300-710 Securing Networks with Cisco Firepower (300-710 SNCF) v1.2 Questions and Answers

Intrusion events provide the detection evidence needed to understand which signatures fired, the affected source and destination addresses, event severity, protocol information, and other indicators associated with the suspected compromise. Host connections provide the corresponding network context, allowing the analyst to determine which systems communicated, when the sessions occurred, and which ports, applications, or protocols were involved. Together, these details connect security detections with the traffic flows that produced them and support reconstruction of the incident. Client applications by user and user connections are useful when the investigation is primarily identity-focused, but they do not provide the same direct combination of exploit evidence and host-level network activity. The number of attacked machines is an aggregate measurement and lacks the granular information necessary to investigate the suspicious communications and determine their cause.

Secure Firewall Management Center evaluates access control entries sequentially from the lowest sequence number to the highest and stops processing after the first match. Because host 10.236.131.1 is contained within network 10.236.131.0/24, the specific host exception must appear before the broader subnet block. Sequence 1 must therefore allow 10.236.131.1, and sequence 2 must block 10.236.131.0/24. If the subnet block were placed first, traffic to 10.236.131.1 would match that entry and never reach the subsequent host allow entry. Cisco recommends placing more specific entries above general entries for exactly this reason. In an access list object, Allow identifies traffic to which the associated service applies, while Block excludes it from that service; it does not necessarily mean the firewall drops the packet. Cisco access-list object documentation

Change Reconciliation records snapshots whenever users save system-configuration changes and combines those snapshots into a detailed report covering the previous 24 hours. Under System > Configuration > Change Reconciliation, the administrator enables the feature, selects the daily execution time, and specifies management’s recipient email addresses. The administrator can also include policy-configuration changes and enable the full change history instead of receiving only a consolidated view. An email relay host must be configured so that Management Center can deliver the report. Sending audit logs to an HTTP or syslog server streams audit events to an external collector; it does not generate the required daily email summary. STIG Compliance applies security-hardening settings and is unrelated to scheduled change reporting. Cisco Change Reconciliation documentation

When packet capture is used on a Cisco Secure Firewall Threat Defense (FTD) device and the packet flow is waiting on the malware query, the Snort verdict appears as " retry. " This indicates that the device is still processing the malware analysis and has not yet determined the final action for the packet.

The " retry " verdict signifies that the packet is in a holding state while awaiting the result of the malware inspection, which helps in maintaining the security posture until a definitive decision is made.

When configuring a custom widget on a dashboard within Cisco Secure Firewall Management Center (FMC), it is mandatory to provide a title for the system to display the information correctly. The title helps in identifying and organizing the widget on the dashboard.

Steps:

Navigate to the dashboard section in FMC.

Add a new custom widget.

Configure the widget settings and provide a title.

Save and apply the widget to the dashboard.

Providing a title ensures that the widget is correctly displayed and easily identifiable on the dashboard.

Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of its screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a “bump in the wire,” or a “stealth firewall,” and is not seen as a router hop to connected devices. However, like any other firewall, access control between interfaces is controlled, and all of the usual firewall checks are in place. Layer 2 connectivity is achieved by using a " bridge group " where you group together the inside and outside interfaces for a network, and the ASA uses bridging techniques to pass traffic between the interfaces. Each bridge group includes a Bridge Virtual Interface (BVI) to which you assign an IP address on the network. You can have multiple bridge groups for multiple networks. In transparent mode, these bridge groups cannot communicate with each other.https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/intro-fw.html

When performing packet capture on a Cisco Secure Firewall Threat Defense (FTD) device, ensuring that the allocated memory is sufficient is crucial for capturing all necessary traffic during a specified capture session. If users experience issues accessing a server and the engineer suspects not all traffic was collected, it indicates that the current memory allocation might not be enough to store the entire capture data for the 15-minute session.

Steps:

Check the current memory allocation for packet captures on the FTD device.

Increase the memory allocation if it is insufficient to handle the volume of traffic expected during the capture session.

This ensures that all relevant traffic is captured and can be analyzed to diagnose and resolve the network issue.

