Cisco CCNP 300-710 SNCF Practice Exam

• A. For the dynamic routing feature, if the master unit fails, the newly elected master unit maintains all existing connections
• B. Integrated Routing and Bridging is supported on the master unit.
• C. Site-to-site VPN functionality is limited to the master unit, and all VPN connections are dropped if the master unit fails. Correct answer
• D. All Secure Firewall appliances can support Cisco FTD clustering.

Site-to-site VPN functionality on a Cisco FTD cluster is only supported on the control (master) unit; if that unit fails and a new control unit is elected, existing VPN sessions are dropped and must re-establish. Cluster members don't synchronize VPN state the way they do for firewall connections, and not every Secure Firewall appliance model supports clustering in the first place.

• A. The units must be the same version Correct answer
• B. Both devices can be part of a different group that must be in the same domain when configured within the FMC.
• C. The units must be different models if they are part of the same series.
• D. The units must be configured only for firewall routed mode.
• E. The units must be the same model. Correct answer

For two Cisco FTD devices to form a high-availability pair, they must be the same model and run the same software version, since mismatched hardware or software prevents state synchronization. High-availability pairs also need to be in the same domain within FMC and share a firewall mode, so devices of different models can't be paired.

• A. transparent inline mode
• B. TAP mode Correct answer
• C. strict TCP enforcement
• D. propagate link state

TAP mode, configured under the inline set's advanced properties, makes the inline interface pair behave like a passive interface -- traffic is copied for inspection but not blocked -- without physically rewiring it as a passive tap. Strict TCP enforcement and propagate link state control different inline-set behaviors, not passive-style operation.

• A. inline interfaces, security zones, MTU, and mode
• B. passive interface, MTU, and mode
• C. inline interfaces, MTU, and mode Correct answer
• D. passive interface, security zone, MTU, and mode

Deploying a managed device in inline mode requires configuring the inline interface pair, setting a matching MTU on both interfaces, and selecting the interface mode. A passive interface or security zone alone doesn't establish the inline path needed for the device to sit directly in the traffic flow.

• A. Gi0/1, Gi0/2 and Gi0/3
• B. Gi0/1 and Gi0/2 only Correct answer
• C. Gi0/1, Gi0/2 and Gi0/4
• D. Gi0/1, Gi0/2, Gi0/3 and Gi0/4

Option B is correct because an ECMP traffic zone only load-balances routes that are truly equal cost to the same destination, and in the exhibit only Gi0/1 (203.0.113.2/30) and Gi0/2 (198.51.100.2/30) carry a 0.0.0.0/0 route with metric 1. The default route out Gi0/3 has metric 5, so it loses the route comparison and never enters the ECMP set, which rules out options A and D. Gi0/4 does not have a default route at all, only 172.16.0.0/12 with metric 1, so it is used for that private range rather than Internet traffic, ruling out option C.

• A. Redundant Interface
• B. EtherChannel
• C. Speed Correct answer
• D. Media Type
• E. Duplex Correct answer

A routed interface on Cisco FTD requires speed and duplex to be set explicitly as part of bringing the interface up. EtherChannel and Redundant Interface are separate interface types you'd configure instead of a plain routed interface, and media type isn't a required routed-interface setting.

• A. a default DMZ policy for which only a user can change the IP addresses.
• B. deny ip any
• C. no policy rule is included Correct answer
• D. permit ip any

When a new zone/interface is added during initial NGFW deployment through FMC, no default access control rule is created for it -- traffic to and from a newly defined DMZ isn't automatically permitted or denied until the administrator writes a rule.

• A. VPN connections can be re-established only if the failed master unit recovers.
• B. Smart License is required to maintain VPN connections simultaneously across all cluster units.
• C. VPN connections must be re-established when a new master unit is elected. Correct answer
• D. Only established VPN connections are maintained when a new master unit is elected.

In a Cisco FTD cluster, VPN sessions live only on the master/control unit, so when a new master is elected after a failure, existing VPN connections don't carry over and must be re-established from scratch. A Smart License requirement and permanent inability to recover aren't accurate descriptions of this limitation.

• A. time range
• B. security group tag
• C. network object Correct answer
• D. DNS server group

Network objects support per-device overrides in FMC, letting the same object resolve to a different value (like a different IP) on different managed devices. Time ranges, security group tags, and DNS server groups don't support this override mechanism.

• A. Static NAT rules are evaluated only after all dynamic rules have been exhausted.
• B. It is in the manual NAT section after auto NAT, so the dynamic PAT rule in the auto NAT section matches the traffic first. Correct answer
• C. The dynamic PAT rule has fewer hits than the exemption rule and therefore takes priority.
• D. It has no destination object, so it cannot match traffic to 172.20.0.0/16.

Option B is correct because the exhibit shows the identity NAT exemption for 10.1.0.0/16 to 172.20.0.0/16 sitting in Manual NAT Policies (Section 3), which is the after-auto section, while the dynamic PAT rule sits in Auto NAT Policies (Section 2); NAT is processed Section 1, then Section 2, then Section 3, so the PAT rule matches first, which is why the exemption shows translate_hits = 0 and the IPsec SA shows zero packets encrypted. Moving the exemption into Section 1 (manual NAT before auto NAT) fixes it. Option D is wrong because the rule clearly has destination REMOTE-NET 172.20.0.0/16, and Options A and C invent an ordering by rule type or hit count that NAT does not use.

