Pass the Cisco CCNP Security 300-710 Questions and answers with CertsForce

Viewing page 6 out of 10 pages
Viewing questions 51-60 out of questions
Questions # 51:

An engineer must deploy a Cisco FTD device. Management wants to examine traffic without requiring network changes that will disrupt end users. Corporate security policy requires the separation of management traffic from data traffic and the use of SSH over Telnet for remote administration. How must the device be deployed to meet these requirements?

Options:

A.

in routed mode with a diagnostic interface


B.

in transparent mode with a management Interface


C.

in transparent made with a data interface


D.

in routed mode with a bridge virtual interface


Expert Solution
Questions # 52:

What is the advantage of having Cisco Firepower devices send events to Cisco Threat Response via the security services exchange portal directly as opposed to using syslog?

Options:

A.

All types of Cisco Firepower devices are supported.


B.

An on-premises proxy server does not need to be set up and maintained.


C.

Cisco Firepower devices do not need to be connected to the Internet.


D.

Supports all devices that are running supported versions of Cisco Firepower.


Expert Solution
Questions # 53:

An engineer is troubleshooting application failures through a FTD deployment. While using the FMC CLI. it has been determined that the traffic in question is not matching the desired policy. What should be done to correct this?

Options:

A.

Use the system support firewall-engine-debug command to determine which rules the traffic matchingand modify the rule accordingly


B.

Use the system support application-identification-debug command to determine which rules the traffic matching and modify the rule accordingly


C.

Use the system support firewall-engine-dump-user-f density-data command to change the policy and allow the application through the firewall.


D.

Use the system support network-options command to fine tune the policy.


Expert Solution
Questions # 54:

A security engineer needs to configure a network discovery policy on a Cisco FMC appliance and prevent excessive network discovery events from overloading the FMC database? Which action must be taken to accomplish this task?

Options:

A.

Change the network discovery method to TCP/SYN.


B.

Configure NetFlow exporters for monitored networks.


C.

Monitor only the default IPv4 and IPv6 network ranges.


D.

Exclude load balancers and NAT devices in the policy.


Expert Solution
Questions # 55:

What is an advantage of adding multiple inline interface pairs to the same inline interface set when deploying an asynchronous routing configuration?

Options:

A.

Allows the IPS to identify inbound and outbound traffic as part of the same traffic flow.


B.

The interfaces disable autonegotiation and interface speed is hard coded set to 1000 Mbps.


C.

Allows traffic inspection to continue without interruption during the Snort process restart.


D.

The interfaces are automatically configured as a media-independent interface crossover.


Expert Solution
Questions # 56:

An engineer must deny ICMP traffic to the networks of separate departments that use Cisco Secure Firewall Management Center. The engineer must use the same object on the relevant device for each network. What must be configured in Secure Firewall Management Center?

Options:

A.

IP address


B.

IP range


C.

Deny ICMP check box


D.

Allow Overrides check box


Expert Solution
Questions # 57:

An organization is implementing Cisco FTD using transparent mode in the network. Which rule in the default Access Control Policy ensures that this deployment does not create a loop in the network?

Options:

A.

ARP inspection is enabled by default.


B.

Multicast and broadcast packets are denied by default.


C.

STP BPDU packets are allowed by default.


D.

ARP packets are allowed by default.


Expert Solution
Questions # 58:

Which process should be checked when troubleshooting registration issues between Cisco FMC and managed devices to verify that secure communication is occurring?

Options:

A.

fpcollect


B.

dhclient


C.

sfmgr


D.

sftunnel


Expert Solution
Questions # 59:

A network administrator needs to create a policy on Cisco Firepower to fast-path traffic to avoid Layer 7 inspection. The rate at which traffic is inspected must be optimized. What must be done to achieve this goal?

Options:

A.

Enable lhe FXOS for multi-instance.


B.

Configure a prefilter policy.


C.

Configure modular policy framework.


D.

Disable TCP inspection.


Expert Solution
Questions # 60:

An engineer attempts to pull the configuration for a Cisco FTD sensor to review with Cisco TAC but does not have direct access to the CU for the device. The CLl for the device is managed by Cisco FMC to which the engineer has access. Which action in Cisco FMC grants access to the CLl for the device?

Options:

A.

Export the configuration using the Import/Export tool within Cisco FMC.


B.

Create a backup of the configuration within the Cisco FMC.


C.

Use the show run all command in the Cisco FTD CLI feature within Cisco FMC.


D.

Download the configuration file within the File Download section of Cisco FMC.


Expert Solution
Viewing page 6 out of 10 pages
Viewing questions 51-60 out of questions