SNMP provides nonintrusive, read-only monitoring of Secure Firewall Threat Defense devices and is appropriate for collecting high-level device statistics without interrupting production traffic. An external network management system can poll supported Management Information Base objects to obtain CPU utilization, memory usage, interface statistics, Snort information, process status, high-availability state, and cluster health. SNMP traps can also report important events without requiring continuous manual access to the device. Malware reports focus on malicious files and malware events, while risk reports summarize security risks and attacks. Host reports describe discovered hosts, applications, operating systems, and vulnerabilities rather than overall device performance. Because the requirement concerns device-level statistics and minimizing operational disruption during peak season, SNMP monitoring is the most appropriate choice. Cisco Secure Firewall SNMP monitoring

================

After setting the interface mode to inline and enabling the interfaces on a Cisco Secure Firewall Threat Defense (FTD) device in an inline IPS deployment, the next step is to configure an inline set. An inline set groups two interfaces that work together to inspect traffic passing between them.

Steps to configure an inline set:

In FMC, navigate toDevices > Device Management.

Select the FTD device and configure the interfaces.

Create a new inline set, adding the relevant interfaces that have been set to inline mode.

Deploy the configuration to the FTD device.

Configuring an inline set ensures that the traffic between the specified interfaces is inspected and processed according to the IPS policies, completing the implementation of the inline IPS deployment.

Disseminate: The dissemination phase publishes the results of the investigation or threat hunt. This information is disseminated with a focus on the receivers of the information. At the tactical level, this information feeds back into the beginning of the F3EAD model, Find. Figure 3 illustrates the F3EAD model.

The “Risky Applications with Low Business Relevance” widget identifies BitTorrent as the most significant application risk, with 342 connections—substantially more than the other applications displayed. BitTorrent is a peer-to-peer application that can introduce malware, facilitate unauthorized file transfers, consume bandwidth, and bypass normal content-distribution controls. The engineer should configure an access control rule or application filter that blocks all BitTorrent applications. Google Play appears only as a frequently used web application and is not identified by the dashboard as the primary risky application. Disabling a user account would not address BitTorrent usage by other users, while patching Chrome concerns endpoint vulnerability management rather than application usage risk. Cisco application-control rules can block applications according to risk and business relevance. Cisco application-control documentation

To configure Active Directory authentication for VPN authentication on a Cisco Secure Firewall Threat Defense (FTD) instance registered with Cisco Secure Firewall Management Center (FMC), the administrator needs to configure Realms in the System settings of the FMC. Realms in FMC are used to define the directory servers (e.g., Active Directory) and how they are used for user authentication.

Steps to configure this in FMC:

Navigate toSystem > Integration > Realms and Directory.

Add a new realm and configure the necessary details such as the directory server type (e.g., Active Directory), server address, and bind credentials.

Test the connection to ensure it works correctly.

This setup allows the FMC to authenticate VPN users against the Active Directory, thereby enabling secure access control for VPN connections.

When an FTD device that is managed by FDM is registered to FMC, the existing configuration is automatically converted and imported into FMC. The FMC then pushes the configuration back to the device. This process preserves most of the FDM configuration, except for some features that are not supported by FMC, such as VPN wizards and certificates.

Change Reconciliation is specifically designed to generate and email a detailed summary of configuration changes made during the preceding 24 hours. Secure Firewall Management Center takes snapshots when users save configuration changes and consolidates those records into a daily change report. The administrator can enable the feature, select the scheduled delivery time, specify recipient email addresses, and optionally include the full change history. Sending audit logs to a syslog or HTTP server exports individual audit events to an external system but does not automatically generate the required daily management report. STIG Compliance evaluates the system against security configuration guidance and is unrelated to change reporting. Therefore, Change Reconciliation is the only option that directly satisfies both the 24-hour reporting period and email-delivery requirements. Cisco Change Reconciliation configuration

================

To protect and encrypt the synchronization/failover traffic between Cisco Secure Firewall Threat Defense (FTD) high-availability or cluster units, the correct action is to encrypt the synchronization traffic with IPsec (via the failover/state link configuration) or choose the appropriate cryptographic authentication/key settings

If an engineer receives a 403: Forbidden error when attempting to download a packet capture file from Cisco Secure Firewall Management Center (FMC), the issue is likely due to HTTPS not being enabled in the device platform policy. To resolve this issue, the engineer must enable HTTPS in the platform policy.

