https://www.braindump2go.com/300-710.html https://www.braindump2go.com/300-710.html https://www.braindump2go.com/300-710.html QUESTION 361 Which component is needed to perform rapid threat containment with Cisco FMC? A ISE B. RESTful API C. SIEM D. DDI Answer: A Explanation: To perform rapid threat containment with Cisco FMC, the necessary component is Cisco Identity Services Engine (ISE). ISE integrates with FMC to provide dynamic network access control and enforcement, allowing for quick isolation of compromised endpoints based on security events detected by FMC. Steps: Integrate FMC with ISE by configuring the necessary settings in both platforms. Define security policies in FMC that trigger rapid threat containment actions via ISE. When a threat is detected, FMC can instruct ISE to isolate the affected endpoint, limiting its access to the network. This integration enables automated and efficient threat containment, reducing the response time and mitigating the impact of security incidents. QUESTION 362 Which action must be taken to permit communication between a bridge group and routed interface on Cisco Secure Firewall? A. Define a source NAT address. B. Create an access rule to allow the traffic. C. Enabl e split tunneling. D. Create an ACL for the bridge group. Answer: B QUESTION 363 An engineer is deploying a Cisco ASA Secure Firewall module. The engineer must be able to examine traffic without impacting the network, and the ASA has been deployed with a single context. Which ASA Secure Firewall module deployment mode must be implemented to meet the requirements? A. routed mode with inline tap monitor - only mode B. transparent mode with passive monitor - only mode C. transparent mode with inline tap mon itor - only mode D. routed mode with passive monitor - only mode Answer: B Explanation: In this scenario, the engineer’s requirement is to inspect traffic without impacting the network. To meet this, the passive m onitor-only mode is an appropriate choice: - Transparent Mode: In this mode, the Cisco ASA acts as a "bump in the wire," making it effectively invisible to the network. This mode does not require IP addresses on the interfaces, allowing it to inspect traffic without altering or routing it, making it ideal for passive monitoring scenarios. - Passive Monitor-Only Mode: This mode is specifically designed to allow traffic inspection without interference. Traffic flows through the device, allowing it to inspect packets but without enforcing policies or disrupting packet flow, which is crucial to meet the requirement of "no network impact." - Single Context Requirement: The setup specifies a single context, which simplifies the deployment by using one consistent inspection policy across the traffic. QUESTION 364 An engineer is setting up a new Cisco Secure Firewall Threat Defense appliance to replace the current firewall. The company requests that inline sets be used and that when one interface in an inline set goes down, the second interface in the inline set goes down. What must the engineer configure to meet the deployment https://www.braindump2go.com/300-710.html requirements? A. propagate link state B. Snort fail open C. inline tap mode D. strict TCP enforcement Answer: A Explanation: In Cisco Secure Firewall Threat Defense deployments, propagate link state is a feature designed to manage interface behavior in inline sets. When inline sets are used, the network often requires that both interfaces in the set behave consistently; if one interface in the pair goes down, the other should automatically go down to prevent asymmetric routing or network issues. The Propagate Link State setting ensures that when one interface in an inline set experiences a failure, the paired interface automatically reflects that down status. This is critical in setups where symmetry and failover are essential, especially in high-availability or redundant network designs. QUESTION 365 An engineer must implement Cisco Secure Firewall transparent mode due to a new server recently being added that must communicate with an existing server that is currently separated by the firewall. Which implementation action must be taken next by the engineer to accomplish the goal? A. Configure the same default gateway for both servers. B. Ensure that both servers are in the same br idge domain. C. Enable both servers to share the same VXLAN segment. D. Assign the same subnet to both servers. Answer: B Explanation: In transparent mode, Cisco Secure Firewall Threat Defense (FTD) operates as a Layer 2 firewall, acting as a "bump in the wire" without performing routing functions. This mode allows devices on either side of the firewall to communicate as if they were on the same network. To achieve this, the firewall typically uses bridge domains or similar configurations to group devices. A bridge domain groups interfaces in transparent mode so that devices