300-710 Securing Networks with Cisco Firepower (300-710 SNCF) v1.2 Question and Answers

Cisco Defense Orchestrator (CDO) is the tool that assists engineers in performing an audit of network projects to determine which objects are duplicated across various firewall models, including Cisco Secure Firewall Threat Defense, Cisco Secure Firewall ASA, and Meraki MX Series. CDO provides a unified management interface for managing multiple security devices and can identify duplicate objects across these devices.

Steps:

Access Cisco Defense Orchestrator.

Connect and synchronize all relevant firewall devices (FTD, ASA, Meraki MX).

Use the audit and reporting features in CDO to identify and manage duplicate objects.

This helps ensure consistency and efficient management across the organization ' s firewall deployments.

To capture packets that are dropped by Cisco Secure Firewall Threat Defense (FTD) and troubleshoot the issue of traffic from the inside network to a webserver not getting through, the administrator should use the command to capture packets dropped by the accelerated security path (ASP) engine. The correct command is:

capture CAP type asp-drop all headers-only

This command captures all packets dropped by the ASP engine, which includes packets that are being blocked by access control policies, NAT issues, or other security checks.

Steps:

Access the FTD CLI.

Run the commandcapture CAP type asp-drop all headers-onlyto capture dropped packets.

Analyze the captured data to identify the cause of the drops.

This command provides detailed information on why packets are being dropped, helping the administrator resolve the issue.

When reconfiguring an existing Cisco FTD from transparent mode to routed mode, an additional action that must be taken to maintain communication between the two network segments is toupdate the IP addressing so that each segment is a unique IP subnet. This is because in routed mode, the FTD device acts as a router hop in the network and requires each interface to be on a different subnet. In transparent mode, the FTD device acts as a layer 2 firewall and does not require different subnets for each interface1.

The other options are incorrect because:

Configuring a NAT rule so that traffic between the segments is exempt from NAT is not necessary to maintain communication between the two network segments. NAT is used to translate IP addresses between different networks, but it does not affect the routing of packets. Moreover, NAT is optional in routed mode and can be disabled if not needed2.

Deploying inbound ACLs on each interface to allow traffic between the segments is not required to maintain communication between the two network segments. ACLs are used to control access to network resources based on source and destination addresses, protocols, and ports. They do not affect the routing of packets. Furthermore, ACLs are optional in routed mode and can be configured as needed3.

Assigning a unique VLAN ID for the interface in each segment is not relevant to maintain communication between the two network segments. VLANs are used to create logical groups of hosts that share the same broadcast domain, regardless of their physical location or connection. They do not affect the routing of packets. Besides, VLANs are not supported in routed mode and can only be used in transparent mode4.

To create a malware and file policy on a Cisco Secure Firewall Threat Defense (FTD) device that ensures PDF, DOCX, and XLSX files are not sent to Cisco Secure Malware Analytics, the security engineer must configure local malware analysis. Local malware analysis allows the FTD to inspect and analyze files locally without sending them to the cloud-based Cisco Secure Malware Analytics.

Steps to configure local malware analysis:

In FMC, navigate toPolicies > Access Control > Malware & FilePolicies.

Create a new malware and file policy or edit an existing one.

Define rules to inspect specific file types, ensuring that PDF, DOCX, and XLSX files are handled locally.

Set the action for these file types to " Local Analysis. "

Apply the policy to the relevant access control policy.

This configuration ensures that the specified file types are analyzed locally, meeting the requirement to avoid sending them to Cisco Secure Malware Analytics.

A static-route command follows the structure ip route destination-network subnet-mask next-hop administrative-distance. The required destination is 192.168.10.0/24, which corresponds to subnet mask 255.255.255.0. The next-hop address must be 192.168.20.1, and the routing-table exhibit confirms that the 192.168.20.0/24 network is directly connected through VLAN 10. The final value must be 2 because the question explicitly requires an administrative distance of 2. Option A uses the correct destination and next hop but sets the distance to 1. Options B and D incorrectly reverse the destination and next-hop networks. Consequently, only option C contains all four required elements and installs the route through the connected 192.168.20.0/24 network with the specified preference.

