10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
These 10 free SNCF questions are organized by exam domain, so you can see how each part of the Securing Networks with Cisco Firepower (SNCF) (300-710) blueprint is tested. Reveal the answer and explanation under each question.
Review this proposed HA connection to the access switch: two Firepower 4100 appliances will run FTD as an Active/Standby pair, each with a two-link EtherChannel to the same switch. The switch configuration places all four links in one port channel because the firewalls share the active interface addresses. Identify the required revision before cutover.
Correct answer: A - Create one switch-side port channel for each firewall's two links.
The second WAN at a retail site must carry no application traffic while the primary is healthy. FTD uses ISP-A as the preferred IPv4 path and ISP-B as backup. An outage beyond ISP-A's first-hop gateway makes the application network unreachable, yet the gateway still answers pings and the local link stays up. A stable ICMP responder on the application network is available for monitoring, with probes constrained to ISP-A. Choose the design that detects this failure while preserving backup-only use.
Correct answer: C - Prefer ISP-A and track its route with the application-network probe.
A firewall insertion must preserve existing host addresses and gateways and keep FTD in transparent mode. The proposed design assigns VLANs 110 and 120 to separate bridge groups, removes the router that connects their subnets, and expects FTD to take over inter-VLAN routing. Which design change preserves the project's constraints?
Correct answer: A - Retain the external router; let FTD bridge traffic within each group.
A supplier's HTTPS file uploads match a deployed Trust rule on an FMC-managed FTD. TLS decryption is confirmed, and Malware Defense licensing is active. The security team needs malicious uploads blocked while legitimate uploads remain permitted. The rule's source, destination, and application conditions are correct. How should the policy be changed?
Correct answer: C - Change Trust to Allow and attach a file policy configured to Block Malware.
Two static auto NAT rules on an FTD use the same inside-to-outside interfaces: BRANCH_LAN, created first: 10.44.8.0/24 maps to 198.51.100.0/24. PUBLISHER_HOST, created later: host 10.44.8.37 maps to 203.0.113.9. No earlier NAT section matches, and no existing translation applies. Which source address is used for a new outbound connection from 10.44.8.37, and why?
Correct answer: D - 203.0.113.9, because the host object contains fewer real addresses than the subnet object.
During a controlled test, an inline FTD running Snort 3 in Prevention mode matches a custom intrusion rule with the Drop action. The matching TCP segment is discarded and an event is recorded, but later nonmatching segments are forwarded. The revised requirement is to discard the matching segment and all subsequent connection traffic, retain an event, and send no TCP reset. Select the rule action that produces all three effects.
Correct answer: D - Block
An FMC-managed FTD 10.0 blocks a backup transfer under EVE Protect, set to Very High. Its event shows Process Confidence 99%, Threat Confidence category Very High, and Reason Encrypted Visibility Block. Independent endpoint and vendor checks confirm the transfer is legitimate. An exception is approved for this source/destination pair; all other pairs must retain EVE protection, and the backup must retain intrusion inspection. Select the change that restores the transfer within that scope.
Correct answer: B - Add an EVE exception for the approved source/destination pair; retain its inspected Allow rule.
New HTTPS connections to an external payroll API fail after its server upgrade. FTD captures show a SYN leaving toward the documented server address and TCP port 443, followed by a matching RST-ACK arriving from outside. FTD forwards that reset to the original client with the expected reverse translation. The TCP handshake never completes. Where does the packet evidence direct the investigation?
Correct answer: A - The path beyond FTD, to locate rejection by the remote listener or intervening network controls.
Enabling both connection-start and connection-end logging nearly doubles a SIEM's reported firewall session count. Paired records share the same device and connection identifiers; some sessions are still open at the reporting cutoff. The team requires immediate session visibility and complete details when sessions end. Which counting method preserves those requirements?
Correct answer: D - Correlate start and end records by connection, count each connection once, and retain both observations.
A wired workstation is confirmed to be encrypting shared files. The response plan requires blocking its lateral production access while retaining a dedicated forensic service. FMC sends an ANC Quarantine request through pxGrid; ISE 3.3 applies the policy and the switch accepts the Change of Authorization. The matched ISE authorization profile still permits production traffic, and SMB connections continue. What will enforce the required containment?
Correct answer: B - Apply a profile that permits the forensic service and denies lateral production access, then reauthorize the session.
The full bank has 1,020 more SNCF questions with explanations.
Continue in the free practice test →
View plans