• A. Create a custom search in Secure Firewall Management Center, and select it in each section of the report.
• B. Add an Input Parameter in the Advanced Settings of the report and set the type to Network/IP. Correct answer
• C. Add a Table View section to the report with the Search field defined as the network in CIDR format.
• D. Select IP Address as the X-Axis in each section of the report.

An Input Parameter of type Network/IP in the report's Advanced Settings lets the report be scoped to just the specified subnet at generation time, without hand-editing every section. A custom search would need to be reapplied to each section separately, a Table View search field only filters that one section, and choosing IP Address as the X-Axis changes how data is charted, not which subnet it covers.

• A. configure manager local 10.0.0.10 Cisco123
• B. configure manager add Cisco123 10.0.0.10
• C. configure manager local Cisco123 10.0.0.10
• D. configure manager add 10.0.0.10 Cisco123 Correct answer

The correct FTD CLI syntax is 'configure manager add <FMC IP> <registration key>' -- IP address first, then the key. The other options either reverse that order or use 'local' instead of 'add', which is the syntax for a locally managed FDM device, not registering to a remote FMC.

• A. The option indicates whether the packet was dropped or successful. Correct answer
• B. The option indicated whether the destination host responds through a different path.
• C. The option limits the number of packets that are captured.
• D. The option captures details of each packet.

Selecting the trace option on a packet capture reports whether each captured packet was ultimately dropped or successfully forwarded, which is its specific diagnostic value. It doesn't reveal an alternate return path, cap the number of packets captured, or add extra per-packet detail beyond that drop/pass verdict.

• A. An option to re-apply NAT and VPN policies during registration is available, so users do not need to reapply the policies after registration is completed.
• B. Before re-adding the device in Cisco FMC, you must add the manager back in the device.
• C. No option to delete and re-add a device is available in the Cisco FMC web interface.
• D. The Cisco FMC web interface prompts users to re-apply access control policies. Correct answer
• E. There is no option to re-apply NAT and VPN policies during registration is available, so users need to re-apply the policies after registration is completed. Correct answer

Cisco FMC prompts the administrator to re-apply access control policies after a device is deleted and re-added, and there is no option to automatically re-apply NAT and VPN policies during that re-registration -- both have to be reconfigured by hand. An option to skip re-adding policies, or a claim that deleting and re-adding isn't possible at all, doesn't match how FMC actually behaves here.

• A. There is no route to the destination network.
• B. An access control rule denies TCP port 23 from the inside zone to the outside zone. Correct answer
• C. The default action of the policy blocks traffic that matches no rule.
• D. The NAT policy has no translation for the source address.

Option B is correct because Phase 4 of the trace is an ACCESS-LIST phase with Result DROP, and the matching entry is 'deny tcp ifc inside any ifc outside any eq telnet' with the remark naming the L4 rule Block-Telnet, which is exactly the port 23 flow being traced. The Drop-reason confirms it as (acl-drop) Flow is denied by configured rule, so A and C are wrong because the route lookup in Phase 3 succeeded and the rule that matched is a user rule rather than the default action, and D is wrong because NAT is never reached and would report a different drop reason.

• A. application blocking Correct answer
• B. simple custom detection Correct answer
• C. file repository
• D. exclusions
• E. application whitelisting

Application blocking and simple custom detection are the two Cisco Secure Endpoint features that let an administrator block a specific uploaded file outright, whether by application policy or by its exact hash. A file repository just stores samples, exclusions specifically exempt files from scanning, and application whitelisting permits software rather than blocking a file.

• A. Windows domain controller
• B. audit Correct answer
• C. triage
• D. protection

The Audit policy in Cisco Secure Endpoint is specifically designed for passive, monitor-only visibility without taking any blocking action -- ideal for baselining endpoint activity. Triage and Protection policies actively enforce detections, and 'Windows domain controller' isn't a real AMP policy type.

• A. non-malicious
• B. malware Correct answer
• C. known-good
• D. pristine

Malware is one of the actual file dispositions Cisco Secure Endpoint returns, alongside clean and unknown; 'non-malicious', 'known-good', and 'pristine' aren't dispositions Secure Endpoint actually uses.

• A. unavailable Correct answer
• B. unknown
• C. clean
• D. disconnected

When Cisco Secure Firewall Malware Defense can't reach the cloud to check a file's reputation, it returns 'unavailable' as the disposition rather than treating the file as clean, unknown, or disconnected -- those aren't the actual value used for this condition.

• A. The download from SRV1 is blocked; the download from SRV2 is allowed because no file policy applies Correct answer
• B. The download from SRV2 is blocked; the download from SRV1 is allowed
• C. Both downloads are blocked, because the malware cloud verdict applies to every rule
• D. Both downloads are allowed, because the connection to the malware cloud is made by FMC1

Option A is correct because the exhibit attaches the Block Malware file policy with cloud lookup only to rule 1, which matches destination 10.9.9.10 (SRV1), while rule 2 for destination 10.9.9.20 (SRV2) has no file policy at all. File inspection only happens on traffic matched by a rule that references a file policy, so the same file is blocked coming from SRV1 and passes untouched from SRV2. Option C is wrong because a cloud verdict is irrelevant where no file policy runs, option B reverses the two rules, and option D misreads FMC1's cloud connection as removing the need for a file policy on the rule.