Steps:

In FMC, navigate toPolicies > Device Management > Platform Settings.

Edit the relevant platform policy.

Enable HTTPS for the device.

Deploy the changes to the FTD device.

This ensures that the FMC and FTD device can securely transfer the packet capture file over HTTPS, resolving the 403 error.

The capture shows that the client repeatedly transmits a TCP SYN but does not receive the SYN-ACK required to advance the connection state. This indicates that the return portion of the TCP three-way handshake is not reaching the expected ingress interface or is not being processed there. The outside interface must therefore be configured or connected so that the returning SYN-ACK packets arrive through the interface where the firewall expects them. An access rule does not instruct an interface to generate TCP acknowledgement messages; ACK and SYN-ACK packets are produced by the communicating endpoints. Likewise, permitting communication “with the DMZ” does not address the missing return-handshake packet shown in the capture. Correcting the return path through the outside interface allows the firewall to observe both directions, establish state, and forward the subsequent packets.

================

To ensure high availability of internet access when deploying a pair of Cisco Secure Firewall Threat Defense (FTD) devices managed by Cisco Secure Firewall Management Center (FMC), the following features must be deployed:

Route Tracking:This feature monitors the reachability of a specified target (such as an external IP address) through the configured routes. If the route to the target is lost, the FTD can dynamically adjust the routing to use an alternate path, ensuring continuous internet access.

SLA Monitor:Service Level Agreement (SLA) monitoring works alongside route tracking to continuously verify the status and performance of the internet links. If the SLA for one of the ISP links fails (indicating the link is down or underperforming), the FTD can switch traffic to the secondary ISP link.

Steps to configure:

In FMC, navigate toDevices > Device Management.

Select the FTD device and configure route tracking to monitor the ISP links.

Configure SLA monitors to continuously check the health and performance of the internet circuits.

These configurations ensure that internet access remains available to users even if one of the ISPs goes down.

To determine if a host is infected with malware, the network administrator can look at the Indications of Compromise (IOC) feature in Cisco FMC. The IOC feature analyzes network and endpoint data collected by Firepower sensors and AMP for Endpoints connectors, and identifies hosts that exhibit signs of compromise or infection. The IOC feature uses predefined rules based on Cisco Talos intelligence and other sources to detect IOCs on hosts. One of these rules is CnC Connected, which indicates that a host has communicated with a command-and-control (CnC) server that is known to be associated with malware activity2.

To view the IOC information for a host, the network administrator can navigate to Analysis > Hosts > Indications of Compromise in Cisco FMC, and select a host from the table. The IOC Details page will show the IOC events for that host, including the CnC Connected event, along with other information such as severity, timestamp, source, destination, protocol, and rule name. The network administrator can also view more details about each IOC event by clicking on it2.

The other options are incorrect because:

Analysis > Files > Malware Events shows information about files that have been detected as malware by Firepower sensors or AMP for Endpoints connectors. This does not show information about hosts that are infected with malware or have communicated with CnC servers3.

Analysis > Hosts > Host Attributes shows information about hosts that have been discovered by Firepower sensors, such as IP address, MAC address, operating system, applications, users, vulnerabilities, and so on. This does not show information about IOCs or CnC connections on hosts4.

Analysis > Files > Network File Trajectory shows information about files that have traversed your network and have been detected by Firepower sensors or AMP for Endpoints connectors. This allows you to track where a file came from, where it went, and what happened to it along the way. This does not show information about hosts that are infected with malware or have communicated with CnC servers5.