on each side of the firewall can communicate directly. Ensuring that both servers are in the same bridge domain allows traffic to pass through the firewall transparently, enabling communication between the two servers as if the firewall were not there. QUESTION 366 Refer to the exhibit. An engineer is configuring a high-availability solution that has the hardware devices and software versions: - two Cisco Secure Firewall 9300 Security Appliances with FXOS SW 2.0(1.23) - one Cisco Secure Firewall Threat Defense with 6.0 1 1 (build 1023) - one Cisco Secure Firewall Management Center with SW 6 0.1.1 (build 1023) Which condition must be met to complete the high-availability configuration? A. Both firewalls must be in transparent mode B. The version numbers must have the same patch number C. DHCP must be configured on at least one firewall interface. D. Both firewalls must have the same number of interfaces Answer: D Explanation: In a high-availability (HA) setup for Cisco Secure Firewall devices, both firewalls in the HA pair must have identical configurations, which includes having the same number of interfaces with matching names, IP addresses, and settings. This requirement ensures that both devices can function seamlessly as primary and secondary units, allowing for smooth failover without configuration mismatches. https://www.braindump2go.com/300-710.html For HA to work properly, each firewall must have the same interface configuration to ensure that both units can handle traffic in the same way when a failover event occurs. If the primary device fails, the secondary device needs to have identical interface configurations to take over immediately. QUESTION 367 An engineer is deploying a Cisco Secure Firewall Management Center appliance. The company must send data to Cisco Secure Network Analytics appliances. Which two actions must the engineer take? (Choose two.) A. Create a service identifier to enable the NetFlow service. B. Add the Netflow_Send_Destination object to the configuration. C. Add the Netflow_Set_Parameters object to the configuration. D. Add the Netflow_Add_Destination object to the configuration. E. Security Intelligence object to send data to Cisco Secure Network Analytics Answer: CD Explanation: https://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/netflow/216126-configure-netflow-secure-event-logging- o.html#:~:text=The%20four%20predefined%20objects%20are%20listed%20in%20the%20table%3A QUESTION 368 A network administrator is trying to configure a previously created file policy on a new access policy. Which action must the administrator take before applying the file policy? A. Create a new access control rule. B. Apply an application to an access control rule. C. Set up an inspection policy. D. Assign the file policy to the default action. Answer: A Explanation: In Cisco Firepower, file policies are used to inspect and control files within the network traffic based on specific rules. To apply a file policy to traffic effectively, it must be associated with an access control rule within an access policy. File policies cannot be applied independently; they must be integrated into access control rules. These rules specify how traffic should be treated, allowing the administrator to control file-based actions, such as allowing, blocking, or tracking files within network traffic. Once the access control rule is created, the administrator can specify conditions, such as the file type and file disposition (clean, malware, unknown, etc.), and attach the file policy to control these files accordingly. QUESTION 369 A security engineer must add a new policy to block UDP traffic to one server. The engineer adds a new object. Which action must the engineer take next to identify all the UDP ports? A. Specify the transport protocol and leave the port number empty. B. Define the transport protocol and the mandatory port range. C. Add the transport number and specify the type and code. D. Add the corresponding IP protocol number for UDP and TCP. Answer: A Explanation: When creating an access rule or object to block all UDP traffic to a server, specifying the transport protocol as UDP without defining any specific port number effectively matches all UDP ports. This means the rule will apply to all UDP traffic regardless of port number. QUESTION 370 Refer to the exhibit. An engineer is configuring access control rules on a Cisco Secure Firewall Threat Defense device. The access control rules must include a file policy with rules that will trigger when MSEXE files are accessed. Which two actions must be configured in the access rule? (Choose two.) A. block files with reset B. interactive block C. monitor D. allow https://www.braindump2go.com/300-710.html E. trust Answer: AC Explanation: The first row in the exhibit shows an action for MSEXE files set to "Block Files with Reset". This action will block the MSEXE files