Cisco CCNP Security 300-710 Questions & Answers

• Question 11:

  Refer to the exhibit.

  

  A company is deploying a pair of Cisco Secure Firewall Threat defence devices named FTD1 and FTD2. FTD1 and FTD2 have been configured as an active/standby pair with a failover link but without a stateful link.

  What must be implemented next to ensure that users on the internal network still communicate with outside devices if FTD1 fails?

  A. Disable port security on the switch interfaces connected to FTD1 and FTD2.

  B. Set maximum secured addresses to two on the switch interfaces on FTD1 and FTD2.

  C. Connect and configure a stateful link and thon deploy the changes.

  D. Configure the spanning-tree PortFasI feature on SW1 and FTD2

  Correct Answer: C

  In a failover configuration with Cisco Secure Firewall Threat Defense (FTD) devices, ensuring that users on the internal network can continue to communicate with outside devices if the primary device (FTD1) fails requires the implementation

  of a stateful failover link. The stateful failover link allows the secondary device (FTD2) to maintain session information and state data, ensuring seamless failover and minimizing disruptions.

  Steps to implement a stateful failover link:

  Physically connect a stateful failover link between FTD1 and FTD2.

  Configure the stateful failover link in the FMC.

  Ensure that both devices are properly synchronized and that stateful failover is enabled.

  Deploy the changes to both FTD devices.

  By configuring a stateful link, the secondary FTD can take over active sessions without requiring users to re-establish their connections, thus ensuring continuous communication. References: Cisco Secure Firewall Threat Defense

  Configuration Guide, Chapter on Failover Configuration.

• Question 12:

  A network administrator is trying to configure Active Directory authentication for VPN authentication to a Cisco Secure Firewall Threat Defence instance that is registered with Cisco Secure Firewall Management Center. Which system settings must be configured first in Secure Firewall Management Center to accomplish the goal?

  A. Device, Remote Access VPN

  B. System, Realms

  C. Policies, Authentication

  D. Authentication, Device

  Correct Answer: B

  To configure Active Directory authentication for VPN authentication on a Cisco Secure Firewall Threat Defense (FTD) instance registered with Cisco Secure Firewall Management Center (FMC), the administrator needs to configure Realms in

  the System settings of the FMC. Realms in FMC are used to define the directory servers (e.g., Active Directory) and how they are used for user authentication.

  Steps to configure this in FMC:

  Navigate to System > Integration > Realms and Directory. Add a new realm and configure the necessary details such as the directory server type (e.g., Active Directory), server address, and bind credentials. Test the connection to ensure it

  works correctly. This setup allows the FMC to authenticate VPN users against the Active Directory, thereby enabling secure access control for VPN connections. References: Cisco Secure Firewall Management Center Administrator Guide,

  Chapter on Realms Configuration.

• Question 13:

  Refer to the exhibit.

  

  An engineer generates troubleshooting files in Cisco Secure Firewall Management Center (FMC).

  A successfully completed task Is removed before the files are downloaded.

  Which two actions must be taken to determine the filename and obtain the generated troubleshooting files without regenerating them? (Choose two.)

  A. Use an FTP client Hi expert mode on Secure FMC lo upload the files to the FTP server.

  B. Go to the same screen as shown in the exhibit, click Advanced Troubleshooting, enter the rile name, and then start the download

  C. Connect to CU on the FTD67 and FTD66 devices and copy the tiles from flash to the PIP server.

  D. Go to expert mode on Secure FMC. list the contents of/Var/common, and determine the correct filename from the output

  E. Click System Monitoring, men Audit to determine the correct filename from the line containing the Generate Troubleshooting Files string.

  Correct Answer: DE

  If a task to generate troubleshooting files in Cisco Secure Firewall Management Center (FMC) is completed successfully but removed before the files are downloaded, the following steps can be taken to determine the filename and obtain the

  generated troubleshooting files without regenerating them:

  Go to expert mode on Secure FMC:

  Use the System Monitoring Audit logs:

  These actions help identify and retrieve the generated troubleshooting files without the need to regenerate them, saving time and resources. References: Cisco Secure Firewall Management Center Administrator Guide, Chapter on

  Troubleshooting and File Management.

• Question 14:

  An administrator configures the interfaces of a Cisco Secure Firewall Threat Defence device in an inline IPS deployment.

  The administrator completes these actions:

  1.

  identifies the device and the interfaces

  2.

  sets the interface mode to inline

  3.

  enables the interlaces

  Which configuration step must the administrator take next to complete the implementation?

  A. Enable spanning-tree PortFast on the interfaces.

  B. Configure an inline set

  C. Set the interface to Transparent mode.

  D. Set the interface to routed mode.

  Correct Answer: B

  After setting the interface mode to inline and enabling the interfaces on a Cisco Secure Firewall Threat Defense (FTD) device in an inline IPS deployment, the next step is to configure an inline set. An inline set groups two interfaces that work

  together to inspect traffic passing between them.

  Steps to configure an inline set:

  In FMC, navigate to Devices > Device Management.

  Select the FTD device and configure the interfaces. Create a new inline set, adding the relevant interfaces that have been set to inline mode.

  Deploy the configuration to the FTD device.

  Configuring an inline set ensures that the traffic between the specified interfaces is inspected and processed according to the IPS policies, completing the implementation of the inline IPS deployment.

