Cisco 300-710: Securing Networks with Cisco Firewalls (SNCF) v1.2

Last checked November 10, 2026 against the official Cisco exam page.

1. Question 1Deployment

   A company needs to place a firewall between two server segments that share one IPv4 subnet, and it cannot renumber either segment. Which Secure Firewall Threat Defense firewall mode should the engineer configure?

   1. ARouted mode with static routes on each interface
   2. BTransparent mode with a separate routing table for each interface
   3. CRouted mode with NAT applied on every interface
   4. DTransparent mode with the interfaces placed in a bridge group
   Show answer and explanationHide answer

   Correct answer: D

   Transparent mode operates at layer 2, so the device can sit between two hosts in the same subnet without renumbering, and bridge groups hold the interfaces. Routed mode requires each interface to sit in a different subnet, so A and C do not meet the requirement, and D describes per-interface routing tables that transparent mode does not use.

2. Question 2Configuration

   An engineer wants traffic from one trusted server subnet to bypass intrusion and file inspection in an access control policy, while all other traffic stays inspected. Which rule action achieves this?

   1. AInteractive block with a user prompt for the server subnet
   2. BAllow action with an intrusion policy set to No Rules Active
   3. CBlock with reset for traffic from the trusted server subnet
   4. DTrust action on a rule that matches the trusted server subnet
   Show answer and explanationHide answer

   Correct answer: D

   The Trust action allows matching traffic without further Snort inspection, so the trusted subnet skips intrusion and file checks. Allow with No Rules Active still sends traffic through the inspection engine, and both block actions stop the traffic instead of passing it, so B, C and D are wrong.

3. Question 3Management and Troubleshooting

   Users report that a web application is blocked intermittently. The administrator needs to see which access control rule handled each logged connection and the action taken. Which event type should be reviewed?

   1. ADiscovery events, which record hosts and applications seen on the network
   2. BHealth events, which record module status on managed devices
   3. CConnection events, which record the rule matched and the action taken
   4. DMalware events, which record files flagged by a file policy
   Show answer and explanationHide answer

   Correct answer: C

   Connection events record logged connections with the access control rule that matched and the action applied, so they explain why traffic was blocked. Discovery events describe hosts and applications, health events describe device module status, and malware events describe files, so A, B and C do not show the rule and action.

4. Question 4Integration

   A file policy flags an executable with no known signature. The security team wants the file run in a sandbox and a behavior report returned to the analysts. Which Cisco component provides this?

   1. ACisco Identity Services Engine profiling service
   2. BSecure Malware Analytics
   3. CCisco Umbrella DNS security policy
   4. DSplunk search head with an indexer
   Show answer and explanationHide answer

   Correct answer: B

   Secure Malware Analytics is the Cisco sandbox that runs suspicious files and produces behavior reports for analysts. Identity Services Engine handles access and profiling, Splunk stores and searches logs, and Umbrella provides DNS-layer security, so A, B and C cannot detonate a file.

5. Question 5Deployment

   A security team wants to inspect a mirrored copy of traffic from a SPAN port for intrusion events. The sensor must never sit in the path of live traffic. Which NGIPS deployment mode fits this requirement?

   1. AInline set mode with drop rules enabled on both interfaces
   2. BPassive mode on an interface that receives the SPAN feed
   3. CRouted mode with an access rule set to block the source
   4. DInline tap mode on a pair of inline interfaces for monitoring
   Show answer and explanationHide answer

   Correct answer: B

   Passive mode analyzes a copy of the traffic and never forwards or blocks live packets, which matches a SPAN-fed sensor. Inline set and inline tap both place the device in the forwarding path, and routed blocking enforces decisions on live traffic, so A, B and D are wrong.