Replace 300-710 Samples For Securing Networks With Cisco Firepower (SNCF) Certification

NEW QUESTION 1

Which two conditions are necessary for high availability to function between two Cisco FTD devices? (Choose two.)

• A. The units must be the same version
• B. Both devices can be part of a different group that must be in the same domain when configured within the FMC.
• C. The units must be different models if they are part of the same series.
• D. The units must be configured only for firewall routed mode.
• E. The units must be the same model.

Answer: AE

Explanation:
Reference: https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699- configure-ftd-high-availability-on-firep.html

NEW QUESTION 2

A company has many Cisco FTD devices managed by a Cisco FMC. The security model requires that access control rule logs be collected for analysis. The security engineer is concerned that the Cisco FMC will not be able to process the volume of logging that will be generated. Which configuration addresses this concern?

• A. Send Cisco FTD connection events and security events directly to SIEM system for storage and analysis.
• B. Send Cisco FTD connection events and security events to a cluster of Cisco FMC devices for storage and analysis.
• C. Send Cisco FTD connection events and security events to Cisco FMC and configure it to forward logs to SIEM for storage and analysis.
• D. Send Cisco FTD connection events directly to a SIEM system and forward security events from Cisco FMC to the SIEM system for storage and analysis.

Answer: C

NEW QUESTION 3

A Cisco FMC administrator wants to configure fastpathing of trusted network traffic to increase performance. In which type of policy would the administrator configure this feature?

• A. Identity policy
• B. Prefilter policy
• C. Network Analysis policy
• D. Intrusion policy

Answer: B

NEW QUESTION 4

What is the advantage of having Cisco Firepower devices send events to Cisco Threat Response via the security services exchange portal directly as opposed to using syslog?

• A. All types of Cisco Firepower devices are supported.
• B. An on-premises proxy server does not need to be set up and maintained.
• C. Cisco Firepower devices do not need to be connected to the Internet.
• D. Supports all devices that are running supported versions of Cisco Firepower.

Answer: B

NEW QUESTION 5

Which object type supports object overrides?

• A. time range
• B. security group tag
• C. network object
• D. DNS server group

Answer: C

Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide- v60/Reusable_Objects.html#concept_8BFE8B9A83D742D9B647A74F7AD50053

NEW QUESTION 6

An administrator is configuring their transparent Cisco FTD device to receive ERSPAN traffic from multiple switches on a passive port, but the Cisco FTD is not processing the traffic. What is the problem?

• A. The switches do not have Layer 3 connectivity to the FTD device for GRE traffic transmission.
• B. The switches were not set up with a monitor session ID that matches the flow ID defined on the CiscoFTD.
• C. The Cisco FTD must be in routed mode to process ERSPAN traffic.
• D. The Cisco FTD must be configured with an ERSPAN port not a passive port.

Answer: C

NEW QUESTION 7

A security engineer must integrate an external feed containing STIX/TAXII data with Cisco FMC. Which feature must be enabled on the Cisco FMC to support this connection?

• A. Cisco Success Network
• B. Cisco Secure Endpoint Integration
• C. Threat Intelligence Director
• D. Security Intelligence Feeds

Answer: C

NEW QUESTION 8

A network administrator has converted a Cisco FTD from using LDAP to LDAPS for VPN authentication. The Cisco FMC can connect to the LDAPS server, but the Cisco FTD is not connecting. Which configuration must be enabled on the Cisco FTD?

• A. SSL must be set to a use TLSv1.2 or lower.
• B. The LDAPS must be allowed through the access control policy.
• C. DNS servers must be defined for name resolution.
• D. The RADIUS server must be defined.

Answer: B

NEW QUESTION 9

A network engineer is logged into the Cisco AMP for Endpoints console and sees a malicious verdict for an identified SHA-256 hash. Which configuration is needed to mitigate this threat?

• A. Use regular expressions to block the malicious file.
• B. Add the hash from the infected endpoint to the network block list.
• C. Add the hash to the simple custom detection list.
• D. Enable a personal firewall in the infected endpoint.

