300-710 SNCF - Concentration Exam of CCNP Security Certification - Free Latest Dumps for IT Certification Exams

300-710 SNCF – Concentration Exam of CCNP Security Certification

dumps2021-08-25T06:54:38+08:00

Securing Networks with Cisco Firepower 300-710 SNCF exam is known as a concentration test of Cisco CCNP security certification. If you intend to earn CCNP Security certification, you can choose Cisco 300-710 SNCF exam as the concentration test. Online Cisco 300-710 SNCF exam dumps are the best material for you to study this test.

Cisco 300-710 SNCF exam tests your knowledge of Cisco Firepower Threat Defense and Firepower, including policy configurations, integrations, deployments, management and troubleshooting. To prepare for Cisco 300-710 SNCF exam well, the online Securing Networks with Cisco Firepower 300-710 SNCF dumps are the good material. Free Cisco 300-710 SNCF exam online dumps are available below.

Page 1 of 3

1. An engineer configures a network discovery policy on Cisco FMC. Upon configuration, it is noticed that excessive and misleading events filing the database and overloading the Cisco FMC. A monitored NAT device is executing multiple updates of its operating system in a short period of time.

What configuration change must be made to alleviate this issue?

Leave default networks.

Change the method to TCP/SY

Increase the number of entries on the NAT device.

Exclude load balancers and NAT devices.

2. administrator is configuring SNORT inspection policies and is seeing failed deployment messages in Cisco FMC.

What information should the administrator generate for Cisco TAC to help troubleshoot?

A Troubleshoot" file for the device in question.

A "show tech" file for the device in question

A "show tech" for the Cisco FM

A "troubleshoot" file for the Cisco FMC

3. An engineer is troubleshooting a device that cannot connect to a web server. The connection is initiated from the Cisco FTD inside interface and attempting to reach 10.0.1.100 over the nonstandard port of 9443. The host the engineer is attempting the connection from is at the IP address of 10.20.10.20. In order to determine what is happening to the packets on the network, the engineer decides to use the FTD packet capture tool.

Which capture configuration should be used to gather the information needed to troubleshoot this issue?

A)

Option A

Option B

Option C

Option D

4. A network engineer is receiving reports of users randomly getting disconnected from their corporate applications which traverses the data center FTD appliance Network monitoring tools show that the FTD appliance utilization is peaking above 90% of total capacity.

What must be done in order to further analyze this issue?

Use the Packet Export feature to save data onto external drives

Use the Packet Capture feature to collect real-time network traffic

Use the Packet Tracer feature for traffic policy analysis

Use the Packet Analysis feature for capturing network data

5. IT management is asking the network engineer to provide high-level summary statistics of the Cisco FTD appliance in the network. The business is approaching a peak season so the need to maintain business uptime is high.

Which report type should be used to gather this information?

Malware Report

Standard Report

SNMP Report

Risk Report

6. Refer to the exhibit.

An administrator is looking at some of the reporting capabilities for Cisco Firepower and noticed this section of the Network Risk report showing a lot of SSL activity that cloud be used for evasion.

Which action will mitigate this risk?

Use SSL decryption to analyze the packets.

Use encrypted traffic analytics to detect attacks

Use Cisco AMP for Endpoints to block all SSL connection

Use Cisco Tetration to track SSL connections to servers.

7. An administrator is setting up Cisco Firepower to send data to the Cisco Stealthwatch appliances. The NetFlow_Set_Parameters object is already created, but NetFlow is not being sent to the flow collector.

What must be done to prevent this from occurring?

Add the NetFlow_Send_Destination object to the configuration

Create a Security Intelligence object to send the data to Cisco Stealthwatch

Create a service identifier to enable the NetFlow service

Add the NetFlow_Add_Destination object to the configuration

8. With a recent summer time change, system logs are showing activity that occurred to be an hour behind real time.

Which action should be taken to resolve this issue?

