Cisco CCNP Security 300-710 Questions & Answers

• Question 21:

  An engineer is implementing a new Cisco Secure Firewall. The firewall must filler traffic between the three subnets:

  1.

  LAN 192.168.101.0724

  2.

  DMZ 192.168 200.0/24

  3.

  WAN 10.0.0.0/30

  Which firewall mode must the engineer implement?

  A. transparent

  B. network

  C. routed

  D. gateway

  Correct Answer: C

  To filter traffic between multiple subnets, the engineer must implement the firewall in routed mode. In routed mode, the firewall operates as a Layer 3 device, capable of routing traffic between different IP subnets. This mode is appropriate for

  filtering traffic between LAN, DMZ, and WAN subnets.

  Steps to configure routed mode:

  Access the firewall's management interface.

  Configure interfaces for each subnet (LAN, DMZ, WAN) with appropriate IP addresses and network masks.

  Define security zones and apply access control policies to filter traffic as required. This ensures that the firewall can inspect and route traffic between the different subnets, providing the necessary security and control.

  References: Cisco Secure Firewall Threat Defense Configuration Guide, Chapter on Routed Mode Configuration.

• Question 22:

  A network administrator is setting up a new highly available Cisco Secure Firewall Threat Defense (FTD) pair. The administrator wants to monitor that the interfaces on the secondary Secure FTD are reachable not just up. What must the administrator configure?

  A. This happens by default when high availability is enabled.

  B. secondary IP address

  C. EUI 64 address on a high-availability link

  D. separate high-availability and failover links

  Correct Answer: B

• Question 23:

  An administrator must fix a network problem whereby traffic from the inside network to a webserver is not getting through an instance of Cisco Secure Firewall Threat Defense. Which command must the administrator use to capture packets to the webserver that are dropped by Secure Firewall Threat Defense and resolve the issue?

  A. capture CAP int INSIDE match ip any host WEBSERVERIP

  B. capture CAP int OUTSIDE match ip any host WEBSERVERIP

  C. capture CAP int INSIDE match tcp any 80 host WEBSERVERIP 80

  D. capture CAP type asp-drop all headers-only

  Correct Answer: A

• Question 24:

  Users report that Cisco Duo 2FA fails when they attempt to connect to the VPN on a Cisco Secure Firewall Threat Defense (FTD) device. IT staff have VPN profiles that do not require multifactor authentication and they can connect to the VPN without any issues. When viewing the VPN troubleshooting log in Cisco Secure Firewall Management Center (FMC), the network administrator sees an error that the Cisco Duo AAA server has been marked as failed. What is the root cause of the issue?

  A. AD Trust certificates are missing from the Secure FTD device.

  B. Multifactor authentication is not supported on Secure FMC managed devices.

  C. The internal AD server is unreachable from the Secure FTD device.

  D. Duo trust certificates are missing from the Secure FTD device.

  Correct Answer: D

  If users report that Cisco Duo 2FA fails when attempting to connect to the VPN on a Cisco Secure Firewall Threat Defense (FTD) device, and the VPN troubleshooting log in FMC shows an error indicating that the Cisco Duo AAA server has

  been marked as failed, the root cause is likely missing Duo trust certificates on the FTD device. Trust certificates are essential for establishing a secure and trusted connection between the FTD and the Duo authentication service.

  Steps:

  Obtain the necessary Duo trust certificates.

  Install the certificates on the FTD device.

  Verify the configuration to ensure that the FTD device can properly communicate with the Duo AAA server.

  This resolves the authentication failure by ensuring that the FTD device can trust the Duo server.

  References: Cisco Secure Firewall Management Center Administrator Guide, Chapter on Certificate Management.

• Question 25:

  An engineer is troubleshooting an intermittent connectivity issue on a Cisco Secure Firewall Threat Defense appliance and must collect 24 hours' worth of data. The engineer started a packet capture, however it stops prematurely during this time period. The engineer notices that the packet capture buffer size is set to the default of 32 MB. Which buffer size is the maximum that the engineer must set to enable the packet capture to run successfully?

  A. 64 MB

  B. 1 GB

  C. 10 GB

  D. 100 GB

  Correct Answer: C

• Question 26:

  A network engineer detects a connectivity issue between Cisco Secure Firewall Management Center and Cisco Secure Firewall Threat Defense. Initial troubleshooting indicates that heartbeats and events are not being received. The engineer re-establishes the secure channels between both peers. Which two commands must the engineer run to resolve the issue? (Choose two.)