Answer: C

NEW QUESTION 10

Remote users who connect via Cisco AnyConnect to the corporate network behind a Cisco FTD device report that they get no audio when calling between remote users using their softphones. These same users can call internal users on the corporate network without any issues. What is the cause of this issue?

• A. The hairpinning feature is not available on FTD.
• B. Split tunneling is enabled for the Remote Access VPN on FTD
• C. FTD has no NAT policy that allows outside to outside communication
• D. The Enable Spoke to Spoke Connectivity through Hub option is not selected on FTD.

Answer: A

NEW QUESTION 11

A network administrator notices that inspection has been interrupted on all non-managed interfaces of a device. What is the cause of this?

• A. The value of the highest MTU assigned to any non-management interface was changed.
• B. The value of the highest MSS assigned to any non-management interface was changed.
• C. A passive interface was associated with a security zone.
• D. Multiple inline interface pairs were added to the same inline interface.

Answer: A

NEW QUESTION 12

Refer to the exhibit.

An organization has an access control rule with the intention of sending all social media traffic for inspection After using the rule for some time, the administrator notices that the traffic is not being inspected, but is being automatically allowed What must be done to address this issue?

• A. Modify the selected application within the rule
• B. Change the intrusion policy to connectivity over security.
• C. Modify the rule action from trust to allow
• D. Add the social network URLs to the block list

Answer: A

NEW QUESTION 13

An engineer defines a new rule while configuring an Access Control Policy. After deploying the policy, the rule is not working as expected and the hit counters associated with the rule are showing zero. What is causing this error?

• A. Logging is not enabled for the rule.
• B. The rule was not enabled after being created.
• C. The wrong source interface for Snort was selected in the rule.
• D. An incorrect application signature was used in the rule.

Answer: B

NEW QUESTION 14

How many report templates does the Cisco Firepower Management Center support?

• A. 20
• B. 10
• C. 5
• D. unlimited

Answer: D

Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide- v60/Working_with_Reports.html

NEW QUESTION 15

An engineer is creating an URL object on Cisco FMC How must it be configured so that the object will match for HTTPS traffic in an access control policy?

• A. Specify the protocol to match (HTTP or HTTPS).
• B. Use the FQDN including the subdomain for the website
• C. Define the path to the individual webpage that uses HTTPS.
• D. Use the subject common name from the website certificate

Answer: B

NEW QUESTION 16

Which policy rule is included in the deployment of a local DMZ during the initial deployment of a Cisco NGFW through the Cisco FMC GUI?

• A. a default DMZ policy for which only a user can change the IP addresses.
• B. deny ip any
• C. no policy rule is included
• D. permit ip any

Answer: C

NEW QUESTION 17

A mid-sized company is experiencing higher network bandwidth utilization due to a recent acquisition The network operations team is asked to scale up their one Cisco FTD appliance deployment to higher capacities due to the increased network bandwidth. Which design option should be used to accomplish this goal?

• A. Deploy multiple Cisco FTD appliances in firewall clustering mode to increase performance.
• B. Deploy multiple Cisco FTD appliances using VPN load-balancing to scale performance.
• C. Deploy multiple Cisco FTD HA pairs to increase performance
• D. Deploy multiple Cisco FTD HA pairs in clustering mode to increase performance

Answer: A

NEW QUESTION 18

An organization wants to secure traffic from their branch office to the headquarter building using Cisco Firepower devices, They want to ensure that their Cisco Firepower devices are not wasting resources on inspecting the VPN traffic. What must be done to meet these requirements?

• A. Configure the Cisco Firepower devices to ignore the VPN traffic using prefilter policies
• B. Enable a flexconfig policy to re-classify VPN traffic so that it no longer appears as interesting traffic
• C. Configure the Cisco Firepower devices to bypass the access control policies for VPN traffic.
• D. Tune the intrusion policies in order to allow the VPN traffic through without inspection

Answer: C

Explanation:
When you configure the Cisco Firepower devices to bypass the access control policies for VPN traffic, the devices will not inspect the VPN traffic and thus will not waste resources on it. This is the best option to ensure that the VPN traffic is not wasting resources on the Cisco Firepower devices.
Reference:
https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/219759-configure-bypass-policies-on-the

NEW QUESTION 19
......