Cisco CCNP Security 300-710 Questions & Answers

• Question 121:

  Due to an increase in malicious events, a security engineer must generate a threat report to include intrusion events, malware events, and security intelligence events. How is this information collected in a single report?

  A. Run the default Firepower report.

  B. Create a Custom report.

  C. Generate a malware report.

  D. Export the Attacks Risk report.

  Correct Answer: B

• Question 122:

  An engineer must configure a Cisco FMC dashboard in a multidomain deployment. Which action must the engineer take to edit a report template from an ancestor domain?

  A. Copy it to the current domain.

  B. Add it as a separate widget.

  C. Change the document attributes.

  D. Assign themselves ownership of it.

  Correct Answer: A

• Question 123:

  A company is deploying intrusion protection on multiple Cisco FTD appliances managed by Cisco FMC. Which system-provided policy must be selected if speed and detection are priorities?

  A. Maximum Detection

  B. Connectivity Over Security

  C. Security Over Connectivity

  D. Balanced Security and Connectivity

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/overview_of_network_analysis_and_intrusion_policies.html#ID-2247-00000144

• Question 124:

  What must be implemented on Cisco Firepower to allow multiple logical devices on a single physical device to have access to external hosts?

  A. Add at least two container instances from the same module.

  B. Set up a cluster control link between all logical devices.

  C. Define VLAN subinterfaces for each logical device.

  D. Add one shared management interface on all logical devices.

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa915/asdm715/general/asdm-715-general-config/intro-logical-devices.html

• Question 125:

  An engineer wants to perform a packet capture on the Cisco FTD to confirm that the host using IP address 192.168.100.100 has the MAC address of 1234.5678.901 to help troubleshoot a connectivity issue. What is the correct tcpdump command syntax to ensure that the MAC address appears in the packet capture output?

  A. -w capture.pcap -s 1518 host 192.168.100.100 ether

  B. -w capture.pcap -s 1518 host 192.168.100.100 mac

  C. -nm src 192.168.100.100

  D. -ne src 192.168.100.100

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212474-working-with-firepower-threat-defense-f.html

• Question 126:

  An engineer must deploy a Cisco FTD appliance via Cisco FMC to span a network segment to detect malware and threats. When setting the Cisco FTD interface mode, which sequence of actions meets this requirement?

  A. Set to passive, and configure an access control policy with an intrusion policy and a file policy defined.

  B. Set to passive, and configure an access control policy with a prefilter policy defined.

  C. Set to none, and configure an access control policy with an intrusion policy and a file policy defined.

  D. Set to none, and configure an access control policy with a prefilter policy defined.

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/fpmc-config-guide-v623_chapter_010000001.html

• Question 127:

  Remote users who connect via Cisco AnyConnect to the corporate network behind a Cisco FTD device report that they get no audio when calling between remote users using their softphones. These same users can call internal users on the corporate network without any issues. What is the cause of this issue?

  A. FTD has no NAT policy that allows outside to outside communication.

  B. Split tunneling is enabled for the Remote Access VPN on FTD.

  C. The hairpinning feature is not available on FTD.

  D. The Enable Spoke to Spoke Connectivity through Hub option is not selected on FTD.

  Correct Answer: A

• Question 128:

  A network administrator is troubleshooting access to a website hosted behind a Cisco FTD device. External clients cannot access the web server via HTTPS. The IP address configured on the web server is 192.168.7.46. The administrator is running the command capture CAP interface outside match ip any 192.168.7.46 255.255.255.255 but cannot see any traffic in the capture. Why is this occurring?

  A. The capture must use the public IP address of the web server.

  B. The packet capture shows only blocked traffic.

  C. The FTD has no route to the web server.

  D. The access policy is blocking the traffic.

  Correct Answer: A

• Question 129:

  A network administrator wants to block traffic to a known malware site at https:/www.badsite.com and all subdomains while ensuring no packets from any internal client are sent to that site. Which type of policy must the network administrator use to accomplish this goal?

  A. Access Control policy with URL filtering

  B. Prefilter policy

  C. DNS policy

  D. SSL policy

  Correct Answer: C

• Question 130:

  An administrator is adding a QoS policy to a Cisco FTD deployment. When a new rule is added to the policy and QoS is applied on "Interfaces in Destination Interface Objects", no interface objects are available. What is the problem?

  A. The FTD is out of available resources for use, so QoS cannot be added.

  B. The network segments that the interfaces are on do not have contiguous IP space.

  C. A conflict exists between the destination interface types that is preventing QoS from being added.

  D. QoS is available only on routed interfaces, and this device is in transparent mode.

  Correct Answer: D