and send a TCP reset to terminate the connection, effectively preventing the files from being accessed or downloaded. The second row shows an action for MSEXE files set to "Detect Files". This is essentially a monitoring action that allows the system to log and detect MSEXE file access events without blocking them. In this configuration, combining "Block Files with Reset" and "Detect Files" enables both blocking specific actions and monitoring file access, providing comprehensive control and visibility for MSEXE files. QUESTION 371 An engineer must deny ICMP traffic to the networks of separate departments that use Cisco Secure Firewall Management Center. The engineer must use the same object on the relevant device for each network. What must be configured in Secure Firewall Management Center? A. Allow Overrides check box B. IP address C. Deny ICMP check box D. IP range Answer: A Explanation: In Cisco Secure Firewall Management Center (FMC), if an engineer needs to apply the same object across multiple devices or networks but may want to configure specific settings for each device or network, they can use the "Allow Overrides" option. When the Allow Overrides checkbox is selected, it enables flexibility by allowing the object to have different configurations or values on different devices while still being centrally managed. This is useful when a single object is applied across multiple networks, as it lets the engineer tailor the settings for each department while maintaining consistency in object management. QUESTION 372 Refer to the exhibit. An engineer is deploying a new instance of Cisco Secure Firewall Threat Defense. Which action must the engineer take next so that Client_A and Client_B receive an IP address via DHCP from Server_A? A. Disable all the DHCP Snort rules by using Secure Firewall Device Manager. B. Add another DHCP pool on Server_A with DHCP relay on Secure Firewall Threat Defense. C. Disable Optio n 82 in the DHCP relay configuration properties using Secure Firewall Management Center. D. Add access rules that allow DHCP traffic by using Cisco Secure Firewall Management Center. Answer: D Explanation: For features that are not directly supported on the transparent firewall, you can allow traffic to pass through so that upstream and downstream routers can support the functionality. For example, by using an access rule, you can allow DHCP traffic (instead of the unsupported DHCP relay feature) or multicast traffic such as that created by IP/TV. https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide- v70/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html QUESTION 373 A VPN administrator converted an instance of Cisco Secure Firewall Threat Defense, which is managed by Cisco Secure Firewall Management Center, from using LDAP to LDAPS for remote access VPN authentication. Which certificate must be added to allow for remote users to authenticate over the VPN? A. Secure Firewall Threat Defense certificate must be added to the LDAPS server B. LDAPS server certificate must be added to Secure Firewall Management Center realms C. Secure Firewall Management Center certificate must be added to the LDA PS server D. LDAPS server certificate must be added to Secure Firewall Threat Defense https://www.braindump2go.com/300-710.html Answer: B Explanation: Import the Root CA Certificate that has signed the LDAPS service Certificate on the Windows Server under Objects > PKI > Trusted CAs > Add Trusted CA, as this is referenced under theDirectory Server Configuration of the Realm https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client-v4x/220880-configure-password-management-using-ldap.html#toc- hId--2065014694 QUESTION 374 A network administrator is configuring a transparent Cisco Secure Firewall Threat Defense registered to a Cisco Secure Firewall Management Center. The administrator wants to configure the Secure Firewall Threat Defense to allow ARP traffic to pass between two interfaces of a bridge group. What must be configured? A. Use the default configuration on the devices. B. An access policy must allow MAC address 0100.0CCC.CCCD. C. ARP inspection must be disabled. D. An access policy must allow MAC address FFF F.FFFF.FFFF. Answer: A Explanation: By default, all ARP packets are passed within the bridge group. