Cisco CCNP Security 300-710 Questions & Answers

• Question 271:

  In a multi-tenant deployment where multiple domains are in use, which update should be applied outside of the Global Domain?

  A. minor upgrade

  B. local import of intrusion rules

  C. Cisco Geolocation Database

  D. local import of major upgrade

  Correct Answer: B

  In a multidomain deployment, you can import local intrusion rules in any domain. You can view local intrusion rules imported in the current domain and ancestor domains.

• Question 272:

  An engineer wants to connect a single IP subnet through a Cisco FTD firewall and enforce policy. There is a requirement to present the internal IP subnet to the outside as a different IP address. What must be configured to meet these requirements?

  A. Configure the downstream router to perform NAT.

  B. Configure the upstream router to perform NAT.

  C. Configure the Cisco FTD firewall in routed mode with NAT enabled.

  D. Configure the Cisco FTD firewall in transparent mode with NAT enabled.

  Correct Answer: C

• Question 273:

  An administrator is adding a new URL-based category feed to the Cisco FMC for use within the policies. The intelligence source does not use STIX. but instead uses a .txt file format. Which action ensures that regular updates are provided?

  A. Add a URL source and select the flat file type within Cisco FMC.

  B. Upload the .txt file and configure automatic updates using the embedded URL.

  C. Add a TAXII feed source and input the URL for the feed.

  D. Convert the .txt file to STIX and upload it to the Cisco FMC.

  Correct Answer: A

• Question 274:

  An administrator receives reports that users cannot access a cloud-hosted web server. The access control policy was recently updated with several new policy additions and URL filtering. What must be done to troubleshoot the issue and restore access without sacrificing the organization's security posture?

  A. Create a new access control policy rule to allow ports 80 and 443 to the FQDN of the web server.

  B. Identify the blocked traffic in the Cisco FMC connection events to validate the block, and modify the policy to allow the traffic to the web server.

  C. Verify the blocks using the packet capture tool and create a rule with the action monitor for the traffic.

  D. Download a PCAP of the traffic attempts to verify the blocks and use the flexconfig objects to create a rule that allows only the required traffic to the destination server.

  Correct Answer: B

• Question 275:

  A network administrator reviews the file report for the last month and notices that all file types, except exe. show a disposition of unknown. What is the cause of this issue?

  A. The malware license has not been applied to the Cisco FTD.

  B. The Cisco FMC cannot reach the Internet to analyze files.

  C. A file policy has not been applied to the access policy.

  D. Only Spero file analysis is enabled.

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Reference_a_wrapper_Chapter_topic_here.html

• Question 276:

  An engineer runs the command restore remote-manager-backup location 2.2.2.2 admin /Volume/home/admin FTD408566513.zip on a Cisco FMC. After connecting to the repository, the Cisco FTD device is unable to accept the backup file. What is the reason for this failure?

  A. The backup file is not in .cfg format.

  B. The wrong IP address is used.

  C. The backup file extension was changed from .tar to .zip.

  D. The directory location is incorrect.

  Correct Answer: C

  Reference: https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC- 3455.pdf

• Question 277:

  Refer to the exhibit

  

  An engineer is modifying an access control pokey to add a rule to inspect all DNS traffic that passes through the firewall After making the change and deploying the pokey they see that DNS traffic is not bang inspected by the Snort engine What is the problem?

  A. The rule must specify the security zone that originates the traffic.

  B. The rule Is configured with the wrong setting for the source port.

  C. The rule must define the source network for inspection as well as the port.

  D. The action of the rule is set to trust instead of allow.

  Correct Answer: D

• Question 278:

  DRAG DROP

  Drag and drop the configuration steps from the left into the sequence on the right to enable external authentication on Cisco FMC to a RADIUS server.

  Select and Place:

  

  Correct Answer:

  

• Question 279:

  DRAG DROP

  A network engineer is deploying a Cisco Firepower 4100 appliance and must configure a multi-instance environment for high availability. Drag and drop me actions from the left into sequence on the right far this configuration.

  Select and Place:

  

  Correct Answer:

  

  The correct sequence of actions for configuring a multi-instance environment for high availability on a Cisco Firepower 4100 appliance is as follows:

  Add a resource profile for container instances. A resource profile defines the CPU, RAM, and disk space allocation for each container instance. You can create multiple resource profiles with different resource settings and assign them to

  different container instances1.

  Add a MAC pool prefix and view the MAC address for the container instance interfaces. A MAC pool prefix is a 24-bit prefix that is used to generate MAC addresses for the container instance interfaces. You can specify a custom MAC pool

  prefix or use the default one. You can also view the MAC addresses that are assigned to each container instance interface1.

  Configure interfaces. You need to configure the physical interfaces, EtherChannels, and VLAN subinterfaces that will be used by the container instances. You can also configure shared interfaces that can be used by multiple container

  instances on the same security module/engine1. Add a Standalone Firepower Threat Defense for Cisco Secure Firewall Management Center. You need to add a logical device that runs a standalone Firepower Threat Defense (FTD)

  application instance and register it with the Cisco Secure Firewall Management Center (FMC). This logical device will act as the management interface for the container instances1. Add a high-availability pair. You need to add another logical

  device that runs a standalone FTD application instance and register it with the FMC as well. Then, you need to configure high availability (HA) between the two standalone FTD logical devices. This will enable HA for the container instances

  that are associated with them1.

• Question 280:

  Refer to the exhibit.

  

  A Cisco Secure Firewall Threat Defense (FTD) device is deployed in inline mode with an inline set. The network engineer wants router R2 to remove the directly connected route M 68.1.0/24 from its routing table when the cable between routed R1 and the Secure FTD device Is disconnected. Which action must the engineer take?

  A. Implement the Propagate Link Stale option on the Secure FTD device

  B. Establish a routing protocol between R1 and R2.

  C. Disable hardware bypass on the Secure FTD device.

  D. Implement autostate functionality on the Gi0/2 interface of R2

  Correct Answer: A

  To ensure that router R2 removes the directly connected route for 192.168.1.0/24 from its routing table when the cable between router R1 and the Secure FTD device is disconnected, the network engineer must implement the "Propagate Link

  State" option on the Secure FTD device. This option allows the FTD to propagate the link state changes to adjacent devices, ensuring that the disconnection is recognized and the routing table is updated accordingly.

  Steps:

  Access the FTD device configuration via FMC.

  Navigate to the interface settings for the relevant interfaces. Enable the "Propagate Link State" option for the interfaces connected to R1 and R2.

  Deploy the changes to the FTD device.

  This configuration ensures that the link state changes are communicated to router R2, prompting it to remove the disconnected route from its routing table. References: Cisco Secure Firewall Threat Defense Configuration Guide, Chapter on

  Interface Settings and Link State Propagation.