Cisco CCNP Security 300-710 Questions & Answers

• Question 161:

  A company is in the process of deploying intrusion protection with Cisco FTDs managed by a Cisco FMC. Which action must be selected to enable fewer rules detect only critical conditions and avoid false positives?

  A. Connectivity Over Security

  B. Balanced Security and Connectivity

  C. Maximum Detection

  D. No Rules Active

  Correct Answer: A

• Question 162:

  The CIO asks a network administrator to present to management a dashboard that shows custom analysis tables for the top DNS queries URL category statistics, and the URL reputation statistics. Which action must the administrator take to quickly produce this information for management?

  A. Run the Attack report and filter on DNS to show this information.

  B. Create a new dashboard and add three custom analysis widgets that specify the tables needed.

  C. Modify the Connection Events dashboard to display the information in a view for management.

  D. Copy the intrusion events dashboard tab and modify each widget to show the correct charts.

  Correct Answer: B

• Question 163:

  Which Cisco FMC report gives the analyst information about the ports and protocols that are related to the configured sensitive network for analysis?

  A. Malware Report

  B. Host Report

  C. Firepower Report

  D. Network Report

  Correct Answer: D

• Question 164:

  An engineer is investigating connectivity problems on Cisco Firepower for a specific SGT. Which command allows the engineer to capture real packets that pass through the firewall using an SGT of 64?

  A. capture CAP type inline-tag 64 match ip any any

  B. capture CAP match 64 type inline-tag ip any any

  C. capture CAP headers-only type inline-tag 64 match ip any any

  D. capture CAP buffer 64 match ip any any

  Correct Answer: A

• Question 165:

  A network administrator is migrating from a Cisco ASA to a Cisco FTD. EIGRP is configured on the Cisco ASA but it is not available in the Cisco FMC. Which action must the administrator take to enable this feature on the Cisco FTD?

  A. Configure EIGRP parameters using FlexConfig objects.

  B. Add the command feature eigrp via the FTD CLI.

  C. Create a custom variable set and enable the feature in the variable set.

  D. Enable advanced configuration options in the FMC.

  Correct Answer: A

  Reference: https://community.cisco.com/t5/network-security/adding-eigrp-to-ftd-using-fmc/td-p/4284529

• Question 166:

  What is an advantage of adding multiple inline interface pairs to the same inline interface set when deploying an asynchronous routing configuration?

  A. Allows the IPS to identify inbound and outbound traffic as part of the same traffic flow.

  B. The interfaces disable autonegotiation and interface speed is hard coded set to 1000 Mbps.

  C. Allows traffic inspection to continue without interruption during the Snort process restart.

  D. The interfaces are automatically configured as a media-independent interface crossover.

  Correct Answer: A

  https://www.cisco.com/c/en/us/td/docs/security/firepower/601/configuration/guide/fpmc-config-guide-v601/fpmc-config-guide-v60_chapter_01011010.pdf

• Question 167:

  A network administrator cannot select the link to be used for failover when configuring an active/passive HA Cisco FTD pair. Which configuration must be changed before setting up the high availability pair?

  A. An IP address in the same subnet must be added to each Cisco FTD on the interface.

  B. The interface name must be removed from the interface on each Cisco FTD.

  C. The name Failover must be configured manually on the interface on each Cisco FTD.

  D. The interface must be configured as part of a LACP Active/Active EtherChannel.

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699-configure-ftd-high-availability-on-firep.html

• Question 168:

  An organization recently implemented a transparent Cisco FTD in their network. They must ensure that the device does not respond to insecure SSL/TLS protocols. Which action accomplishes this task?

  A. Modify the device's settings using the device management feature within Cisco FMC to force only secure protocols.

  B. Use the Cisco FTD platform policy to change the minimum SSL version on the device to TLS 1.2.

  C. Enable the UCAPL/CC compliance on the device to support only the most secure protocols available.

  D. Configure a FlexConfig object to disable any insecure TLS protocols on the Cisco FTD device.

  Correct Answer: B

• Question 169:

  An administrator is configuring their transparent Cisco FTD device to receive ERSPAN traffic from multiple switches on a passive port, but the Cisco FTD is not processing the traffic. What is the problem?

  A. The switches do not have Layer 3 connectivity to the FTD device for GRE traffic transmission.

  B. The switches were not set up with a monitor session ID that matches the flow ID defined on the Cisco FTD.

  C. The Cisco FTD must be in routed mode to process ERSPAN traffic.

  D. The Cisco FTD must be configured with an ERSPAN port not a passive port.

  Correct Answer: C

• Question 170:

  A network administrator is deploying a Cisco IPS appliance and needs it to operate initially without affecting traffic flows. It must also collect data to provide a baseline of unwanted traffic before being reconfigured to drop it. Which Cisco IPS mode meets these requirements?

  A. failsafe

  B. inline tap

  C. promiscuous

  D. bypass

  Correct Answer: B