Manually adjust the time to the correct hour on all managed devices

Configure the system clock settings to use NTP with Daylight Savings checked

Manually adjust the time to the correct hour on the Cisco FM

Configure the system clock settings to use NTP

9. A network administrator notices that SI events are not being updated The Cisco FTD device is unable to load all of the SI event entries and traffic is not being blocked as expected.

What must be done to correct this issue?

Restart the affected devices in order to reset the configurations

Manually update the SI event entries to that the appropriate traffic is blocked

Replace the affected devices with devices that provide more memory

Redeploy configurations to affected devices so that additional memory is allocated to the SI module

10. Refer to the exhibit.

What must be done to fix access to this website while preventing the same communication to all other websites?

Create an intrusion policy rule to have Snort allow port 80 to only 172.1.1.50.

Create an intrusion policy rule to have Snort allow port 443 to only 172.1.1.50.

Create an access control policy rule to allow port 443 to only 172.1.1.50.

Create an access control policy rule to allow port 80 to only 172.1.1.50.

11. A network administrator discovers that a user connected to a file server and downloaded a malware file. The Cisco FMC generated an alert for the malware event, however the user still remained connected.

Which Cisco APM file rule action within the Cisco FMC must be set to resolve this issue?

Detect Files

Malware Cloud Lookup

Local Malware Analysis

Reset Connection

12. Which feature within the Cisco FMC web interface allows for detecting, analyzing and blocking malware in network traffic?

intrusion and file events

Cisco AMP for Endpoints

Cisco AMP for Networks

file policies

13. Which license type is required on Cisco ISE to integrate with Cisco FMC pxGrid?

mobility

plus

base

apex

14. A network engineer wants to add a third-party threat feed into the Cisco FMC for enhanced threat detection.

Which action should be taken to accomplish this goal?

Enable Threat Intelligence Director using STIX and TAXII

Enable Rapid Threat Containment using REST APIs

Enable Threat Intelligence Director using REST APIs

Enable Rapid Threat Containment using STIX and TAXII

15. What is a feature of Cisco AMP private cloud?

It supports anonymized retrieval of threat intelligence

It supports security intelligence filtering.

It disables direct connections to the public cloud.

It performs dynamic analysis

16. An engineer has been tasked with using Cisco FMC to determine if files being sent through the network are malware.

Which two configuration tasks must be performed to achieve this file lookup? (Choose two.)

The Cisco FMC needs to include a SSL decryption policy.

The Cisco FMC needs to connect to the Cisco AMP for Endpoints service.

The Cisco FMC needs to connect to the Cisco ThreatGrid service directly for sandboxing.

The Cisco FMC needs to connect with the FireAMP Cloud.

The Cisco FMC needs to include a file inspection policy for malware lookup.

17. An organization is using a Cisco FTD and Cisco ISE to perform identity-based access controls. A network administrator is analyzing the Cisco FTD events and notices that unknown user traffic is being allowed through the firewall.

How should this be addressed to block the traffic while allowing legitimate user traffic?

Modify the Cisco ISE authorization policy to deny this access to the user.

Modify Cisco ISE to send only legitimate usernames to the Cisco FT

Add the unknown user in the Access Control Policy in Cisco FT

Add the unknown user in the Malware & File Policy in Cisco FT

18. An engineer is restoring a Cisco FTD configuration from a remote backup using the command restore remote-manager-backup location 1.1.1.1 admin /volume/home/admin BACKUP_Cisc394602314.zip on a Cisco FMG. After connecting to the repository, an error occurred that prevents the FTD device from accepting the backup file.

What is the problem?

The backup file is not in .cfg format.

The backup file is too large for the Cisco FTD device

The backup file extension was changed from tar to zip

The backup file was not enabled prior to being applied

19. A network engineer is logged into the Cisco AMP for Endpoints console and sees a malicious verdict for an identified SHA-256 hash.

Which configuration is needed to mitigate this threat?

Add the hash to the simple custom deletion list.

Use regular expressions to block the malicious file.

Enable a personal firewall in the infected endpoint.

Add the hash from the infected endpoint to the network block list.

