Cisco CCNP Security 300-710 Questions & Answers

• Question 241:

  A network engineer is logged into the Cisco AMP for Endpoints console and sees a malicious verdict for an identified SHA-256 hash. Which configuration is needed to mitigate this threat?

  A. Add the hash to the simple custom deletion list.

  B. Use regular expressions to block the malicious file.

  C. Enable a personal firewall in the infected endpoint.

  D. Add the hash from the infected endpoint to the network block list.

  Correct Answer: A

• Question 242:

  A network engineer implements a new Cisco Firepower device on the network to take advantage of its intrusion detection functionality. There is a requirement to analyze the traffic going across the device, alert on any malicious traffic, and appear as a bump in the wire. How should this be implemented?

  A. Specify the BVl IP address as the default gateway for connected devices.

  B. Enable routing on the Cisco Firepower

  C. Add an IP address to the physical Cisco Firepower interfaces.

  D. Configure a bridge group in transparent mode.

  Correct Answer: D

  Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of its screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a "bump in the wire," or a "stealth firewall," and is not seen as a router hop to connected devices. However, like any other firewall, access control between interfaces is controlled, and all of the usual firewall checks are in place. Layer 2 connectivity is achieved by using a "bridge group" where you group together the inside and outside interfaces for a network, and the ASA uses bridging techniques to pass traffic between the interfaces. Each bridge group includes a Bridge Virtual Interface (BVI) to which you assign an IP address on the network. You can have multiple bridge groups for multiple networks. In transparent mode, these bridge groups cannot communicate with each other.

  https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/intro-fw.html

• Question 243:

  An engineer is troubleshooting a device that cannot connect to a web server. The connection is initiated from the Cisco FTD inside interface and attempting to reach 10.0.1.100 over the non-standard port of 9443. The host the engineer is attempting the connection from is at the IP address of 10.20.10.20. In order to determine what is happening to the packets on the network, the engineer decides to use the FTD packet capture tool.

  Which capture configuration should be used to gather the information needed to troubleshoot the issue?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: B

• Question 244:

  A network engineer is receiving reports of users randomly getting disconnected from their corporate applications which traverse the data center FTD appliance. Network monitoring tools show that the FTD appliance utilization is peaking above 90% of total capacity. What must be done in order to further analyze this issue?

  A. Use the Packet Export feature to save data onto external drives.

  B. Use the Packet Capture feature to collect real-time network traffic.

  C. Use the Packet Tracer feature for traffic policy analysis.

  D. Use the Packet Analysis feature for capturing network data.

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212474-working-with-firepower-threat-defense-f.html

• Question 245:

  An administrator is attempting to remotely log into a switch in the data center using SSH and is unable to connect. How does the administrator confirm that traffic is reaching the firewall?

  A. by performing a packet capture on the firewall

  B. by attempting to access it from a different workstation

  C. by running Wireshark on the administrator's PC

  D. by running a packet tracer on the firewall

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212474-working-with-firepower-threat-defense-f.html#anc16

• Question 246:

  IT management is asking the network engineer to provide high-level summary statistics of the Cisco FTD appliance in the network. The business is approaching a peak season so the need to maintain business uptime is high. Which report type should be used to gather this information?

  A. Risk Report

  B. SNMP Report

  C. Standard Report

  D. Malware Report

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/working_with_reports.html#id_20016

• Question 247:

  With a recent summer time change, system logs are showing activity that occurred to be an hour behind real time. Which action should be taken to resolve this issue?

  A. Manually adjust the time to the correct hour on all managed devices.

  B. Configure the system clock settings to use NTP with Daylight Savings checked.

  C. Configure the system clock settings to use NTP.

  D. Manually adjust the time to the correct hour on the Cisco FMC.

  Correct Answer: C

• Question 248:

  An engineer configures a network discovery policy on Cisco FMC. Upon configuration, it is noticed that excessive and misleading events are filling the database and overloading the Cisco FMC. A monitored NAT device is executing multiple updates of its operating system in a short period of time. What configuration change must be made to alleviate this issue?

  A. Exclude load balancers and NAT devices.

  B. Leave default networks.

  C. Increase the number of entries on the NAT device.

  D. Change the method to TCP/SYN.

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Network_Discovery_Policies.html

• Question 249:

  A network administrator is configuring SNORT inspection policies and is seeing failed deployment messages in Cisco FMC. What information should the administrator generate for Cisco TAC to help troubleshoot?

  A. A "troubleshoot" file for the device in question.

  B. A "show tech" file for the device in question.

  C. A "troubleshoot" file for the Cisco FMC.

  D. A "show tech" for the Cisco FMC.

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/troubleshooting_the_system.html

• Question 250:

  An engineer is attempting to add a new FTD device to their FMC behind a NAT device with a NAT ID of ACME001 and a password of Cisco0391521107.

  Which command set must be used in order to accomplish this?

  A. configure manager add ACME001

  B. configure manager add ACME001

  C. configure manager add ACME001

  D. configure manager add DONTRESOLVE AMCE001

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118596-configure-firesight-00.html