================

Explanation

The Encrypted Visibility Engine (EVE) in Cisco Secure Firewall Management Center is enabled under the SSL tab of an access control policy. EVE provides visibility into encrypted traffic, allowing the firewall to detect threats even when traffic is encrypted.

Steps to enable EVE:

Navigate to the access control policy in FMC.

Go to theSSLtab.

Enable Encrypted Visibility Engine (EVE) to analyze encrypted traffic.

This configuration helps in identifying and mitigating threats within encrypted traffic without the need for full decryption.

To filter traffic between multiple subnets, the engineer must implement the firewall in routed mode. In routed mode, the firewall operates as a Layer 3 device, capable of routing traffic between different IP subnets. This mode is appropriate for filtering traffic between LAN, DMZ, and WAN subnets.

Steps to configure routed mode:

Access the firewall ' s management interface.

Configure interfaces for each subnet (LAN, DMZ, WAN) with appropriate IP addresses and network masks.

Define security zones and apply access control policies to filter traffic as required.

This ensures that the firewall can inspect and route traffic between the different subnets, providing the necessary security and control.

To add a Cisco Secure Firewall Threat Defense (FTD) device to Cisco Secure Firewall Management Center (FMC), the correct command to use isconfigure manager add 192.168.75.201 < reg_key > . This command registers the FTD device with the FMC using the FMC ' s IP address and the registration key provided during the FMC setup.

Command structure:

configure manager add < FMC_IP > < reg_key >

For the given scenario:

FMC IP address: 192.168.75.201

Registration key: provided during FMC setup

Thus, the correct command is:

configure manager add 192.168.75.201 < reg_key >

Threat Intelligence Director cannot apply Block directly to a TAXII source because STIX data obtained through TAXII can contain complex indicators. A managed device takes enforcement action based on individual observables, such as an IP address, URL, domain, or file hash. After the TAXII content has been ingested, an administrator can configure Block on an individual observable or on a simple indicator containing one actionable observable. Complex indicators combine multiple observables and therefore cannot be blocked directly; the administrator must instead block the appropriate individual observables within them. An element is the managed device that receives published intelligence, not an intelligence object on which this action is configured. Consequently, the two supported object types are an observable and a simple indicator. Cisco Threat Intelligence Director documentation

================

To block traffic to known cryptomining networks using Cisco Secure Firewall Threat Defense (FTD) managed by Cisco Secure Firewall Management Center (FMC), the network administrator needs to configure Security Intelligence in an Access Control Policy. Security Intelligence allows administrators to block traffic based on threat intelligence feeds, which include known malicious IP addresses, domains, and URLs.

Steps:

Navigate toPolicies > Access Control > Access Control Policyin FMC.

Edit or create an Access Control Policy.

Go to theSecurity Intelligencetab.

Enable the relevant threat intelligence feeds that include cryptomining networks.

Apply the policy to the FTD device.

This configuration ensures that traffic to known cryptomining networks is blocked, enhancing the network ' s security posture against cryptomining threats.

Individual intrusion rules do not support direct time-range conditions or scheduled activation triggers. Instead, the administrator creates a time-range object and uses it as a condition in an access control rule. The required intrusion policy is then associated with that access control rule. During the specified time range, matching traffic invokes the intrusion policy and its enabled intrusion rules; outside the range, the access control rule does not match. Multiple access control rules can be created when different intrusion policies or protection levels are needed at different times. Secure Firewall Management Center does not require an external scheduled task to enable and disable individual intrusion rules. Cisco documents time-range objects as the mechanism for making supported policies apply only during defined periods. Therefore, time-based access control rules are the correct implementation. Cisco time-range objects