20. A network engineer implements a new Cisco Firepower device on the network to take advantage of its intrusion detection functionality. There is a requirement to analyze the traffic going across the device, alert on any malicious traffic, and appear as a bump in the wire.

How should this be implemented?

Specify the BVl IP address as the default gateway for connected devices.

Enable routing on the Cisco Firepower

Add an IP address to the physical Cisco Firepower interfaces.

Configure a bridge group in transparent mode.

Page 2 of 3

21. An organization has a Cisco IPS running in inline mode and is inspecting traffic for malicious activity.

When traffic is received by the Cisco IRS, if it is not dropped, how does the traffic get to its destination?

It is retransmitted from the Cisco IPS inline set.

The packets are duplicated and a copy is sent to the destination.

It is transmitted out of the Cisco IPS outside interface.

It is routed back to the Cisco ASA interfaces for transmission.

22. A network administrator is concerned about (he high number of malware files affecting users' machines.

What must be done within the access control policy in Cisco FMC to address this concern?

Create an intrusion policy and set the access control policy to block.

Create an intrusion policy and set the access control policy to allow.

Create a file policy and set the access control policy to allow.

Create a file policy and set the access control policy to block.

23. An engineer is investigating connectivity problems on Cisco Firepower that is using service group tags. Specific devices are not being tagged correctly, which is preventing clients from using the proper policies when going through the firewall.

How is this issue resolved?

Use traceroute with advanced options.

Use Wireshark with an IP subnet filter.

Use a packet capture with match criteria.

Use a packet sniffer with correct filtering

24. A connectivity issue is occurring between a client and a server which are communicating through a Cisco Firepower device While troubleshooting, a network administrator sees that traffic is reaching the server, but the client is not getting a response.

Which step must be taken to resolve this issue without initiating traffic from the client?

Use packet-tracer to ensure that traffic is not being blocked by an access list.

Use packet capture to ensure that traffic is not being blocked by an access list.

Use packet capture to validate that the packet passes through the firewall and is NATed to the corrected IP address.

Use packet-tracer to validate that the packet passes through the firewall and is NATed to the corrected IP address.

25. An organization must be able to ingest NetFlow traffic from their Cisco FTD device to Cisco Stealthwatch for behavioral analysis.

What must be configured on the Cisco FTD to meet this requirement?

flexconfig object for NetFlow

interface object to export NetFlow

security intelligence object for NetFlow

variable set object for NetFlow

26. An engineer is tasked with deploying an internal perimeter firewall that will support multiple DMZs Each DMZ has a unique private IP subnet range.

How is this requirement satisfied?

Deploy the firewall in transparent mode with access control policies.

Deploy the firewall in routed mode with access control policies.

Deploy the firewall in routed mode with NAT configured.

Deploy the firewall in transparent mode with NAT configured.

27. An engineer must build redundancy into the network and traffic must continuously flow if a redundant switch in front of the firewall goes down.

What must be configured to accomplish this task?

redundant interfaces on the firewall cluster mode and switches

redundant interfaces on the firewall noncluster mode and switches

vPC on the switches to the interface mode on the firewall duster

vPC on the switches to the span EtherChannel on the firewall cluster

28. What is the advantage of having Cisco Firepower devices send events to Cisco Threat Response via the security services exchange portal directly as opposed to using syslog?

All types of Cisco Firepower devices are supported.

An on-premises proxy server does not need to be set up and maintained.

Cisco Firepower devices do not need to be connected to the Internet.

Supports all devices that are running supported versions of Cisco Firepower.

29. A network administrator notices that remote access VPN users are not reachable from inside the network. It is determined that routing is configured correctly, however return traffic is entering the firewall but not leaving it.

What is the reason for this issue?

A manual NAT exemption rule does not exist at the top of the NAT table.

An external NAT IP address is not configured.

An external NAT IP address is configured to match the wrong interface.

An object NAT exemption rule does not exist at the top of the NAT table.

30. An engineer must configure high availability for the Cisco Firepower devices. The current network topology does not allow for two devices to pass traffic concurrently.

