Cisco CCNP Security 300-710 Questions & Answers

• Question 101:

  A security engineer must configure a Cisco FTD appliance to inspect traffic coming from the internet. The internet traffic will be mirrored from the Cisco Catalyst 9300 Switch. Which configuration accomplishes the task?

  A. Set the firewall mode to routed.

  B. Set interface configuration mode to passive.

  C. Set the firewall mode to transparent.

  D. Set interface configuration mode to none.

  Correct Answer: B

• Question 102:

  Refer to the exhibit. An engineer is analyzing a Network Risk Report from Cisco FMC. Which application must the engineer take immediate action against to prevent unauthorized network use?

  

  A. YouTube

  B. TOR

  C. Chrome

  D. Kerberos

  Correct Answer: B

• Question 103:

  Which two dynamic routing protocols are supported in Cisco FTD without using FlexConfig? (Choose two.)

  A. EIGRP

  B. OSPF

  C. static routing

  D. IS-IS

  E. BGP

  Correct Answer: BE

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/660/fdm/fptd-fdm-config-guide-660/fptd-fdm-routing.html

• Question 104:

  Which process should be checked when troubleshooting registration issues between Cisco FMC and managed devices to verify that secure communication is occurring?

  A. fpcollect

  B. dhclient

  C. sfmgr

  D. sftunnel

  Correct Answer: D

• Question 105:

  A security engineer must deploy a Cisco FTD appliance as a bump in the wire to detect intrusion events without disrupting the flow of network traffic. Which two features must be configured to accomplish the task? (Choose two.)

  A. transparent mode

  B. tap mode

  C. bridged mode

  D. inline set pair

  E. passive interfaces

  Correct Answer: BD

• Question 106:

  A network administrator has converted a Cisco FTD from using LDAP to LDAPS for VPN authentication. The Cisco FMC can connect to the LDAPS server, but the Cisco FTD is not connecting. Which configuration must be enabled on the Cisco FTD?

  A. The LDAPS must be allowed through the access control policy.

  B. The RADIUS server must be defined.

  C. SSL must be set to a use TLSv1.2 or lower.

  D. DNS servers must be defined for name resolution.

  Correct Answer: A

• Question 107:

  An engineer attempts to pull the configuration for a Cisco FTD sensor to review with Cisco TAC but does not have direct access to the CLI for the device. The CLI for the device is managed by Cisco FMC to which the engineer has access. Which action in Cisco FMC grants access to the CLI for the device?

  A. Create a backup of the configuration within the Cisco FMC.

  B. Download the configuration file within the File Download section of Cisco FMC.

  C. Export the configuration using the Import/Export tool within Cisco FMC.

  D. Use the show run all command in the Cisco FTD CLI feature within Cisco FMC.

  Correct Answer: C

• Question 108:

  An engineer must add DNS-specific rules to the Cisco FTD intrusion policy. The engineer wants to use the rules currently in the Cisco FTD Snort database that are not already enabled but does not want to enable more than are needed. Which action meets these requirements?

  A. Change the rules using the Generate and Use Recommendations feature.

  B. Change the rule state within the policy being used.

  C. Change the dynamic state of the rule within the policy.

  D. Change the base policy to Security over Connectivity.

  Correct Answer: B

• Question 109:

  Refer to the exhibit.

  

  A systems administrator conducts a connectivity test to their SCCM server from a host machine and gets no response from the server. Which action ensures that the ping packets reach the destination and that the host receives replies?

  A. Configure a custom Snort signature to allow ICMP traffic after inspection.

  B. Modify the Snort rules to allow ICMP traffic.

  C. Create an access control policy rule that allows ICMP traffic.

  D. Create an ICMP allow list and add the ICMP destination to remove it from the implicit deny list.

  Correct Answer: C

• Question 110:

  An administrator is setting up a Cisco FMC and must provide expert mode access for a security engineer. The engineer is permitted to use only a secured out-of-band network workstation with a static IP address to access the Cisco FMC. What must be configured to enable this access?

  A. Enable SSH and define an access list.

  B. Enable HTTPS and SNMP under the Access List section.

  C. Enable SCP under the Access List section.

  D. Enable HTTP and define an access list.

  Correct Answer: A