An inline set consists of paired Secure Firewall Threat Defense interfaces placed directly in the network traffic path. The interfaces operate like a bump in the wire: one interface receives the traffic, the inspection engine evaluates it, and the paired interface retransmits it unless an access-control, intrusion, file, or other security policy explicitly drops it. This arrangement enables the IPS to prevent attacks because the device can stop malicious packets before forwarding them. A passive interface also receives traffic unconditionally, but it receives copied traffic from a SPAN or mirror port and retransmits none of it. Routed and transparent modes describe broader firewall packet-forwarding behavior rather than this IPS-only interface characteristic. Therefore, an inline deployment satisfies the requirement to inspect, retransmit, and selectively drop traffic. Cisco inline-set documentation

================

Explanation

Cisco Defense Orchestrator (CDO) is the tool that assists engineers in performing an audit of network projects to determine which objects are duplicated across various firewall models, including Cisco Secure Firewall Threat Defense, Cisco Secure Firewall ASA, and Meraki MX Series. CDO provides a unified management interface for managing multiple security devices and can identify duplicate objects across these devices.

Steps:

Access Cisco Defense Orchestrator.

Connect and synchronize all relevant firewall devices (FTD, ASA, Meraki MX).

Use the audit and reporting features in CDO to identify and manage duplicate objects.

This helps ensure consistency and efficient management across the organization ' s firewall deployments.

To change the mode of a Cisco Secure Firewall Threat Defense (FTD) device in the Cisco Secure Firewall Management Center (FMC) inventory, the engineer must follow these steps:

Register the Secure FTD with Secure FMC.

Change the firewall mode.

Deregister the Secure FTD device from Secure FMC.

To perform these actions, accessing the Secure FTD CLI from the console port is necessary. This allows the engineer to execute the required commands to change the firewall mode and manage the registration status of the FTD device.

Steps:

Connect to the Secure FTD device via the console port.

Access the CLI and execute the command to change the firewall mode (configure firewall-mode).

Deregister the device from FMC if needed.

Register or re-register the device with FMC as required.

The content keyword is used to specify a string or pattern to search for in the payload or stream of a packet. The string must be enclosed in quotation marks and can use modifiers such as nocase, depth, offset, and so on. The string can also use hexadecimal notation by using a pipe symbol (|) before and after the hexadecimal characters. For example, content: " |45 5* 26 27 4 0A| " will match any payload or stream that contains the hexadecimal bytes 45 5 26 27 4 0A followed by any number of bytes2

Reason: the command " capture-traffic " is used for SNORT Engine Captures. To capture a LINA Engine Capture, you use the " capture " command. Since the Lina Engine represents the actual physical interface of the device, " capture " is the only reasonable choice Reference:https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212474-working-with-firepower-threat-defense-f.html#anc10

The command is

firepower# capture DMZ interface dmz trace detail match ip host 192.168.76.14 host 192.168.76.100

firepower# capture INSIDE interface inside trace detail match ip host 192.168.76.14 host 192.168.75.14

Name → HTTP-HTTPS-QoS

Apply QoS On → Interfaces in Destination Interface Objects

Download/Upload Limit → 5 Mb/s

Source Interface Networks → 192.168.1.0/24

Destination Interface Networks → 192.168.2.0/24

Destination Ports → HTTP-HTTPS

The HR workstation resides on the inside 192.168.1.0/24 network, making that subnet the source-interface network. Internet-bound traffic exits through the 192.168.2.0/24 network, which must be configured as the destination-interface network. Because rate limiting must occur as traffic leaves toward the internet, QoS is applied to interfaces in the destination interface objects. The HTTP-HTTPS object identifies the destination ports for web traffic, while HTTP-HTTPS-QoS provides a descriptive rule name. Both download and upload limits are configured as 5 Mb/s. Cisco Secure Firewall applies a QoS limit independently on each selected interface and determines upload and download direction based on the connection initiator. The Apply QoS On selection must correspond to a populated source or destination interface condition. Cisco Secure Firewall QoS configuration

To ensure that router R2 removes the directly connected route for 192.168.1.0/24 from its routing table when the cable between router R1 and the Secure FTD device is disconnected, the network engineer must implement the " Propagate Link State " option on the Secure FTD device. This option allows the FTD to propagate the link state changes to adjacent devices, ensuring that the disconnection is recognized and the routing table is updated accordingly.

Steps:

Access the FTD device configuration via FMC.

Navigate to the interface settings for the relevant interfaces.

Enable the " Propagate Link State " option for the interfaces connected to R1 and R2.

Deploy the changes to the FTD device.