Secure Firewall access control evaluates a connection using the destination’s real, untranslated address. For an inbound static NAT connection, the Internet client sends traffic to the mapped public address, but the firewall performs NAT untranslation and evaluates the access control rule against the internal server address. Consequently, a rule containing only the public address will not match as intended. The administrator must replace that public destination with the web server’s internal IP address while retaining the required TCP port and appropriate Allow action. Changing the action to Trust does not correct an address-matching error and would also bypass additional inspection. Disabling intrusion inspection is unrelated, and translating the client’s source address is unnecessary for ordinary inbound static NAT. Therefore, the access control rule must reference the internal, real server address. Cisco NAT and real-address documentation

Integrated Routing and Bridging allows a Secure Firewall device operating in routed mode to contain bridge groups while also supporting routed interfaces. Multiple physical or logical interfaces can become members of one bridge group, placing them in the same Layer 2 broadcast domain, VLAN, and IP subnet. A Bridge Virtual Interface represents that bridge group at Layer 3 and functions as its gateway, permitting communication between the bridged network and routed interfaces or other bridge groups, subject to security policy. This can remove the need for an additional external Layer 2 switch when suitable firewall interfaces are available. IRB does not itself provide high availability, security-context separation, or Cisco Talos threat-intelligence updates. Those capabilities are implemented through separate features. Therefore, allowing multiple interfaces to participate in the same VLAN is the stated IRB benefit. Cisco IRB documentation

================

A file policy defines the actions that the Cisco Firepower Threat Defense (FTD) device should take when it encounters different types of files. The file policy is applied as part of an access control policy. If an access control policy does not include a file policy, the FTD device will not take any action on the files it encounters, resulting in a disposition of " unknown " for all file types except exe.

Dynamic Analysis submits eligible files with an Unknown or Unavailable malware-cloud disposition to Cisco Secure Malware Analytics, formerly Cisco Threat Grid. The service executes and observes the file in a controlled environment, examines its behavior, and returns a threat score and detailed analysis report. Secure Firewall Management Center can use the returned threat score and the threshold configured in the file policy to determine whether the file should be treated as malware. Spero Analysis is different because it examines structural characteristics and generates a signature primarily for executable files. It does not provide the comprehensive sandbox-based behavioral examination described in the question. Therefore, when unknown files must be submitted to Secure Malware Analytics for deeper investigation, Dynamic Analysis is the required configuration. Cisco file-policy documentation

================

In inline IPS mode, to ensure that traffic passes through uninterrupted when VDB (Vulnerability Database) updates are being applied, the " Short Fall Open " setting must be configured. This setting allows traffic to continue to flow through the firewall even if there are issues with the inspection process, such as during updates or if the inspection engine fails.

Steps:

In FMC, navigate to the inline set configuration.

Enable the " Short Fall Open " option.

Deploy the configuration to the FTD device.

This ensures that network traffic is not disrupted during updates or other issues with the inspection process.

If a task to generate troubleshooting files in Cisco Secure Firewall Management Center (FMC) is completed successfully but removed before the files are downloaded, the following steps can be taken to determine the filename and obtain the generated troubleshooting files without regenerating them:

Go to expert mode on Secure FMC:

Access expert mode on the FMC via SSH or the console.

List the contents of the directory/var/commonto locate the generated troubleshooting files. Use the commandls /var/common.

Use the System Monitoring Audit logs:

In FMC, navigate toSystem > Monitoring > Audit.

Find the line containing the " Generate Troubleshooting Files " string to determine the correct filename.

These actions help identify and retrieve the generated troubleshooting files without the need to regenerate them, saving time and resources.

To enable SSH access to a Cisco Secure Firewall Threat Defense (FTD) device from the inside interface for remote administration, the engineer needs to configure a Platform Settings policy in Cisco Secure Firewall Management Center (FMC). The Platform Settings policy allows the configuration of various system-related settings, including enabling SSH, specifying the allowed interfaces, and defining the SSH access parameters.

Steps:

In FMC, navigate toPolicies > Access Control > Platform Settings.

Create a new Platform Settings policy or edit an existing one.