How must the devices be implemented in this environment?

in active/active mode

in a cluster span EtherChannel

in active/passive mode

in cluster interface mode

31. When deploying a Cisco ASA Firepower module, an organization wants to evaluate the contents of the traffic without affecting the network. It is currently configured to have more than one instance of the same device on the physical appliance.

Which deployment mode meets the needs of the organization?

inline tap monitor-only mode

passive monitor-only mode

passive tap monitor-only mode

inline mode

32. A network administrator notices that inspection has been interrupted on all non-managed interfaces of a device.

What is the cause of this?

The value of the highest MTU assigned to any non-management interface was changed.

The value of the highest MSS assigned to any non-management interface was changed.

A passive interface was associated with a security zone.

Multiple inline interface pairs were added to the same inline interface.

33. An administrator is creating interface objects to better segment their network but is having trouble adding interfaces to the objects.

What is the reason for this failure?

The interfaces are being used for NAT for multiple networks.

The administrator is adding interfaces of multiple types.

The administrator is adding an interface that is in multiple zones.

The interfaces belong to multiple interface groups.

34. Which two conditions must be met to enable high availability between two Cisco FTD devices? (Choose two.)

same flash memory size

same NTP configuration

same DHCP/PPoE configuration

same host name

same number of interfaces

35. A network administrator is configuring Snort inspection policies and is seeing failed deployment messages in Cisco FMC.

What information should the administrator generate for Cisco TAC to help troubleshoot?

A "show tech" file for the device in question.

A "troubleshoot" file for the device in question.

A "troubleshoot" file for the Cisco FM

A "show tech" for the Cisco FM

36. An engineer is building a new access control policy using Cisco FMC. The policy must inspect a unique IPS policy as well as log rule matching.

Which action must be taken to meet these requirements?

Configure an IPS policy and enable per-rule logging.

Disable the default IPS policy and enable global logging.

Configure an IPS policy and enable global logging.

Disable the default IPS policy and enable per-rule logging.

37. A network administrator needs to create a policy on Cisco Firepower to fast-path traffic to avoid Layer 7 inspection. The rate at which traffic is inspected must be optimized.

What must be done to achieve this goal?

Enable the FXOS for multi-instance.

Configure a prefilter policy.

Configure modular policy framework.

Disable TCP inspection.

38. A network engineer is tasked with minimising traffic interruption during peak traffic limes.

When the SNORT inspection engine is overwhelmed, what must be configured to alleviate this issue?

Enable IPS inline link state propagation

Enable Pre-filter policies before the SNORT engine failure.

Set a Trust ALL access control policy.

Enable Automatic Application Bypass.

39. A VPN user is unable to conned lo web resources behind the Cisco FTD device terminating the connection. While troubleshooting, the network administrator determines that the DNS responses are not getting through the Cisco FTD.

What must be done to address this issue while still utilizing Snort IPS rules?

Uncheck the "Drop when Inline" box in the intrusion policy to allow the traffic.

Modify the Snort rules to allow legitimate DNS traffic to the VPN users.

Disable the intrusion rule threshes to optimize the Snort processing.

Decrypt the packet after the VPN flow so the DNS queries are not inspected

40. An organization has a Cisco FTD that uses bridge groups to pass traffic from the inside interfaces to the outside interfaces. They are unable to gather information about neighbouring Cisco devices or use multicast in their environment.

What must be done to resolve this issue?

Create a firewall rule to allow CDP traffic.

Create a bridge group with the firewall interfaces.

Change the firewall mode to transparent.

Change the firewall mode to routed.

