Cisco CCNP Security 300-710 Questions & Answers

• Question 171:

  A network administrator is implementing an active/passive high availability Cisco FTD pair. When adding the high availability pair, the administrator cannot select the secondary peer. What is the cause?

  A. The second Cisco FTD is not the same model as the primary Cisco FTD.

  B. An high availability license must be added to the Cisco FMC before adding the high availability pair.

  C. The failover link must be defined on each Cisco FTD before adding the high availability pair.

  D. Both Cisco FTD devices are not at the same software version.

  Correct Answer: C

• Question 172:

  An engineer wants to change an existing transparent Cisco FTD to routed mode. The device controls traffic between two network segments. Which action is mandatory to allow hosts to reestablish communication between these two segments after the change?

  A. Remove the existing dynamic routing protocol settings.

  B. Configure multiple BVIs to route between segments.

  C. Assign unique VLAN IDs to each firewall interface.

  D. Implement non-overlapping IP subnets on each segment.

  Correct Answer: D

• Question 173:

  An engineer installs a Cisco FTD device and wants to inspect traffic within the same subnet passing through a firewall and inspect traffic destined to the Internet. Which configuration will meet this requirement?

  A. transparent firewall mode with IRB only

  B. routed firewall mode with BVI and routed interfaces

  C. transparent firewall mode with multiple BVIs

  D. routed firewall mode with routed interfaces only

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html

• Question 174:

  An engineer is working on a LAN switch and has noticed that its network connection to the inline Cisco IPS has gone down. Upon troubleshooting, it is determined that the switch is working as expected. What must have been implemented for this failure to occur?

  A. The upstream router has a misconfigured routing protocol.

  B. Link-state propagation is enabled.

  C. The Cisco IPS has been configured to be in fail-open mode.

  D. The Cisco IPS is configured in detection mode.

  Correct Answer: B

• Question 175:

  What is the role of the casebook feature in Cisco Threat Response?

  A. pulling data via the browser extension

  B. alert prioritization

  C. sharing threat analysis

  D. triage automation with alerting

  Correct Answer: C

  The casebook and pivot menu are widgets available in Cisco Threat Response. Casebook

  - It is used to record, organize, and share sets of observables of interest primarily during an investigation and threat analysis. You can use a casebook to get the current verdicts or dispositions on the observables. https://www.cisco.com/c/en/ us/td/docs/security/ces/user_guide/esa_user_guide_13- 5-1/b_ESA_Admin_Guide_ces_13-5-1/b_ESA_Admin_Guide_13- 0_chapter_0110001.pdf

• Question 176:

  Upon detecting a flagrant threat on an endpoint, which two technologies instruct Cisco Identity Services Engine to contain the infected endpoint either manually or automatically? (Choose two.)

  A. Cisco ASA 5500 Series

  B. Cisco FMC

  C. Cisco AMP

  D. Cisco Stealthwatch

  E. Cisco ASR 7200 Series

  Correct Answer: BC

• Question 177:

  A security engineer is configuring an Access Control Policy for multiple branch locations. These locations share a common rule set and utilize a network object called INSIDE_NET which contains the locally significant internal network subnets at each location.

  Which technique will retain the policy consistency at each location but allow only the locally significant network subnet within the applicable rules?

  A. utilizing a dynamic Access Control Policy that updates from Cisco Talos

  B. utilizing policy inheritance

  C. creating a unique Access Control Policy per device

  D. creating an Access Control Policy with an INSIDE_NET network object and object overrides

  Correct Answer: D

• Question 178:

  An organization is migrating their Cisco ASA devices running in multicontext mode to Cisco FTD devices.

  Which action must be taken to ensure that each context on the Cisco ASA is logically separated in the Cisco FTD devices?

  A. Add a native instance to distribute traffic to each Cisco FTD context.

  B. Add the Cisco FTD device to the Cisco ASA port channels.

  C. Configure a container instance in the Cisco FTD for each context in the Cisco ASA.

  D. Configure the Cisco FTD to use port channels spanning multiple networks.

  Correct Answer: C

• Question 179:

  A network administrator configured a NAT policy that translates a public IP address to an internal web server IP address. An access policy has also been created that allows any source to reach the public IP address on port 80. The web server is still not reachable from the Internet on port 80.

  Which configuration change is needed?

  A. The intrusion policy must be disabled for port 80.

  B. The access policy rule must be configured for the action trust.

  C. The NAT policy must be modified to translate the source IP address as well as destination IP address.

  D. The access policy must allow traffic to the internal web server IP address.

  Correct Answer: D

• Question 180:

  An engineer must define a URL object on Cisco FMC.

  What is the correct method to specify the URL without performing SSL inspection?

  A. Use Subject Common Name value.

  B. Specify all subdomains in the object group.

  C. Specify the protocol in the object.

  D. Include all URLs from CRL Distribution Points.

  Correct Answer: B