In the policy settings, go to theSSHsection.

Enable SSH and specify theinsideinterface as the allowed interface for SSH access.

Define the SSH parameters such as allowed IP addresses, user credentials, and other security settings.

Save and deploy the policy to the FTD device.

This configuration ensures that SSH access is enabled on the specified interface, allowing secure remote administration.

In a failover configuration with Cisco Secure Firewall Threat Defense (FTD) devices, ensuring that users on the internal network can continue to communicate with outside devices if the primary device (FTD1) fails requires the implementation of a stateful failover link. The stateful failover link allows the secondary device (FTD2) to maintain session information and state data, ensuring seamless failover and minimizing disruptions.

Steps to implement a stateful failover link:

Physically connect a stateful failover link between FTD1 and FTD2.

Configure the stateful failover link in the FMC.

Ensure that both devices are properly synchronized and that stateful failover is enabled.

Deploy the changes to both FTD devices.

By configuring a stateful link, the secondary FTD can take over active sessions without requiring users to re-establish their connections, thus ensuring continuous communication.

The correct sequence of actions for configuring a multi-instance environment for high availability on a Cisco Firepower 4100 appliance is as follows:

Add a resource profile for container instances. A resource profile defines the CPU, RAM, and disk space allocation for each container instance.You can create multiple resource profiles with different resource settings and assign them to different container instances1.

Add a MAC pool prefix and view the MAC address for the container instance interfaces. A MAC pool prefix is a 24-bit prefix that is used to generate MAC addresses for the container instance interfaces. You can specify a custom MAC pool prefix or use the default one.You can also view the MAC addresses that are assigned to each container instance interface1.

Configure interfaces. You need to configure the physical interfaces, EtherChannels, and VLAN subinterfaces that will be used by the container instances.You can also configure shared interfaces that can be used by multiple container instances on the same security module/engine1.

Add a Standalone Firepower Threat Defense for Cisco Secure Firewall Management Center. You need to add a logical device that runs a standalone Firepower ThreatDefense (FTD) application instance and register it with the Cisco Secure Firewall Management Center (FMC).This logical device will act as the management interface for the container instances1.

Add a high-availability pair. You need to add another logical device that runs a standalone FTD application instance and register it with the FMC as well. Then, you need to configure high availability (HA) between the two standalone FTD logical devices.This will enable HA for the container instances that are associated with them1.

To determine if a host is infected with malware, the network administrator can look at the Indications of Compromise (IOC) feature in Cisco FMC. The IOC feature analyzes network and endpoint data collected by Firepower sensors and AMP for Endpoints connectors, and identifies hosts that exhibit signs of compromise or infection. The IOC feature uses predefined rules based on Cisco Talos intelligence and other sources to detect IOCs on hosts. One of these rules is CnC Connected, which indicates that a host has communicated with a command-and-control (CnC) server that is known to be associated with malware activity2.

To view the IOC information for a host, the network administrator can navigate to Analysis > Hosts > Indications of Compromise in Cisco FMC, and select a host from the table. The IOC Details page will show the IOC events for that host, including the CnC Connected event, along with other information such as severity, timestamp, source, destination, protocol, and rule name. The network administrator can also view more details about each IOC event by clicking on it2.

The other options are incorrect because:

Analysis > Files > Malware Events shows information about files that have been detected as malware by Firepower sensors or AMP for Endpoints connectors. This does not show information about hosts that are infected with malware or have communicated with CnC servers3.

Analysis > Hosts > Host Attributes shows information about hosts that have been discovered by Firepower sensors, such as IP address, MAC address, operating system, applications, users, vulnerabilities, and so on. This does not show information about IOCs or CnC connections on hosts4.

Analysis > Files > Network File Trajectory shows information about files that have traversed your network and have been detected by Firepower sensors or AMP for Endpoints connectors. This allows you to track where a file came from, where it went, and what happened to it along the way. This does not show information about hosts that are infected with malware or have communicated with CnC servers5.