  References: Cisco Secure Firewall Management Center Configuration Guide, Chapter on Inline Sets.

• Question 15:

  An administrator is configuring a new report template off. of a saved search within Cisco Secure Firewall Management Centre. The goal is to use the malware analysis report template, but use a different type saved search as the basis. The report is not working.

  What must be considered when configuring this report template?

  A. Saved searches can be used for the same report template only

  B. Saved searches are available freely for all report templates within the same domain.

  C. Saved searches from a different report template must be used.

  D. Saved searches must be renamed before using for different report template.

  Correct Answer: A

  When configuring a new report template based on a saved search in Cisco Secure Firewall Management Center (FMC), it is important to note that saved searches are specific to the report template they were created with. Saved searches

  cannot be freely used across different report templates.

  To use a different type of saved search, you must ensure that it aligns with the specific report template being used. This restriction ensures that the saved search parameters match the report's data requirements.

  References: Cisco Secure Firewall Management Center Administrator Guide, Chapter on Reporting and Saved Searches.

• Question 16:

  An engineer must change the mode of a Cisco Secure Firewall Threat Defense (FTD) firewall in the Cisco Secure Firewall Management Center (FMC) inventory.

  The engineer must take these actions:

  1.

  Register Secure FTD with Secure FMC.

  2.

  Change the firewall mode.

  3.

  Deregister the Secure FTD device from Secure FMC.

  How must the engineer take FTD take the actions?

  A. Reload the Secure FTD device.

  B. Configure the management IP address.

  C. Access the Secure FTD CLI from the console port.

  D. Erase the Secure FTD configuration

  Correct Answer: C

  To change the mode of a Cisco Secure Firewall Threat Defense (FTD) device in the Cisco Secure Firewall Management Center (FMC) inventory, the engineer must follow these steps:

  Register the Secure FTD with Secure FMC.

  Change the firewall mode.

  Deregister the Secure FTD device from Secure FMC. To perform these actions, accessing the Secure FTD CLI from the console port is necessary. This allows the engineer to execute the required commands to change the firewall mode and

  manage the registration status of the FTD device.

  Steps:

  Connect to the Secure FTD device via the console port. Access the CLI and execute the command to change the firewall mode (configure firewall-mode).

  Deregister the device from FMC if needed.

  Register or re-register the device with FMC as required. References: Cisco Secure Firewall Threat Defense Configuration Guide, Chapter on Device Management and CLI Access.

• Question 17:

  Which component is needed to perform rapid threat containment with Cisco FMC?

  A. ISE

  B. RESTful API

  C. SIEM

  D. DDI

  Correct Answer: A

  To perform rapid threat containment with Cisco FMC, the necessary component is Cisco Identity Services Engine (ISE). ISE integrates with FMC to provide dynamic network access control and enforcement, allowing for quick isolation of

  compromised endpoints based on security events detected by FMC.

  Steps:

  Integrate FMC with ISE by configuring the necessary settings in both platforms. Define security policies in FMC that trigger rapid threat containment actions via ISE.

  When a threat is detected, FMC can instruct ISE to isolate the affected endpoint, limiting its access to the network.

  This integration enables automated and efficient threat containment, reducing the response time and mitigating the impact of security incidents. References: Cisco Secure Firewall Management Center Integration Guide, Chapter on ISE

  Integration for Rapid Threat Containment.

• Question 18:

  A network administrator is trying to configure an access rule to allow access to a specific banking site over HTTPS.

  Which method must the administrator use to meet the requirement?

  A. Enable SSL decryption and specify the URL.

  B. Define the URL to be blocked and set the application to HTTP.

  C. Define the URL to be blocked and disable SSL inspection.

  D. Block the category of banking and define the application of WWW.

  Correct Answer: A

  To allow access to a specific banking site over HTTPS, the network administrator must use SSL decryption (also known as SSL/TLS inspection) and specify the URL. This is because HTTPS traffic is encrypted, and the firewall needs to

  decrypt the traffic to inspect the URL and enforce the access rule.

  Steps:

  Enable SSL Decryption: Configure SSL policies to decrypt the HTTPS traffic. Specify the URL: Define the URL of the banking site in the access control policy, ensuring that the decrypted traffic is inspected and allowed based on the specified

  URL.

  This method ensures that only the desired banking site is accessed over HTTPS, while other HTTPS traffic can be filtered or blocked according to the organization's security policies.

  References: Cisco Secure Firewall Management Center Configuration Guide, Chapter on SSL Decryption.

• Question 19:

  An engineer is tasked with configuring a custom intrusion rule on Cisco Secure Firewall Management Center to detect and block the malicious traffic pattern with specific payload containing string "|04 68 72 80 87 ff ed cq fg he qm pn|". Which action must the Engineer configure on the IPS policy?

  A. reset

  B. drop

  C. alert

  D. disable

  E. quarantine

  Correct Answer: B

• Question 20:

  An engineer must integrate a third-party security intelligence feed with Cisco Secure Firewall Management Center. Secure Firewall Management Center is running Version 6.2.3 and has 8 GB of memory. Which two actions must be taken to implement Threat Intelligence Director? (Choose two.)

  A. Add a TAXI I server.

  B. Add the URL of the TAXII server.

  C. Upgrade to version 6.6.

  D. Enable REST API access.

  E. Add 7 GB of memory.

  Correct Answer: DE