This configuration ensures that the link state changes are communicated to router R2, prompting it to remove the disconnected route from its routing table.

Cisco Secure Firewall Threat Defense Virtual (FTDv) appliances support High Availability (HA) configurations in specific virtual environments. The supported environments for HA setups include:

ESXi: VMware ' s ESXi is a widely supported platform for deploying FTDv appliances in HA configurations.

AWS: Amazon Web Services (AWS) supports FTDv appliances and allows for HA configurations to ensure redundancy and reliability in cloud deployments.

These environments provide the necessary infrastructure and capabilities to support the high availability requirements for FTDv appliances.

A local SPAN configuration requires a numbered monitoring session with a source interface and a different destination interface. Gi0/1 is the switch interface whose traffic must be copied, while Gi0/3 is connected to the passive Cisco Secure IPS sensor and must therefore be the SPAN destination. Option C correctly associates both commands with session 1 and maps the monitored traffic from Gi0/1 to Gi0/3. Option B incorrectly makes Gi0/3 both the source and destination, which cannot provide the required monitoring path. Options A and D omit the mandatory session 1 portion of the Catalyst SPAN syntax. Because the IPS operates passively, it receives copies of packets on its monitoring interface without becoming an inline forwarding device and without being able to disrupt the production traffic.

================

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699-configure-ftd-high-availability-on-firep.html

Conditions

In order to create an HA between 2 FTD devices, these conditions must be met:

Same model

Same version (this applies to FXOS and to FTD - (major (first number), minor (second number), and maintenance (third number) must be equal))

Same number of interfaces

Same type of interfaces

Both devices as part of same group/domain in FMC

Have identical Network Time Protocol (NTP) configuration

Be fully deployed on the FMC without uncommitted changes

Be in the same firewall mode: routed or transparent.

Note that this must be checked on both FTD devices and FMC GUI since there have been cases where the FTDs had the same mode, but FMC does not reflect this.

Does not have DHCP/Point-to-Point Protocol over Ethernet (PPPoE) configured in any of the interface

Different hostname (Fully Qualified Domain Name (FQDN)) for both chassis. In order to check the chassis hostname navigate to FTD CLI and run this command

https://www.cisco.com/c/en/us/td/docs/security/firepower/610/fdm/fptd-fdm-config-guide-610/fptd-fdm- interfaces.html

In the integration between Cisco Identity Services Engine (ISE) and Cisco Firewall Management Center (FMC), realms are used to define the Active Directory (AD) configuration. Realms in FMC specify the AD servers, domain, and other authentication settings necessary to authenticate and authorize users.

Steps to configure realms:

In FMC, navigate toSystem > Integration > Realms and Directory.

Add a new realm and configure the AD settings.

Ensure the realm settings match the AD environment for seamless integration.

Realms are essential for integrating AD with FMC, allowing the firewall to use AD for user authentication and policy enforcement.

Ref: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Tailoring_Intrusion_Protection_to_Your_Network_Assets.html

Cisco Secure Firewall Threat Defense supports IPsec encryption between the failover links of a high-availability pair. During HA configuration, the engineer enables encryption and selects the appropriate Key Generation method for IPsec. This protects failover and stateful synchronization data exchanged between the active and standby units. An SSL remote-access VPN is designed for user-to-network connectivity and is not used to protect an internal HA link. SSL is also not the documented encryption mechanism for Threat Defense failover synchronization. Clearing a commit queue does not encrypt or otherwise protect synchronized state information. Cisco’s HA configuration procedure explicitly instructs administrators to enable the encryption option and choose the Key Generation method for IPsec encryption between the failover links. Therefore, option B directly implements the required synchronization-protection mechanism. Cisco Secure Firewall high-availability configuration

Cisco Secure Cloud Analytics ingests network flows and traffic telemetry, such as NetFlow and cloud flow logs, and applies behavioral modeling to that information. It establishes a baseline of normal activity for entities such as hosts, users, and workloads. New activity is compared with the baseline to identify anomalies, suspicious communication patterns, lateral movement, command-and-control traffic, and potential data exfiltration. The platform does not merely forward or archive the collected information. Although its analytics may incorporate statistical methods and machine learning, Cisco specifically describes the solution as using entity and behavioral modeling. This allows it to detect threats based on how an entity acts over time, including previously unknown threats that would not necessarily match a conventional signature. Cisco Secure Cloud Analytics

================

To collect 24 hours ' worth of data using a packet capture on a Cisco Secure Firewall Threat Defense (FTD) appliance without prematurely stopping due to buffer size limitations, the engineer should increase the packet capture buffer size. The default buffer size is 32 MB, which is insufficient for extended captures.

