Free 300-710 practice test: 30 questions with answers

Transparent mode operates at layer 2, so the device can sit between two hosts in the same subnet without renumbering, and bridge groups hold the interfaces. Routed mode requires each interface to sit in a different subnet, so A and C do not meet the requirement, and D describes per-interface routing tables that transparent mode does not use.

Passive mode analyzes a copy of the traffic and never forwards or blocks live packets, which matches a SPAN-fed sensor. Inline set and inline tap both place the device in the forwarding path, and routed blocking enforces decisions on live traffic, so A, B and D are wrong.

Inline tap mode lets traffic pass while Snort generates the events it would have produced had it dropped the packets, which suits a policy trial. Inline set with drop rules enforces the drops, and routed or transparent blocking changes live traffic, so A, B and C are wrong.

In an active and standby pair, the standby unit receives configuration and connection state from the active unit over the failover links and takes over only after a failover. Option B describes an active and active model that this pair does not use, D is wrong because both units are managed by the same Management Center, and A is wrong because configuration is synchronized continuously.

FTDv is the virtual form factor of Threat Defense and runs on a hypervisor or in a public cloud. The Management Center appliance is a manager, the Firepower 4100 is dedicated hardware, and Cisco Defense Orchestrator is a cloud management service rather than a firewall instance, so B, C and D are wrong.

Clustering groups several Threat Defense units into one logical device that shares the load and scales throughput. Active and standby failover offers redundancy with only one unit forwarding at a time, multi-instance runs separate independent logical devices, and a bridge group is a single-device mode, so A, C and D are wrong.

Cloud-delivered Firewall Management Center is provided as a service through Cisco Defense Orchestrator, so the company runs no management server itself. A self-hosted virtual Management Center still needs a server the company operates, Device Manager runs locally on each device, and ISE is an identity and access product rather than a firewall manager.

Firepower Device Manager is the on-box, browser-based manager for a single Threat Defense device. A dedicated Management Center at every branch is more than one device needs, pxGrid is an information-sharing framework, and Secure Malware Analytics is a file sandbox, so A, C and D do not fit.

The Trust action allows matching traffic without further Snort inspection, so the trusted subnet skips intrusion and file checks. Allow with No Rules Active still sends traffic through the inspection engine, and both block actions stop the traffic instead of passing it, so B, C and D are wrong.

The prefilter policy is evaluated first and can fastpath or block traffic before Security Intelligence and the access rules run. The SSL decryption policy comes later in the evaluation, while intrusion and file policies apply after a rule has matched, so A, B and C are not the first check.

A network object group holds several address objects under one name, so every rule that references the group updates when its members change. An FQDN object resolves one DNS name, a port object holds ports, and a security zone groups interfaces, so none of those holds the three addresses.

An identity policy uses an identity source such as an Active Directory realm to tie users to traffic, and access control rules can then match those users. A DNS policy works on name lookups, a NAT rule only translates addresses, and a variable set in an intrusion policy holds network definitions rather than user names, so A, C and D are wrong.

Balanced Security and Connectivity is the base policy designed to balance protection against disruption to legitimate traffic. Security Over Connectivity favors blocking, Maximum Detection favors broad alerting with more noise, and No Rules Active turns off the rule set, so B, C and D are not the best starting point.

Snort 3 is a rewritten inspection engine with modular inspectors and multithreaded processing. The other options describe behavior that Snort 3 does not have, such as VPN-only inspection, management-interface-only inspection, or removal of intrusion policies.

Static NAT creates a fixed one-to-one mapping, so inbound connections to the public address reach the internal server. Dynamic PAT shares one address among many outbound hosts, identity NAT does not translate the address, and a dynamic pool does not give a stable mapping, so A, B and C are wrong.

The prefilter policy and the Security Intelligence settings are both part of an access control policy and are applied during traffic evaluation. An NTP server list is a Management Center system setting and a fan profile is chassis hardware, so C and D are not access control components.

Connection events record logged connections with the access control rule that matched and the action applied, so they explain why traffic was blocked. Discovery events describe hosts and applications, health events describe device module status, and malware events describe files, so A, B and C do not show the rule and action.

The show asp drop command displays counters for the reasons the accelerated security path dropped packets, which helps locate data path drops. The show conn detail command lists connections, show running-config route displays routing configuration, and show version reports software details, so A, C and D do not list drop reasons.

The packet-tracer command simulates a packet you define and reports each processing phase, including access list and NAT decisions. The capture-traffic utility records real packets rather than simulating one, show conn lists existing connections, and Health Monitor alerts report device health, so none of those predicts the handling of a hypothetical flow.

Health Monitor shows the status of device modules and raises health alerts for every managed device in one view. The audit log records administrator actions, the policy editor changes access rules, and the object manager stores reusable objects, so A, B and C do not show module health.

Discovery events are generated by network discovery and record the hosts, operating systems, and application protocols observed on the network. Intrusion events record signature matches, file events record transferred files, and malware events record file dispositions, so A, B and D do not describe host inventory.

The LINA capture command records real packets that match the specified interface and match criteria, and the capture can be exported for analysis. The packet-tracer command only simulates a packet, show xlate lists NAT translations, and show route displays routes, so B, C and D do not record real traffic.

Custom dashboards built from widgets and report templates that produce PDF output are both used to summarize security activity. Direct SSH sessions are device access rather than a summary feature, and automatic VPN tunnel creation is not a reporting function, so C and D are wrong.

Secure Malware Analytics is the Cisco sandbox that runs suspicious files and produces behavior reports for analysts. Identity Services Engine handles access and profiling, Splunk stores and searches logs, and Umbrella provides DNS-layer security, so A, B and C cannot detonate a file.

pxGrid is the Cisco publish and subscribe framework that lets platforms such as ISE and Firewall Management Center exchange contextual information. Syslog, SNMP traps, and NetFlow are one-way telemetry or notification mechanisms and do not provide the shared context exchange described, so A, B and D are wrong.

Cisco XDR is a cloud-based detection and response platform that correlates telemetry from several Cisco and partner products into shared investigations. The Dynamic Attributes Connector passes tags to policies, eStreamer streams events to a client, and ISE enforces access policy, so A, B and C are not the correlating console.

Threat Intelligence Director imports threat intelligence in STIX and TAXII form and turns the resulting indicators into observables that the detection engine can match. Replacing intrusion policies and encrypting traffic are not TID functions, so C and D are wrong.

The Secure Endpoint cloud supplies file dispositions that a file policy can use for lookups. Umbrella handles DNS-layer security, ISE handles access and profiling, and a Splunk Cloud forwarder moves logs, so A, B and C do not provide file dispositions.

eStreamer is the Firewall Management Center interface that streams structured event records to external consumers such as a Splunk add-on. SNMP polling reads counters, NetFlow exports flow summaries, and DHCP option relay handles address assignment, so A, C and D do not stream event records.

Rapid Threat Containment lets Firewall Management Center work with ISE over pxGrid so that a detected endpoint can be quarantined. Threat Intelligence Director imports indicators, Security Analytics and Logging stores logs, and Secure Malware Analytics runs sandbox analysis, so A, B and D do not quarantine endpoints.