Cisco CCNP Security 300-710 Questions & Answers

• Question 351:

  Which two actions can be used in an access control policy rule? (Choose two.)

  A. Block with Reset

  B. Monitor

  C. Analyze

  D. Discover

  E. Block ALL

  Correct Answer: AB

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firesight/541/firepower-module-user-guide/asa-firepower-module-user-guide-v541/AC-Rules-Tuning-Overview.html#71854

• Question 352:

  Which two routing options are valid with Cisco Firepower Threat Defense? (Choose two.)

  A. BGPv6

  B. ECMP with up to three equal cost paths across multiple interfaces

  C. ECMP with up to three equal cost paths across a single interface

  D. BGPv4 in transparent firewall mode

  E. BGPv4 with nonstop forwarding

  Correct Answer: AE

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/601/configuration/guide/fpmc-config-guide-v601/fpmc-config-guide-v60_chapter_01100011.html#ID-2101-0000000e

• Question 353:

  Which object type supports object overrides?

  A. time range

  B. security group tag

  C. network object

  D. DNS server group

  Correct Answer: C

  Object Overrides supported are: Network Port VLAN tag URL

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Reusable_Objects.html#concept_8BFE8B9A83D742D9B647A74F7AD50053

• Question 354:

  Which Cisco Firepower rule action displays an HTTP warning page?

  A. Monitor

  B. Block

  C. Interactive Block

  D. Allow with Warning

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401/AC-Rules-Tuning-Overview.html#76698

• Question 355:

  Which two statements about bridge-group interfaces in Cisco FTD are true? (Choose two.)

  A. The BVI IP address must be in a separate subnet from the connected network.

  B. Bridge groups are supported in both transparent and routed firewall modes.

  C. Bridge groups are supported only in transparent firewall mode.

  D. Bidirectional Forwarding Detection echo packets are allowed through the FTD when using bridge-group members.

  E. Each directly connected network must be on the same subnet.

  Correct Answer: BE

  Bridge groups are supported in both transparent and routed firewall mode.

  The BVI IP address must be on the same subnet as the bridge group member interfaces.

  Reference : https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html

• Question 356:

  Which command is run on an FTD unit to associate the unit to an FMC manager that is at IP address 10.0.0.10, and that has the registration key Cisco123?

  A. configure manager local 10.0.0.10 Cisco123

  B. configure manager add Cisco123 10.0.0.10

  C. configure manager local Cisco123 10.0.0.10

  D. configure manager add 10.0.0.10 Cisco123

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/misc/fmc-ftd-mgmt-nw/fmc-ftd-mgmt-nw.html#id_106101

• Question 357:

  When creating a report template, how can the results be limited to show only the activity of a specific subnet?

  A. Create a custom search in Firepower Management Center and select it in each section of the report.

  B. Add an Input Parameter in the Advanced Settings of the report, and set the type to Network/IP.

  C. Add a Table View section to the report with the Search field defined as the network in CIDR format.

  D. Select IP Address as the X-Axis in each section of the report.

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401/Reports.html#87267

• Question 358:

  What is the disadvantage of setting up a site-to-site VPN in a clustered-units environment?

  A. VPN connections can be re-established only if the failed master unit recovers.

  B. Smart License is required to maintain VPN connections simultaneously across all cluster units.

  C. VPN connections must be re-established when a new master unit is elected.

  D. Only established VPN connections are maintained when a new master unit is elected.

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/clustering/ftd-cluster-solution.html#concept_g32_yml_y2b

• Question 359:

  Which policy rule is included in the deployment of a local DMZ during the initial deployment of a Cisco NGFW through the Cisco FMC GUI?

  A. a default DMZ policy for which only a user can change the IP addresses.

  B. deny ip any

  C. no policy rule is included

  D. permit ip any

  Correct Answer: C

  There is no DMZ setup during initial deployment of a CISCO NGFW using the FMC GUI... You would have to specify an interface designated to receive DMZ traffic, associate it to a security zone designated to DMZ traffic and lastly configure a policy to act on the DMZ traffic....

  However, when creating a NEW access control policy you have to choose from one of the 3 default actions: Block all traffic Intrusion Prevention Network Discovery

  So Technical C would be correct because there is no DMZ deployment during initial setup but if you were to setup a DMZ after initial setup you would most likely block all traffic by default and change it after to allow all traffic... Because it's a DMZ...

• Question 360:

  What are two application layer preprocessors? (Choose two.)

  A. CIFS

  B. IMAP

  C. SSL

  D. DNP3

  E. ICMP

  Correct Answer: BC

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Application_Layer_Preprocessors.html