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/reusable_objects.html#ID-2243-000009b4

" All interfaces in an interface object must be of the same type: all inline, passive, switched, routed, or ASA FirePOWER. After you create an interface object, you cannot change the type of interfaces it contains. "

Change Reconciliation is specifically designed to generate and email a detailed summary of configuration changes made during the preceding 24 hours. Secure Firewall Management Center takes snapshots when users save configuration changes and consolidates those records into a daily change report. The administrator can enable the feature, select the scheduled delivery time, specify recipient email addresses, and optionally include the full change history. Sending audit logs to a syslog or HTTP server exports individual audit events to an external system but does not automatically generate the required daily management report. STIG Compliance evaluates the system against security configuration guidance and is unrelated to change reporting. Therefore, Change Reconciliation is the only option that directly satisfies both the 24-hour reporting period and email-delivery requirements. Cisco Change Reconciliation configuration

================

To connect to a Secure Endpoint private cloud instance from Cisco Secure Firewall Management Center (FMC), the network engineer requires the SSL certificate for the Secure Endpoint private cloud instance. This SSL certificate is necessary to establish a secure, trusted connection between the FMC and the private cloud instance.

Steps:

Obtain the SSL certificate from the server administrator.

Import the SSL certificate into the FMC.

Configure the connection to the Secure Endpoint private cloud instance using the provided hostname and SSL certificate.

This ensures a secure and authenticated connection to the private cloud instance.

A custom application detector is a user-defined script that can detect web applications, clients, and application protocols based on patterns in network traffic. Custom application detectors are written in LUA, which is a lightweight and embeddable scripting language. LUA scripts can use predefined functions and variables provided by the Firepower System to access packet data and metadata, and to specify the detection criteria and the application information1.

To import a custom application detector file that was provided by a third party, you need to follow these steps1:

In the FMC web interface, navigate to Objects > Object Management > Application Detectors.

Click Import.

Browse to the location of the LUA script file and select it.

Click Upload.

Review the detector details and click Save.

The other options are incorrect because:

Perl script is not a supported format for custom application detectors. Perl is a general-purpose programming language that is not embedded in the Firepower System.

NBAR protocol is not a file type, but a feature of Cisco IOS routers that can classify and monitor network traffic based on application types. NBAR protocols are predefined and cannot be imported as custom application detectors.

Python program is not a supported format for custom application detectors. Python is a general-purpose programming language that is not embedded in the Firepower System.

Secure Firewall Management Center must trust the certificate presented by the Cisco ISE pxGrid server. Therefore, the certificate authority certificate that signed the pxGrid node’s server certificate must be exported from ISE and imported into Management Center as a trusted CA object. If primary and secondary pxGrid nodes are deployed, Cisco requires their certificates to be signed by the same trusted certificate authority. Depending on the integration design, the engineer might also need the monitoring-node CA certificate and a pxGrid client certificate with its private key for Management Center. However, the question specifically asks which certificate establishes trust with the pxGrid server node. SAML and domain-controller certificates are unrelated, and a certificate cannot simultaneously be self-signed and signed by a third-party CA. Cisco ISE and Secure Firewall certificate integration

================

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699-configure-ftd-high-availability-on-firep.html

Conditions

In order to create an HA between 2 FTD devices, these conditions must be met:

Same model

Same version (this applies to FXOS and to FTD - (major (first number), minor (second number), and maintenance (third number) must be equal))

Same number of interfaces

Same type of interfaces

Both devices as part of same group/domain in FMC

Have identical Network Time Protocol (NTP) configuration

Be fully deployed on the FMC without uncommitted changes

Be in the same firewall mode: routed or transparent.

Note that this must be checked on both FTD devices and FMC GUI since there have been cases where the FTDs had the same mode, but FMC does not reflect this.

