Cisco CCNP Security 300-710 Questions & Answers

• Question 131:

  Which action must be taken on the Cisco FMC when a packet bypass is configured in case the Snort engine is down or a packet takes too long to process?

  A. Enable Automatic Application Bypass.

  B. Add a Bypass Threshold policy for failures.

  C. Configure Fastpath rules to bypass inspection.

  D. Enable Inspect Local Router Traffic.

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/policy_management.html

• Question 132:

  An engineer is configuring multiple Cisco FTD appliances for use in the network. Which rule must the engineer follow while defining interface objects in Cisco FMC for use with interfaces across multiple devices?

  A. Two security zones can contain the same interface.

  B. Interface groups can contain interfaces from many devices.

  C. An interface cannot belong to a security zone and an interface group.

  D. Interface groups can contain multiple interface types.

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/reusable_objects.html#ID-2243-000009b4

• Question 133:

  An organization is configuring a new Cisco Firepower High Availability deployment. Which action must be taken to ensure that failover is as seamless as possible to end users?

  A. Set the same FQDN for both chassis.

  B. Set up a virtual failover MAC address between chassis.

  C. Load the same software version on both chassis.

  D. Use a dedicated stateful link between chassis.

  Correct Answer: D

• Question 134:

  A Cisco FMC administrator wants to configure fastpathing of trusted network traffic to increase performance. In which type of policy would the administrator configure this feature?

  A. Network Analysis policy

  B. Identity policy

  C. Prefilter policy

  D. Intrusion policy

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/prefiltering_and_prefilter_policies.html

• Question 135:

  An engineer is creating an URL object on Cisco FMC. How must it be configured so that the object will match for HTTPS traffic in an access control policy?

  A. Specify the protocol to match (HTTP or HTTPS).

  B. Use the FQDN including the subdomain for the website.

  C. Use the subject common name from the website certificate.

  D. Define the path to the individual webpage that uses HTTPS.

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/url_filtering.html

• Question 136:

  A network administrator has converted a Cisco FTD from using LDAP to LDAPS for VPN authentication. The Cisco FMC can connect to the LDAPS server, but the Cisco FTD is not connecting. Which configuration must be enabled on the Cisco FTD?

  A. SSL must be set to a use TLSv1.2 or lower.

  B. The LDAPS must be allowed through the access control policy.

  C. DNS servers must be defined for name resolution.

  D. The RADIUS server must be defined.

  Correct Answer: C

• Question 137:

  An engineer must configure the firewall to monitor traffic within a single subnet without increasing the hop count of that traffic. How would the engineer achieve this?

  A. Configure Cisco Firepower as a transparent firewall.

  B. Set up Cisco Firepower as managed by Cisco FDM.

  C. Configure Cisco Firepower in FXOS monitor only mode.

  D. Set up Cisco Firepower in intrusion prevention mode.

  Correct Answer: A

• Question 138:

  Which firewall design will allow it to forward traffic at layers 2 and 3 for the same subnet?

  A. routed mode

  B. Cisco Firepower Threat Defense mode

  C. transparent mode

  D. integrated routing and bridging

  Correct Answer: D

• Question 139:

  What is the RTC workflow when the infected endpoint is identified?

  A. Cisco ISE instructs Cisco AMP to contain the infected endpoint.

  B. Cisco ISE instructs Cisco FMC to contain the infected endpoint.

  C. Cisco AMP instructs Cisco FMC to contain the infected endpoint.

  D. Cisco FMC instructs Cisco ISE to contain the infected endpoint.

  Correct Answer: D

• Question 140:

  A network administrator is trying to convert from LDAP to LDAPS for VPN user authentication on a Cisco FTD. Which action must be taken on the Cisco FTD objects to accomplish this task?

  A. Add a Key Chain object to acquire the LDAPS certificate.

  B. Create a Certificate Enrollment object to get the LDAPS certificate needed.

  C. Identify the LDAPS cipher suite and use a Cipher Suite List object to define the Cisco FTD connection requirements.

  D. Modify the Policy List object to define the session requirements for LDAPS.

  Correct Answer: B