  A. manage_procs.pl

  B. show disk-manager

  C. show history

  D. sudo perfstats -Cq < /var/sf/rna/correlator-stats/now

  E. sudo stats_unified.pl

  Correct Answer: AE

  When connectivity issues are detected between Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) devices, and initial troubleshooting indicates that heartbeats and events are not being

  received, the engineer can run the following commands to resolve the issue by re-establishing secure channels and checking process statuses:

  manage_procs.pl: This script is used to manage and restart processes on the FTD device. Running this script can help restart any malfunctioning processes and reestablish connectivity between the FMC and FTD. sudo stats_unified.pl: This

  command provides detailed statistics and status of the unified system processes. It helps in diagnosing and resolving issues related to the secure channel and event reporting.

  Steps:

  Access the FTD CLI.

  Run the command manage_procs.pl to restart processes. Run the command sudo stats_unified.pl to gather detailed process statistics and verify the status. These commands help resolve connectivity issues by ensuring that all necessary

  processes are running correctly and secure channels are re-established. References: Cisco Secure Firewall Threat Defense Configuration Guide, Chapter on Troubleshooting and CLI Commands.

• Question 27:

  A network administrator is reviewing a packet capture. The packet capture from inside of Cisco Secure Firewall Threat Defense shows the inbound TCP traffic. However, the outbound TCP traffic is not seen in the packet capture from outside Secure Firewall Threat Defense. Which configuration change resolves the issue?

  A. Packet capture must include UDP traffic.

  B. Inside interface must be assigned a higher security level.

  C. Route to the destination must be added.

  D. Inside interface must be assigned a lower security level.

  Correct Answer: C

• Question 28:

  An administrator receives reports that users cannot access a cloud-hosted web server. The access control policy was recently updated with several new policy additions and URL filtering. What must be done to troubleshoot the issue and restore access without sacrificing the organization's security posture?

  A. Download a PCAP of the traffic to verify the blocks and use the FlexConfig to override the existing policy.

  B. Review the output in connection events to validate the block, and modify the policy to allow the traffic.

  C. Create a new access control policy rule to allow ports 80 and 443 to the FQDN of the web server.

  D. Verify the blocks using the packet capture tool and create a rule with the action monitor for the traffic.

  Correct Answer: B

• Question 29:

  A network administrator wants to configure a Cisco Secure Firewall Threat Defense instance managed by Cisco Secure Firewall Management Center to block traffic to known cryptomining networks. Which system settings must the administrator configure in Secure Firewall Management Center to meet the requirement?

  A. Intrusion Policy, Security Intelligence

  B. Access Policy, Security Intelligence

  C. Malware Policy, Rules

  D. Access Policy, Rules

  Correct Answer: B

  To block traffic to known cryptomining networks using Cisco Secure Firewall Threat Defense (FTD) managed by Cisco Secure Firewall Management Center (FMC), the network administrator needs to configure Security Intelligence in an

  Access Control Policy. Security Intelligence allows administrators to block traffic based on threat intelligence feeds, which include known malicious IP addresses, domains, and URLs.

  Steps:

  Navigate to Policies > Access Control > Access Control Policy in FMC.

  Edit or create an Access Control Policy.

  Go to the Security Intelligence tab.

  Enable the relevant threat intelligence feeds that include cryptomining networks.

  Apply the policy to the FTD device.

  This configuration ensures that traffic to known cryptomining networks is blocked, enhancing the network's security posture against cryptomining threats. References: Cisco Secure Firewall Management Center Configuration Guide, Chapter

  on Security Intelligence.

• Question 30:

  A network administrator is deploying a new Cisco Secure Firewall Threat Defense (FTD) firewall. After Cisco Secure FTD is deployed, inside clients have intermittent connectivity to each other. When reviewing the packet capture on the Secure FTD firewall, the administrator sees that Secure FTD is responding to all the ARP requests on the inside network. Which action must the network administrator take to resolve the issue?

  A. Review the access policy and verify that ARP is allowed from inside to inside.

  B. Review NAT policy and disable incorrect proxy ARP configuration.

  C. Convert the FTD to transparent mode to allow ARP requests.

  D. Hardcode the MAC address of the FTD to IP mapping on client machines.

  Correct Answer: B

  If inside clients have intermittent connectivity issues and the Cisco Secure FTD is responding to all ARP requests on the inside network, it indicates that there may be an incorrect proxy ARP configuration in the NAT policy. Proxy ARP can

  cause the FTD to respond to ARP requests on behalf of other devices, leading to connectivity issues.

  Steps to resolve:

  Review the NAT policy on the FTD to identify any incorrect proxy ARP configurations.

  Disable the proxy ARP setting for the relevant NAT rules that are causing the issue.

  This ensures that the FTD only responds to ARP requests as needed, preventing it from interfering with normal ARP traffic on the inside network. References: Cisco Secure Firewall Management Center Configuration Guide, Chapter on NAT

  and ARP Configuration.