Does not have DHCP/Point-to-Point Protocol over Ethernet (PPPoE) configured in any of the interface

Different hostname (Fully Qualified Domain Name (FQDN)) for both chassis. In order to check the chassis hostname navigate to FTD CLI and run this command

If users report that Cisco Duo 2FA fails when attempting to connect to the VPN on a Cisco Secure Firewall Threat Defense (FTD) device, and the VPN troubleshooting log in FMC shows an error indicating that the Cisco Duo AAA server has been marked as failed, the root cause is likely missing Duo trust certificates on the FTD device. Trust certificates are essential for establishing a secure and trusted connection between the FTD and the Duo authentication service.

Steps:

Obtain the necessary Duo trust certificates.

Install the certificates on the FTD device.

Verify the configuration to ensure that the FTD device can properly communicate with the Duo AAA server.

This resolves the authentication failure by ensuring that the FTD device can trust the Duo server.

https://www.cisco.com/c/en/us/td/docs/security/firepower/610/fdm/fptd-fdm-config-guide-610/fptd-fdm- interfaces.html

To protect and encrypt the synchronization/failover traffic between Cisco Secure Firewall Threat Defense (FTD) high-availability or cluster units, the correct action is to encrypt the synchronization traffic with IPsec (via the failover/state link configuration) or choose the appropriate cryptographic authentication/key settings

To configure URL filtering such that users receive a warning when they access a specific website (e.g.,http://www.badadultsite.com) and have the option to continue to the site, the engineer needs to perform the following actions:

Configure an access control rule:

Create a URL object forhttp://www.badadultsite.com.

Set the action for this URL object to " Interactive Block, " which prompts the user with a warning and allows them to proceed if they choose to.

Set the Interactive Block Response Page:

Navigate to the HTTP Responses tab in the access control policy editor.

Set the Interactive Block Response Page to " System-provided " to ensure that users see the default warning page provided by Cisco Secure Firewall Management Center.

These actions ensure that only the specified website triggers an interactive block, while other websites are not blocked.

To support more than two interfaces per context and enable NAT configurations, the firewall must operate in routed mode. Since the firewall was previously in transparent mode, the network engineer needs to change it to routed mode.

Steps:

Access the CLI of the Secure FTD device.

Run the commandconfigure firewall routedto switch the firewall from transparent mode to routed mode.

Reregister the FTD device with the FMC by running theconfigure manager add < FMC_IP > < Registration_Key > command from the FTD device CLI.

This will ensure that the firewall can support the required NAT configurations and more than two interfaces per context.

To configure IPS mode on a Cisco Secure Firewall Threat Defense (FTD) device to inspect traffic and act as an IDS, the network engineer must configure an intrusion policy on the FTD device. The passive-interface and SPAN on the switch have already been configured, which means the traffic is being mirrored to the FTD. The next step is to set up an intrusion policy that defines the rules and actions for detecting and responding to malicious traffic.

Steps:

In FMC, navigate toPolicies > Intrusion.

Create a new intrusion policy or edit an existing one.

Define the rules and actions for detecting threats.

Apply the intrusion policy to the relevant interfaces or access control policies.

This configuration enables the FTD to inspect the mirrored traffic and take appropriate actions based on the defined intrusion policy.

The intended control node should be assigned a numerically lower priority value than the other cluster nodes. Cisco Secure Firewall cluster priority values operate inversely: the lowest numerical value represents the highest election priority. For example, a node configured with priority 1 takes precedence over nodes configured with priorities 10 or 20. If the current control node fails, the available node with the highest priority—meaning the lowest configured number—is elected as the replacement. Values 0 and 255 are outside the documented 1–100 range for this Management Center clustering implementation. Therefore, the node with greater processing resources should receive a lower numerical value. The supplied answer of C in List B is incorrect and has been corrected to B based on Cisco documentation. Cisco Secure Firewall clustering documentation

================

Transparent mode allows the FTD device to act as a “bump in the wire” that does not affect the IP addressing of the network. The end user workstations will not need any changes to their configuration, as they will still receive an IP address from the same DHCP server. However, the FTD device must allow DHCP traffic in the access control policies, otherwise it will block the DHCP requests and replies1