Cisco CCNP Security 300-710 Questions & Answers

• Question 261:

  An organization has seen a lot of traffic congestion on their links going out to the internet. There is a Cisco Firepower device that processes all of the traffic going to the internet prior to leaving the enterprise. How is the congestion alleviated

  so that legitimate business traffic reaches the destination?

  A. Create a NAT policy so that the Cisco Firepower device does not have to translate as many addresses.

  B. Create a flexconfig policy to use WCCP for application aware bandwidth limiting.

  C. Create a QoS policy rate-limiting high bandwidth applications.

  D. Create a VPN policy so that direct tunnels are established to the business applications.

  Correct Answer: C

• Question 262:

  A hospital network needs to upgrade their Cisco FMC managed devices and needs to ensure that a disaster recovery process is in place. What must be done in order to minimize downtime on the network?

  A. Configure a second circuit to an ISP for added redundancy.

  B. Keep a copy of the current configuration to use as backup.

  C. Configure the Cisco FMCs for failover.

  D. Configure the Cisco FMC managed devices for clustering.

  Correct Answer: D

• Question 263:

  An organization has implemented Cisco Firepower without IPS capabilities and now wants to enable inspection for their traffic. They need to be able to detect protocol anomalies and utilize the Snort rule sets to detect malicious behavior. How is this accomplished?

  A. Modify the network discovery policy to detect new hosts to inspect.

  B. Modify the access control policy to redirect interesting traffic to the engine.

  C. Modify the intrusion policy to determine the minimum severity of an event to inspect.

  D. Modify the network analysis policy to process the packets for inspection.

  Correct Answer: B

  Each rule in the ACP has control over whether the traffic is sent to snort to be inspected or not. If the traffic is allowed and an intrusion policy is selected, then the traffic will go on to be inspected by snort.

  Reference:

  https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html

• Question 264:

  An engineer is monitoring network traffic from their sales and product development departments, which are on two separate networks. What must be configured in order to maintain data privacy for both departments?

  A. Use passive IDS ports for both departments.

  B. Use a dedicated IPS inline set for each department to maintain traffic separation.

  C. Use 802.1Q inline set Trunk interfaces with VLANs to maintain logical traffic separation.

  D. Use one pair of inline set in TAP mode for both departments.

  Correct Answer: A

  There's nothing wrong with answer A. Especially since they state they are on separate networks. Do they both go out their own firewalls and internet connections? Then you would SPAN or ERSPAN copies of traffic to passive interfaces and do IDS instead of IPS. Not sure what "Data Privacy" is supposed to mean, but in IDS mode, those packets are discarded after inspection in an IDS configuration, and dont go through the device.

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/inline_sets_and_passive_interfaces_for_firepower_threat_defense.html

• Question 265:

  With Cisco FTD software, which interface mode must be configured to passively receive traffic that passes through the appliance?

  A. ERSPAN

  B. firewall

  C. tap

  D. IPS-only

  Correct Answer: C

  In Cisco Firepower Threat Defense (FTD) software, configuring an interface in "tap" mode is necessary to passively receive traffic that passes through the appliance. Tap mode allows the interface to act as a passive listening device, monitoring traffic between other devices without interfering or altering the traffic flow. This mode is used primarily for intrusion detection and monitoring purposes, enabling the appliance to analyze traffic for potential threats or anomalies while maintaining the integrity of the network's operational status.

• Question 266:

  A Cisco FTD device is running in transparent firewall mode with a VTEP bridge group member ingress interface. What must be considered by an engineer tasked with specifying a destination MAC address for a packet trace?

  A. The output format option for the packet logs is unavailable.

  B. Only the UDP packet type is supported.

  C. The destination MAC address is optional if a VLAN ID value is entered.

  D. The VLAN ID and destination MAC address are optional.

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/troubleshooting_the_system.html

• Question 267:

  What is a characteristic of bridge groups on a Cisco FTD?

  A. In routed firewall mode, routing between bridge groups is supported.

  B. Routing between bridge groups is achieved only with a router-on-a-stick configuration on a connected router.

  C. In routed firewall mode, routing between bridge groups must pass through a routed interface.

  D. In transparent firewall mode, routing between bridge groups is supported.

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/intro-fw.pdf

• Question 268:

  Network traffic coming from an organization's CEO must never be denied. Which access control policy configuration option should be used if the deployment engineer is not permitted to create a rule to allow all traffic?

  A. Change the intrusion policy from security to balance.

  B. Configure a trust policy for the CEO.

  C. Configure firewall bypass.

  D. Create a NAT policy just for the CEO.

  Correct Answer: B

• Question 269:

  An organization has a compliancy requirement to protect servers from clients, however, the clients and servers all reside on the same Layer 3 network. Without readdressing IP subnets for clients or servers, how is segmentation achieved?

  A. Change the IP addresses of the servers, while remaining on the same subnet.

  B. Deploy a firewall in routed mode between the clients and servers.

  C. Change the IP addresses of the clients, while remaining on the same subnet.

  D. Deploy a firewall in transparent mode between the clients and servers.

  Correct Answer: D

  Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of its screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a "bump in the wire," or a "stealth firewall," and is not seen as a router hop to connected devices. However, like any other firewall, access control between interfaces is controlled, and all of the usual firewall checks are in place. Layer 2 connectivity is achieved by using a "bridge group" where you group together the inside and outside interfaces for a network, and the Firepower Threat Defense device uses bridging techniques to pass traffic between the interfaces. Each bridge group includes a Bridge Virtual Interface (BVI) to which you assign an IP address on the network. You can have multiple bridge groups for multiple networks. In transparent mode, these bridge groups cannot communicate with each other

• Question 270:

  A mid-sized company is experiencing higher network bandwidth utilization due to a recent acquisition. The network operations team is asked to scale up their one Cisco FTD appliance deployment to higher capacities due to the increased network bandwidth. Which design option should be used to accomplish this goal?

  A. Deploy multiple Cisco FTD HA pairs in clustering mode to increase performance.

  B. Deploy multiple Cisco FTD appliances in firewall clustering mode to increase performance.

  C. Deploy multiple Cisco FTD appliances using VPN load-balancing to scale performance.

  D. Deploy multiple Cisco FTD HA pairs to increase performance.

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/clustering/ftd-cluster-solution.html#concept_C8502505F840451C9E600F1EED9BC18E