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/device-ops- tfw.html QUESTION 375 A network administrator manages a network with multiple firewalls in a data center. The administrator must change a next-generation firewall from routed to transparent mode. Which action must the administrator take to meet the requirement? A Deregister the firewall in Cisco Secure Firewall Management Center. B. Enter the configure firewall transparent command from the CLI. C. Manually delete the interface configuration from the CLI. D. Create one or more bridge groups from the CLI. Answer: A Explanation: Step 1. Deregister the Firepower Threat Defense device from the FMC. Step 2. Access the Firepower Threat Defense device CLI, preferably from the console port. Step 3. > configure firewall [routed | transparent] Step 4. Re-register with the FMC https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide- v70/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html QUESTION 376 A security engineer sees an alert on Cisco Secure Endpoint console showing a malicious verdict for a file with the SHA-256 hash 0488537078abcdef048853abcdef048853abcdef048853abcdef048853abcdef048853. Which step will mitigate this threat? A. Add the hash to network block list. B. Quarantine the file on endpoint. C. Add the hash to custom detection list. D. Enable firewall on infected endpoint. Answer: C Explanation: Custom Detection List > Simple 1. On the Add SHA-256 option, paste the SHA-256 code previously collected from the specific file you want to block 2. Once the Simple Custom Detection list is generated, navigate to Management > Policies and choose the policy where you want to apply the list previously created https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215176-configure-a-simple-custom-detection-list.html QUESTION 377 An engineer must configure and generate a report in Cisco Secure Firewall Management Center. The report must allow for the addition of headers and footers, and it will contain many pages. Which format must the engineer configure the report to use? A. pdf B. xls C. xml https://www.braindump2go.com/300-710.html D. doc Answer: A Explanation: A report is a document file formatted in PDF, HTML, or CSV. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/740/management-center-admin-74/report-reports.html QUESTION 378 An engineer must investigate a connectivity issue by using Cisco Secure Firewall Management Center to access the Packet Capture feature on a Cisco Secure Firewall Threat Defense device. The engineer must see a real packet going through the Secure Firewall Threat Defense device and the Snort detection actions. While reviewing the packet capture, the engineer discovers that the Snort detection actions are missing. Which action must the engineer take to resolve the issue? A. Enable the Continuous Capture option. B. Enable the Trace option. C. Specify the packet size. D. Specify the buffer size. Answer: B Explanation: Select Trace if you want to capture the details for each packet. https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/troubleshooting_the_system.html QUESTION 379 An engineer is deploying failover capabilities for a pair of Cisco Secure Firewall devices. The core switch keeps the MAC address of the previously active unit in the ARP table. Which action must the engineer take to minimize downtime and ensure that network users keep access to the internet after a Cisco Secure Firewall failover? A. Use a virtual MAC address on both units B. Add the MAC addre ss to the switch ARP table. C. Set the same MAC address on both units. D. Run a script to send gratuitous ARP after a failover. Answer: A Explanation: When deploying failover capabilities for a pair of Cisco Secure Firewalls (often using the High Avail ability (HA) feature), it’s important that the MAC address seen by the network doesn't change during a failover. Using a virtual MAC address ensures that the same MAC address is presented to the network, regardless of which firewall unit (active or standby) is in control. This minimizes downtime because the core switch will continue to route traffic to the correct unit, as the virtual MAC address remains constant. QUESTION 380 An engineer must deploy a Cisco Secure Firewall Threat Defense instance. The company wants the Secure Firewall Threat Defense deployment to allow business traffic in the event of any type of failure, and there must be no connectivity issues caused by the IPS in the perimeter of its data center. Which implementation mode must the engineer use? A. hardware bypass B. Snort fail open C. inline set D. passive Answer: B Explanation: The Snort fail open mode is used in Cisco Secure Firewall Threat Defense to ensure that business traffic is allowed to pass through the firewall even if there is a failure in the IPS functionality. This is particularly useful when an organization prioritizes uninterrupted traffic flow over security inspection during failures. When Snort (the intrusion prevention system) fails or becomes unavailable, fail-open mode bypasses the IPS processing, ensuring that legitimate business traffic continues to flow without interruption. QUESTION 381 Which firewall mode is Cisco Secure Firewall Threat Defense in when two physical interfaces are assigned to a named BVI? A. IPS only B. routed C. transparent D. in - line Answer: C https://www.braindump2go.com/300-710.html Explanation: The Cisco FTD configured with two physical interfaces assigned to a BVI and connected