Cisco 300-710 SNCF Exam Questions Instant Access

Question 1

A network administrator needs to create a policy on Cisco Firepower to fast-path traffic to avoid Layer 7 inspection. The rate at which traffic is inspected must be optimized. What must be done to achieve this goal?

AEnable lhe FXOS for multi-instance.

BConfigure a prefilter policy.

CConfigure modular policy framework.

DDisable TCP inspection.

Answer : B

Question 2

What is the advantage of having Cisco Firepower devices send events to Cisco Threat Response via the security services exchange portal directly as opposed to using syslog?

AAll types of Cisco Firepower devices are supported.

BAn on-premises proxy server does not need to be set up and maintained.

CCisco Firepower devices do not need to be connected to the Internet.

DSupports all devices that are running supported versions of Cisco Firepower.

Answer : B

Question 3

A security engineer needs to configure a network discovery policy on a Cisco FMC appliance and prevent excessive network discovery events from overloading the FMC database? Which action must be taken to accomplish this task?

AChange the network discovery method to TCP/SYN.

BConfigure NetFlow exporters for monitored networks.

CMonitor only the default IPv4 and IPv6 network ranges.

DExclude load balancers and NAT devices in the policy.

Answer : D

Question 4

An engineer must configure an inline set on a Cisco Secure IPS by using the Cisco Secure Firewall Management Center. The inline set must make a copy of each packet before analyzing the packet and block any connections that do not complete the three-way handshake. These configurations have been performed already:

Select and enable the interfaces that will be added to the inline set.

Configure the speed and duplex.

Configure the inline set and add the interfaces to the inline set.

Which action completes the task?

ASet Tap Mode to Inline.

BConfigure Snort Fail Open.

CConfigure Link State Propagation.

DImplement Strict TCP Enforcement.

Answer : D

Question 5

An engineer is configuring two new Cisco Secure Firewall Threat Defense appliances as a high-availability pair. The high-availability pair must detect a failure on the failover link and trigger failover more quickly. Which two settings must the engineer decrease? (Choose two.)

AInterface poll time

BPeer hold time

CInterface failure limit

DPeer poll time

EInterface hold time

Answer : B, D

Peer poll time controls how frequently one high-availability unit sends hello or polling messages to determine whether its peer remains responsive. Peer hold time specifies how long the appliance waits without receiving the expected peer communication before declaring that peer unavailable. Decreasing both values causes the appliances to test peer availability more frequently and wait less time before initiating failover. Interface-oriented timers are used to evaluate monitored data-interface failures and do not specifically accelerate detection of a failed failover link. Although shorter peer timers improve failover speed, excessively aggressive values can cause false failovers during congestion or high CPU utilization. Cisco explains that threat defense appliances monitor peer health through hello messages on the failover link and begin additional testing after consecutive messages are missed. Cisco Secure Firewall high-availability monitoring

================

Question 6

An engineer is configuring Cisco Secure Firewall Threat Defense managed by a Secure Firewall Management Center appliance. The company wants remote access VPN users to be reachable from the inside network. What must the engineer configure to meet the requirements?

Amanual NAT exemption rule at the top of the NAT policy

Bmanual NAT exemption rule at the bottom of the NAT policy

Cauto NAT exemption rule at the top of the NAT policy

Dauto NAT exemption rule at the bottom of the NAT policy

Answer : A

Question 7

After deploying a network-monitoring tool to manage and monitor networking devices in your organization, you realize that you need to manually upload an MIB for the Cisco FMC. In which folder should you upload the MIB file?

A/etc/sf/DCMIB.ALERT

B/sf/etc/DCEALERT.MIB

C/etc/sf/DCEALERT.MIB

Dsystem/etc/DCEALERT.MIB

Answer : C

Cisco Securing Networks with Cisco Firewalls 300-710 SNCF Exam Questions