300-710: Certifications: CCNP Security, Cisco Certified Specialist - Network Security Firepower

An organization has implemented Cisco Firepower without IPS capabilities and now wants to enable inspection for their traffic.

They need to be able to detect protocol anomalies and utilize the Snort rule sets to detect malicious behavior. How is this accomplished?

Modify the network discovery policy to detect new hosts to inspect.
Modify the access control policy to redirect interesting traffic to the engine.
Modify the intrusion policy to determine the minimum severity of an event to inspect.
Modify the network analysis policy to process the packets for inspection.

Correct answer: D

Explanation:

https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdmintrusion.html

A hospital network needs to upgrade their Cisco FMC managed devices and needs to ensure that a disaster recovery process is in place. What must be done in order to minimize downtime on the network?

Configure a second circuit to an ISP for added redundancy
Keep a copy of the current configuration to use as backup
Configure the Cisco FMCs for failover
Configure the Cisco FMC managed devices for clustering.

Correct answer: C

An engineer is monitoring network traffic from their sales and product development departments, which are on two separate networks.

What must be configured in order to maintain data privacy for both departments?

Use a dedicated IPS inline set for each department to maintain traffic separation
Use 802 1Q mime set Trunk interfaces with VLANs to maintain logical traffic separation
Use passive IDS ports for both departments
Use one pair of inline set in TAP mode for both departments

Correct answer: D

Explanation:

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/inline_sets_and_passive_interfaces_for_firepower_threat_defense.html

With Cisco FTD software, which interface mode must be configured to passively receive traffic that passes through the appliance?

ERSPAN
IPS-only
firewall
tap

Correct answer: A

Explanation:

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-configguide-v64/interface_overview_for_firepower_threat_defense.html

A Cisco FTD device is running in transparent firewall mode with a VTEP bridge group member ingress interface.

What must be considered by an engineer tasked with specifying a destination MAC address for a packet trace?

The destination MAC address is optional if a VLAN ID value is entered
Only the UDP packet type is supported
The output format option for the packet logs unavailable
The VLAN ID and destination MAC address are optional

Correct answer: A

Explanation:

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/troubleshooting_the_system.html

What is a characteristic of bridge groups on a Cisco FTD?

In routed firewall mode, routing between bridge groups must pass through a routed interface.
In routed firewall mode, routing between bridge groups is supported.
In transparent firewall mode, routing between bridge groups is supported
Routing between bridge groups is achieved only with a router-on-a-stick configuration on a connected router

Correct answer: B

Explanation:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/intro-fw.pdf

Network traffic coining from an organization's CEO must never be denied.

Which access control policy configuration option should be used if the deployment engineer is not permitted to create a rule to allow all traffic?

Configure firewall bypass.
Change the intrusion policy from security to balance.
Configure a trust policy for the CEO.
Create a NAT policy just for the CEO.

Correct answer: C

An organization has a compliancy requirement to protect servers from clients, however, the clients and servers all reside on the same Layer 3 network.

Without readdressing IP subnets for clients or servers, how is segmentation achieved?

Deploy a firewall in transparent mode between the clients and servers.
Change the IP addresses of the clients, while remaining on the same subnet.
Deploy a firewall in routed mode between the clients and servers
Change the IP addresses of the servers, while remaining on the same subnet

Correct answer: C

In a multi-tenant deployment where multiple domains are in use. Which update should be applied outside of the Global Domain?

minor upgrade
local import of intrusion rules
Cisco Geolocation Database
local import of major upgrade

Correct answer: C

A mid-sized company is experiencing higher network bandwidth utilization due to a recent acquisition. The network operations team is asked to scale up their one Cisco FTD appliance deployment to higher capacities due to the increased network bandwidth.

Which design option should be used to accomplish this goal?

Deploy multiple Cisco FTD appliances in firewall clustering mode to increase performance.
Deploy multiple Cisco FTD appliances using VPN load-balancing to scale performance.
Deploy multiple Cisco FTD HA pairs to increase performance
Deploy multiple Cisco FTD HA pairs in clustering mode to increase performance

Correct answer: A

Explanation:

https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/clustering/ftd-cluster-solution.html#concept_C8502505F840451C9E600F1EED9BC18E

Vendor:	Cisco
Exam Code:	300-710
Exam Name:	Certifications: CCNP Security, Cisco Certified Specialist - Network Security Firepower
Date:	Mar 21, 2024
File Size:	2 MB
Downloads:	37

Download Certifications: CCNP Security, Cisco Certified Specialist - Network Security Firepower.300-710.Braindump2go.2024-03-21.282q.vcex

How to open VCEX files?

Demo Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

ProfExam at a 20% markdown