Cisco CCNP Security 300-710 Questions & Answers

• Question 251:

  Refer to the exhibit.

  

  An organization has an access control rule with the intention of sending all social media traffic for inspection. After using the rule for some time, the administrator notices that the traffic is not being inspected, but is being automatically allowed. What must be done to address this issue?

  A. Add the social network URLs to the block list.

  B. Change the intrusion policy to connectivity over security.

  C. Modify the selected application within the rule.

  D. Modify the rule action from trust to allow.

  Correct Answer: D

• Question 252:

  A user within an organization opened a malicious file on a workstation which in turn caused a ransomware attack on the network. What should be configured within the Cisco FMC to ensure the file is tested for viruses on a sandbox system?

  A. Spero analysis

  B. capacity handling

  C. local malware analysis

  D. dynamic analysis

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/file_policies_and_advanced_malware_protection.html#ID-2199-000005d8

• Question 253:

  An engineer has been tasked with providing disaster recovery for an organization's primary Cisco FMC. What must be done on the primary and secondary Cisco FMCs to ensure that a copy of the original corporate policy is available if the primary Cisco FMC fails?

  A. Restore the primary Cisco FMC backup configuration to the secondary Cisco FMC device when the primary device fails.

  B. Connect the primary and secondary Cisco FMC devices with Category 6 cables of not more than 10 meters in length.

  C. Configure high-availability in both the primary and secondary Cisco FMCs.

  D. Place the active Cisco FMC device on the same trusted management network as the standby device.

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/firepower_management_center_high_availability.html

• Question 254:

  A network administrator is seeing an unknown verdict for a file detected by Cisco FTD. Which malware policy configuration option must be selected in order to further analyze the file in the Talos cloud?

  A. malware analysis

  B. dynamic analysis

  C. sandbox analysis

  D. Spero analysis

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Reference_a_wrapper_Chapter_topic_here.html

• Question 255:

  An administrator is working on a migration from Cisco ASA to the Cisco FTD appliance and needs to test the rules without disrupting the traffic. Which policy type should be used to configure the ASA rules during this phase of the migration?

  A. Prefilter

  B. Intrusion

  C. Access Control

  D. Identity

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/migration-tool/migration-guide/ASA2FTD-with-FP-Migration-Tool/b_Migration_Guide_ASA2FTD_chapter_01011.html

• Question 256:

  An organization wants to secure traffic from their branch office to the headquarters building using Cisco Firepower devices. They want to ensure that their Cisco Firepower devices are not wasting resources on inspecting the VPN traffic. What must be done to meet these requirements?

  A. Configure the Cisco Firepower devices to bypass the access control policies for VPN traffic.

  B. Tune the intrusion policies in order to allow the VPN traffic through without inspection.

  C. Configure the Cisco Firepower devices to ignore the VPN traffic using prefilter policies.

  D. Enable a flexconfig policy to re-classify VPN traffic so that it no longer appears as interesting traffic.

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/fdm/fptd-fdm-config-guide-640/fptd-fdm-ravpn.html

• Question 257:

  There is an increased amount of traffic on the network and for compliance reasons, management needs visibility into the encrypted traffic. What is a result of enabling TLS/SSL decryption to allow this visibility?

  A. It prompts the need for a corporate managed certificate.

  B. It will fail if certificate pinning is not enforced.

  C. It has minimal performance impact.

  D. It is not subject to any Privacy regulations.

  Correct Answer: A

• Question 258:

  An organization is setting up two new Cisco FTD devices to replace their current firewalls and cannot have any network downtime. During the setup process, the synchronization between the two devices is failing. What action is needed to resolve this issue?

  A. Confirm that both devices are running the same software version.

  B. Confirm that both devices are configured with the same types of interfaces.

  C. Confirm that both devices have the same flash memory sizes.

  D. Confirm that both devices have the same port-channel numbering.

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/firepower_threat_defense_high_availability.html#Cisco_Reference.dita_cc8821d8-a5a5-49c0-97fd-dc9b6f7dbad2

• Question 259:

  An engineer is attempting to create a new dashboard within the Cisco FMC to have a single view with widgets from many of the other dashboards. The goal is to have a mixture of threat and security related widgets along with Cisco Firepower device health information. Which two widgets must be configured to provide this information? (Choose two.)

  A. Intrusion Events

  B. Correlation Information

  C. Appliance Status

  D. Current Sessions

  E. Network Compliance

  Correct Answer: AC

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/dashboards.html#ID-2206-00000283

• Question 260:

  An engineer configures an access control rule that deploys file policy configurations to security zone or tunnel zones, and it causes the device to restart. What is the reason for the restart?

  A. Source or destination security zones in the access control rule matches the security zones that are associated with interfaces on the target devices.

  B. The source tunnel zone in the rule does not match a tunnel zone that is assigned to a tunnel rule in the destination policy.

  C. Source or destination security zones in the source tunnel zone do not match the security zones that are associated with interfaces on the target devices.

  D. The source tunnel zone in the rule does not match a tunnel zone that is assigned to a tunnel rule in the source policy.

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/policy_management.html