Cisco 300-710 Exam Questions Free Practice Test

Viewing page 9 out of 12 pages

Viewing questions 81-90 out of questions

Questions # 81:

An engineer must investigate a connectivity issue from an endpoint behind a Cisco FTD device and a public DNS server. The endpoint cannot perform name resolution queries. Which action must the engineer perform to troubleshoot the issue by simulating real DNS traffic on the Cisco FTD while verifying the Snarl verdict?

Options:

Perform a Snort engine capture using tcpdump from the FTD CLI.

Use the Capture w/Trace wizard in Cisco FMC.

Create a Custom Workflow in Cisco FMC.

Run me system support firewall-engine-debug command from me FTD CLI.

Expert Solution

Answer

Explanation

The Capture w/Trace wizard in Cisco FMC allows you to capture packets on an FTD device and trace their path through the Snort engine. This can help you troubleshoot connectivity issues from an endpoint behind an FTD device and a public DNS server, as well as verify the Snort verdict for the DNS traffic. The Capture w/Trace wizard lets you specify the source and destination IP addresses, ports, and protocols for the packets you want to capture and trace, as well as the FTD device and interface where you want to perform the capture. You can also apply filters to limit the capture size and duration. After you start the capture, you can ping the DNS server from the endpoint and then view the captured packets and their Snort verdicts in the FMC web interface2.

To use the Capture w/Trace wizard in Cisco FMC, you need to follow these steps2:

In the FMC web interface, navigate to Troubleshooting > Capture/Trace.

Click New Capture.

Choose an FTD device from the Device drop-down list.

Choose an interface from the Interface drop-down list.

Enter the source and destination IP addresses, ports, and protocols for the packets you want to capture and trace. For example, if you want to capture DNS queries from an endpoint with IP address 10.1.1.100 to a DNS server with IP address 8.8.8.8, you can enter these values:

Source IP: 10.1.1.100

Source Port: any

Destination IP: 8.8.8.8

Destination Port: 53

Protocol: UDP

Optionally, apply filters to limit the capture size and duration. For example, you can set the maximum number of packets to capture, the maximum capture file size, or the maximum capture time.

Click Start.

Ping the DNS server from the endpoint and wait for some packets to be captured.

Click Stop to stop the capture.

Click View Capture to see the captured packets and their Snort verdicts.

The other options are incorrect because:

Performing a Snort engine capture using tcpdump from the FTD CLI will not allow you to trace the path of the packets through the Snort engine or verify their Snort verdicts. Tcpdump is a command-line tool that can capture packets on an FTD device, but it does not provide any information about how Snort processes those packets or what actions Snort takes on them2.

Creating a Custom Workflow in Cisco FMC will not help you troubleshoot a connectivity issue from an endpoint behind an FTD device and a public DNS server. A Custom Workflow is a user-defined set of pages that display event data in different formats, such as tables, charts, maps, and so on. A Custom Workflow does not allow you to capture or trace packets on an FTD device3.

Running the system support firewall-engine-debug command from the FTD CLI will not allow you to simulate real DNS traffic on the FTD device or verify the Snort verdict for that traffic. The firewall-engine-debug command is a diagnostic tool that can generate synthetic packets and send them through the Snort engine on an FTD device. The synthetic packets are not real network traffic and do not affect any connections or policies on the FTD device4.

Questions # 82:

Which limitation applies to Cisco Firepower Management Center dashboards in a multidomain environment?

Options:

Child domains can view but not edit dashboards that originate from an ancestor domain.

Child domains have access to only a limited set of widgets from ancestor domains.

Only the administrator of the top ancestor domain can view dashboards.

Child domains cannot view dashboards that originate from an ancestor domain.

Expert Solution

Questions # 83:

A network security engineer must export packet captures from the Cisco FMC web browser while troubleshooting an issue. When navigating to the address https:// /capture/CAPI/pcap/test.pcap. an error 403: Forbidden is given instead of the PCAP file. Which action must the engineer take to resolve this issue?

Options:

Disable the HTTPS server and use HTTP instead.

Enable the HTTPS server for the device platform policy.

Disable the proxy setting on the browser.

Use the Cisco FTD IP address as the proxy server setting on the browser.

Expert Solution

Questions # 84:

A security engineer is configuring an Access Control Policy for multiple branch locations These locations share a common rule set and utilize a network object called INSIDE_NET which contains the locally significant internal network subnets at each location What technique will retain the policy consistency at each location but allow only the locally significant network subnet within the applicable rules?

Options:

utilizing policy inheritance

utilizing a dynamic ACP that updates from Cisco Talos

creating a unique ACP per device

creating an ACP with an INSIDE_NET network object and object overrides

Expert Solution

Questions # 85:

What is an advantage of adding multiple inline interface pairs to the same inline interface set when deploying an asynchronous routing configuration?

Options:

Allows the IPS to identify inbound and outbound traffic as part of the same traffic flow.

The interfaces disable autonegotiation and interface speed is hard coded set to 1000 Mbps.

Allows traffic inspection to continue without interruption during the Snort process restart.

The interfaces are automatically configured as a media-independent interface crossover.

Expert Solution

Questions # 86:

A network engineer sets up a secondary CiscoFMC that is integrated with Cisco Security Packet Analyzer What occurs when the secondary CiscoFMC synchronizes with the primary Cisco FMC?

Options:

The existing integration configuration is replicated to the primary Cisco FMC

The existing configuration for integration of the secondary Cisco FMC the Cisco Security Packet Analyzer is overwritten.

The synchronization between the primary and secondary Cisco FMC fails

The secondary Cisco FMC must be reintegrated with the Cisco Security Packet Analyzer after the synchronization

Expert Solution

Questions # 87:

An engineer has been asked to show application usages automatically on a monthly basis and send the information to management What mechanism should be used to accomplish this task?

Options:

event viewer

reports

dashboards

context explorer

Expert Solution

Questions # 88:

Which Cisco Advanced Malware Protection for Endpoints policy is used only for monitoring endpoint actively?

Options:

Windows domain controller

audit

triage

protection

Expert Solution

Questions # 89:

Which two routing options are valid with Cisco Firepower Threat Defense? (Choose two.)

Options:

BGPv6

ECMP with up to three equal cost paths across multiple interfaces

ECMP with up to three equal cost paths across a single interface

BGPv4 in transparent firewall mode

BGPv4 with nonstop forwarding

Expert Solution

Questions # 90:

Which action should be taken after editing an object that is used inside an access control policy?

Options:

Delete the existing object in use.

Refresh the Cisco FMC GUI for the access control policy.

Redeploy the updated configuration.

Create another rule using a different object name.

Expert Solution

Viewing page 9 out of 12 pages

Viewing questions 81-90 out of questions

Month End Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: simple70

Pass the Cisco CCNP Security 300-710 Questions and answers with CertsForce