to different VLANs on the same switch is set up to support the transparent firewall mode. In transparent mode, the firewall operates at Layer 2, and does not modify the IP address or MAC address of the packets passing through it. In this mode, the firewall is transparent to the devices on either side of it, and can be inserted into the network without changing the IP addressing or topology. https://www.cisco.com/c/en/us/td/docs/security/cdo/cloud-delivered-firewall-management-center-in-cdo/managing-firewall-threat-defense-services-with-cisco- defense-orchestrator/m_device-ops-tfw.html QUESTION 382 A network administrator wants to configure a default policy to block malicious sites based on the requested URL lookup. Which feature meets the requirement? A. file policies B. malware policies C. DNS policies D. URL filtering policies Answer: D Explanation: URL filtering allows control over website access based on the URL's category and reputation, which includes blocking malicious or risky sites by inspecting the requested URL. This feature can use category and reputation-based filtering to automatically block URLs classified as malicious or high risk, fulfilling the requirement for a default blocking policy. URL filtering works by inspecting HTTP/HTTPS traffic and matching URLs against Cisco's URL database or manually configured URL lists. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/720/management-center-device-config-72/access-url- filtering.html QUESTION 383 An engineer must implement static route tracking on Cisco Secure Firewall Threat Defense and reroute traffic by using a backup path if the primary path fails. The engineer already defined the primary static route, and the primary path is already monitored. Which action must the engineer take to meet the requirement? A. Establish an IP SLA ICMP ech o request. B. Configure a tracking object for the static route C. Assign a unique tracking ID to the static route D. Configure a secondary static route that has higher precedence Answer: D Explanation: Create the backup static route that will be used if the primary route fails. This route must have a larger metric than the primary route. For example, if the primary route is 1, the backup route could be 10. You would also normally select a different interface for the backup route. https://www.cisco.com/c/en/us/td/docs/security/firepower/70/fdm/fptd-fdm-config-guide-700/fptd-fdm- routing.html#:~:text=Create%20the%20backup%20static%20route%20that%20will%20be%20used%20if%20the%20primary%20route%20fails.%20This%20route% 20must%20have%20a%20larger%20metric%20than%20the%20primary%20route.%20For%20example%2C%20if%20the%20primary%20route%20is%201%2C%20t he%20backup%20route%20could%20be%2010 QUESTION 384 A network engineer wants to disable the HTTP response page and interactive blocking of the entire access control policy in Cisco Secure Firewall Management Center. What must be selected in Block Response Page and Interactive Block Response Page? A. View B. Custom C. System D. None Answer: D Explanation: In Cisco Secure Firewall Management Center, to disable the HTTP response page and interactive blocking of the entire access control policy, the engineer must select None for both the Block Response Page and Interactive Block Response Page settings. This configuration prevents the firewall from displaying any HTTP response page or offering interactive blocking features when a policy action is triggered, such as blocking traffic based on access control rules. QUESTION 385 An engineer must reconfigure an NTP server on an IPSv device that is managed by using Cisco Secure Firewall Management Center. The engineer verified secure communications between Secure Firewall Management Center and the NTP server. How must the engineer perform the reconfiguration in Secure Firewall Management Center? A. Devices > Platform Settin gs > [assigned Secure Firewall Settings Policy] > Classic managed devices https://www.braindump2go.com/300-710.html B. Devices > Device Management > [NGIPSv device] > Device > System C. Devices > Platform Settings > [assigned Threat Defense Settings Policy] > Time Synchronization D. Devices > D evice Management > Time Synchronization Answer: C Explanation: To reconfigure an NTP server for an IPSv device managed via Cisco Secure Firewall Management Center (FMC), the engineer must modify the Platform Settings Policy assigned to the device. In this case, the Threat Defense Settings Policy under Platform Settings contains the configuration for Time Synchronization (NTP). From this section, the engineer can add, modify, or remove NTP servers used by the managed device. After the changes are made, the updated policy is deployed to the device to take effect. QUESTION 386 A network administrator is setting up a Cisco Secure Firewall Threat Defense to peer via BGP with two ISPs. The administrator wants traffic to certain IP ranges