Steps:

Access the packet capture configuration on the FTD device.

Increase the buffer size to 1 GB, which provides a significantly larger capacity for capturing packets over a 24-hour period.

Setting the buffer size to 1 GB should accommodate a substantial amount of traffic and prevent the capture from stopping prematurely.

To connect to a Secure Endpoint private cloud instance from Cisco Secure Firewall Management Center (FMC), the network engineer requires the SSL certificate for the Secure Endpoint private cloud instance. This SSL certificate is necessary to establish a secure, trusted connection between the FMC and the private cloud instance.

Steps:

Obtain the SSL certificate from the server administrator.

Import the SSL certificate into the FMC.

Configure the connection to the Secure Endpoint private cloud instance using the provided hostname and SSL certificate.

This ensures a secure and authenticated connection to the private cloud instance.

In a local SPAN configuration, the source is the switch interface whose traffic must be copied, while the destination is the interface connected to the passive monitoring device. Therefore, switch interface Gi0/1 must be configured as the SPAN source, and switch interface Gi0/3, which connects to the Cisco Secure IPS sensor, must be the destination. Both commands must also reference the same SPAN session number. Option D satisfies all these requirements. Options B and C omit the mandatory session number, while Option A incorrectly assigns Gi0/3 as both the source and destination. A SPAN destination cannot simultaneously be a source in the same session. The passive IPS receives the mirrored packets for inspection but does not retransmit or directly block them. Cisco SPAN configuration documentation

Transparent mode allows the FTD device to act as a “bump in the wire” that does not affect the IP addressing of the network. The end user workstations will not need any changes to their configuration, as they will still receive an IP address from the same DHCP server. However, the FTD device must allow DHCP traffic in the access control policies, otherwise it will block the DHCP requests and replies1

In a failover configuration with Cisco Secure Firewall Threat Defense (FTD) devices, ensuring that users on the internal network can continue to communicate with outside devices if the primary device (FTD1) fails requires the implementation of a stateful failover link. The stateful failover link allows the secondary device (FTD2) to maintain session information and state data, ensuring seamless failover and minimizing disruptions.

Steps to implement a stateful failover link:

Physically connect a stateful failover link between FTD1 and FTD2.

Configure the stateful failover link in the FMC.

Ensure that both devices are properly synchronized and that stateful failover is enabled.

Deploy the changes to both FTD devices.

By configuring a stateful link, the secondary FTD can take over active sessions without requiring users to re-establish their connections, thus ensuring continuous communication.

A correlation policy is a feature that allows you to respond in real time to threats or specific conditions on your network, using correlation rules. A correlation rule can trigger when the system generates a specific type of event, or when your network traffic deviates from its normal profile1. When a correlation rule triggers, the system generates a correlation event and can also launch a response, such as sending an alert, blocking an IP address, or scanning a host1.

In this case, the security engineer can configure a correlation rule that triggers when the system detects five or more connections from external sources within 2 minutes. The engineer can also configure a response that sends an alert to the FMC or an email recipient when this condition is triggered. The engineer can then create a correlation policy that includes this rule and activate it on the FTD device1.

The other options are incorrect because:

An application detector is a feature that allows you to detect web applications, clients, and application protocols based on patterns in network traffic. An application detector does not generate alerts based on the number of connections from external sources2.

An access control policy is a feature that allows you to control traffic flow through your network and inspect traffic for intrusions, malware, and files. An access control policy does not generate alerts based on the number of connections from external sources3.

An intrusion policy is a feature that allows you to detect and prevent malicious network activity using Snort rules. An intrusion policy does not generate alerts based on the number of connections from external sources4.