Page 3 of 3

41. Which CLI command is used to control special handling of ClientHello messages?

system support ssl-client-hello-tuning

system support ssl-client-hello-display

system support ssl-client-hello-force-reset

system support ssl-client-hello-reset

42. Which command is typed at the CLI on the primary Cisco FTD unit to temporarily stop running high-availability?

configure high-availability resume

configure high-availability disable

system support network-options

configure high-availability suspend

43. Which command must be run to generate troubleshooting files on an FTD?

system support view-files

sudo sf_troubleshoot.pl

system generate-troubleshoot all

show tech-support

44. When do you need the file-size command option during troubleshooting with packet capture?

when capture packets are less than 16 MB

when capture packets are restricted from the secondary memory

when capture packets exceed 10 GB

when capture packets exceed 32 MB

45. What is a functionality of port objects in Cisco FMC?

to mix transport protocols when setting both source and destination port conditions in a rule

to represent protocols other than TCP, UDP, and ICMP

to represent all protocols in the same way

to add any protocol other than TCP or UDP for source port conditions in access control rules.

46. Within Cisco Firepower Management Center, where does a user add or modify widgets?

dashboard

reporting

context explorer

summary tool

47. A network engineer is configuring URL Filtering on Firepower Threat Defense.

Which two port requirements on the Firepower Management Center must be validated to allow communication with the cloud service? (Choose two.)

outbound port TCP/443

inbound port TCP/80

outbound port TCP/8080

inbound port TCP/443

outbound port TCP/80

48. What is the maximum bit size that Cisco FMC supports for HTTPS certificates?

1024

8192

4096

2048

49. Which limitation applies to Cisco Firepower Management Center dashboards in a multidomain environment?

Child domains can view but not edit dashboards that originate from an ancestor domain.

Child domains have access to only a limited set of widgets from ancestor domains.

Only the administrator of the top ancestor domain can view dashboards.

Child domains cannot view dashboards that originate from an ancestor domain.

50. Which two statements about deleting and re-adding a device to Cisco FMC are true? (Choose two.)

An option to re-apply NAT and VPN policies during registration is available, so users do not need to re-apply the policies after registration is completed.

Before re-adding the device in Cisco FMC, you must add the manager back in the device.

No option to delete and re-add a device is available in the Cisco FMC web interface.

The Cisco FMC web interface prompts users to re-apply access control policies.

No option to re-apply NAT and VPN policies during registration is available, so users need to reapply the policies after registration is completed.

51. What is a behavior of a Cisco FMC database purge?

User login and history data are removed from the database if the User Activity check box is selected.

Data can be recovered from the device.

The appropriate process is restarted.

The specified data is removed from Cisco FMC and kept for two weeks.

52. Which two packet captures does the FTD LINA engine support? (Choose two.)

Layer 7 network ID

source IP

application ID

dynamic firewall importing

protocol

53. Which two features of Cisco AMP for Endpoints allow for an uploaded file to be blocked? (Choose two.)

application blocking

simple custom detection

file repository

exclusions

application whitelisting

54. Which action should you take when Cisco Threat Response notifies you that AMP has identified a file as malware?

Add the malicious file to the block list.

Send a snapshot to Cisco for technical support.

Forward the result of the investigation to an external threat-analysis engine.

Wait for Cisco Threat Response to automatically block the malware.

55. Which Cisco Advanced Malware Protection for Endpoints policy is used only for monitoring endpoint actively?

Windows domain controller

audit

triage

protection

56. What is a valid Cisco AMP file disposition?

non-malicious

malware

known-good

pristine

57. In a Cisco AMP for Networks deployment, which disposition is returned if the cloud cannot be reached?

unavailable

unknown

clean

disconnected

58. Which two remediation options are available when Cisco FMC is integrated with Cisco ISE? (Choose two.)

dynamic null route configured

DHCP pool disablement

quarantine

port shutdown

host shutdown

59. Which connector is used to integrate Cisco ISE with Cisco FMC for Rapid Threat Containment?

pxGrid

FTD RTC

FMC RTC

ISEGrid

60. What is the maximum SHA level of filtering that Threat Intelligence Director supports?

SHA-1024

SHA-4096

SHA-512

SHA-256

300-710 SNCF – Concentration Exam of CCNP Security Certification

300-710 SNCF – Concentration Exam of CCNP Security Certification

Share this post

Leave a Reply Cancel reply

Related Posts