to prefer to come in one ISP instead of the other. What must be configured on the BGP connection to the peer to help facilitate the requirement? A. prefix list B. access list C. address map D. route map Answer: D Explanation: A route map is the appropriate mechanism to control BGP routing preferences. It allows the administrator to define policies that can influence route selection by modifying attributes such as weight, local preference, or AS path. To ensure traffic to specific IP ranges prefers one ISP over another, the administrator can configure a route map to manipulate BGP attributes for those routes, such as increasing the local preference for the desired ISP. QUESTION 387 A network administrator is configuring an instance of Cisco Secure Firewall Threat Defense, which is registered to Cisco Secure Firewall Management Center, to prevent internal users from downloading executable files from the internet. What must be created and configured by the administrator to meet the requirement? A. file policy that blocks down loads of all executable files and applies the file policy to the default action in the access policy B. access policy rule that allows users to reach the internet with a second rule that blocks application executables C. file policy rule that allows user s to reach the internet with a second rule applied that blocks application use of FTP D. access policy rule that allows users to reach the internet and assigns a file policy that blocks executable downloads to the rule Answer: D Explanation: To prevent internal users from downloading executable files from the internet, the administrator needs to configure an access control policy rule that: 1. Allows users to access the internet. 2. Applies a file policy to the rule that blocks executable file downloads. In Cisco Secure Firewall Threat Defense, file policies are used to inspect file types being transmitted and take appropriate actions, such as blocking or allowing files based on their type. The file policy must be assigned to an access policy rule to enforce it for specific traffic. QUESTION 388 An engineer must export a packet capture from Cisco Secure Firewall Management Center to assist in troubleshooting an issue on a Secure Firewall Threat Defense device. When the engineer navigates to the URL for Secure Firewall Management Center at: https:///capture/CAPI/pcap/sample.pcap The engineer receives a 403: Forbidden error instead of being provided with the PCAP file. Which action resolves the issue? A. Disable the proxy setting on the client browser. B. Disabl e the HTTPS server and use HTTP. C. Enable HTTPS in the device platform policy. D. Enable the proxy setting in the device platform policy. Answer: C Explanation: The 403: Forbidden error indicates that the HTTPS server on the Secure Firewall Threat Defense (FTD) device is not properly configured or enabled, preventing access to the requested PCAP file. To resolve this, the engineer must enable the HTTPS service in the device platform policy applied to the FTD device in Cisco Secure Firewall Management Center (FMC). This allows the FTD to serve HTTPS requests, including access to PCAP files. https://www.braindump2go.com/300-710.html QUESTION 389 Which Cisco Secure Firewall Management Center widget is authorized only for users with administrator access? A. product licensing B. appliance informa tion C. system load D. current sessions Answer: A Explanation: The product licensing widget in Cisco Secure Firewall Management Center is reserved for users with administrator access because it involves managing sensitive system settings, such as licensing for the devices under management. Only administrators have the necessary permissions to view and make changes to licensing information. QUESTION 390 Refer to the exhibit. An engineer is troubleshooting connectivity issues over a VPN tunnel. Users from the 192.168.68.0/24 network report that they cannot connect to a remote web server that has an IP address of 192.168.67.100. The engineer confirms that NAT and access control rules on the local Cisco Secure Firewall Threat Defense Virtual will allow the connection. Which two configuration changes must the engineer make to resolve the connectivity issues? (Choose two.) A. Unblock the remote firewall connection B. Set the VPN to support two - way traffic. C. Bring the VPN tunnel up. D. Match the crypto access control list. E. Reconfigure the web server Answer: AD Explanation: The tunnel SAs are active, and local NAT/ACLs already allow the traffic. Connectivity failures in this state are typically due to (1) mismatched proxy IDs/crypto ACLs between p eers, and/or (2) the remote firewall blocking the return traffic. Adjust the crypto ACLs so both sides’ encryption domains match (192.168.68.0/24 ↔ 192.168.67.0/24) and ensure the remote firewall policy permits the web traffic. https://www.braindump2go.com/300-710.html