talos.

  Correct Answer: C