300-710_Comment_Questions Flashcards
Which command should be used on the Cisco FTD CLI to capture all the packets that hit an interface?
A. configure coredump packet-engine enable
B. capture-traffic
C. capture
D. capture WORD
Answer C
capture
To enable packet capture capabilities for packet sniffing and network fault isolation, use the capture command.
capture-traffic
To intercept and capture packets passing through the threat defense interface, use the capture-traffic command. You can capture traffic on a specified threat defense domain that matches the integer expression from the list of options presented, either the management interface (br1) or traffic interfaces.
Ingress packets are captured before most packet processing
Egress packets are captured after all processing
“>capture-traffic” is a capture in snort which shows packets reads from the DAQ
What is the benefit of selecting the trace option for packet capture?
A. The option indicates whether the packet was dropped or successful.
B. The option indicates whether the destination host responds through a different path.
C. The option limits the number of packets that are captured.
D. The option captures details of each packet.
Answer A
Packet capture is available with the trace option, which provides you with a verdict as to whether the packet is dropped or successful.
What are two features of bridge-group interfaces in Cisco FTD? (Choose two.)
A. The BVI IP address must be in a separate subnet from the connected network.
B. Bridge groups are supported in both transparent and routed firewall modes.
C. Bridge groups are supported only in transparent firewall mode.
D. Bidirectional Forwarding Detection echo packets are allowed through the FTD when using bridge-group members.
E. Each directly connected network must be on the same subnet.
Answer B and E
About Bridge Groups
* A bridge group is a group of interfaces that the Firepower Threat Defense device bridges instead of routes. Bridge groups are supported in both transparent and routed firewall mode. Like any other firewall interfaces, access control between interfaces is controlled, and all of the usual firewall checks are in place.
Guidelines for Firewall Mode
Bridge Group Guidelines (Transparent and Routed Mode)
You can create up to 250 bridge groups, with 64 interfaces per bridge group.
Each directly-connected network must be on the same subnet.
While configuring FTD, a network engineer wants to ensure that traffic passing though the appliance does not require routing or VLAN rewriting. Which interface mode should the engineer implement to accomplish this task?
A. inline set
B. passive
C. transparent
D. inline tap
Answer A
Inline set: it is called bump-on-wire mode. Traffic passes through the appliance, but it does not require routing and Vlan rewriting.
Passive: traffic does not flow through the IPS
Inline Tap: it gets a copy of the packets, traffic does not flow through the IPS
Transparent: it is Transparent inline mode, then this can be an answer as well
Which two dynamic routing protocols are supported in Cisco FTD without using FlexConfig? (Choose two.)
A. EIGRP
B. OSPF
C. static routing
D. IS-IS
E. BGP
Answer B & E
The question ask for dynamic routing protocol, “static routing” is wrong, OSPF and BGP are the right choice, both can be configured with Smart CLI without FlexConfig.
With Cisco FTD software, which interface mode must be configured to passively receive traffic that passes through the appliance?
A. inline set
B. passive
C. routed
D. inline tap
Answer D
With passive interface configuration, traffic does not “pass through” the device, the FTD is configured in an out of band mode.
Passive mode doesn’t allow to pass traffic trough the appliance. It just receive traffic.
INLINE TAP sends a COPY of the data to the SNORT Engineer where THAT COPY then is dropped… Meanwhile in parallel the actual traffic continues THROUGH the appliance uninterrupted.
What are the minimum requirements to deploy a managed device inline?
A. inline interfaces, security zones, MTU, and mode
B. passive interface, MTU, and mode
C. inline interfaces, MTU, and mode
D. passive interface, security zone, MTU, and mode
Answer C
The answer is C: Inline interface, MTU and Mode
Security zone is optional
On the advanced tab under inline set properties, which allows interfaces to emulate a passive interface?
A. transparent inline mode
B. TAP mode
C. strict TCP enforcement
D. propagate link state
Answer B
Link state propagation automatically brings down the second interface in the inline interface pair when one of the interfaces in an inline set goes down. When the downed interface comes back up, the second interface automatically comes back up, also. In other words, if the link state of one interface changes, the device senses the change and updates the link state of the other interface to match it. Note that devices require up to 4 seconds to propagate link state changes. Link state propagation is especially useful in resilient network environments where routers are configured to reroute traffic automatically around network devices that are in a failure state.
An organization has implemented Cisco Firepower without IPS capabilities and now wants to enable inspection for their traffic. They need to be able to detect protocol anomalies and utilize the Snort rule sets to detect malicious behavior. How is this accomplished?
A. Modify the network discovery policy to detect new hosts to inspect.
B. Modify the access control policy to redirect interesting traffic to the engine.
C. Modify the intrusion policy to determine the minimum severity of an event to inspect.
D. Modify the network analysis policy to process the packets for inspection.
Answer B
A network analysis policy (NAP) governs how traffic is decoded and preprocessed so that it can be further evaluated, especially for anomalous traffic that might signal an intrusion attempt.
To apply intrusion policies to network traffic, you select the policy within an access control rule that allows traffic. You do not directly assign intrusion policies.
An engineer is monitoring network traffic from their sales and product development departments, which are on two separate networks. What must be configured in order to maintain data privacy for both departments?
A. Use passive IDS ports for both departments.
B. Use a dedicated IPS inline set for each department to maintain traffic separation.
C. Use 802.1Q inline set Trunk interfaces with VLANs to maintain logical traffic separation.
D. Use one pair of inline set in TAP mode for both departments.
Answer A
Use passive IDS ports for both departments.
There’s nothing wrong with answer A. Especially since they state they are on separate networks. Do they both go out their own firewalls and internet connections? Then you would SPAN or ERSPAN copies of traffic to passive interfaces and do IDS instead of IPS. Not sure what “Data Privacy” is supposed to mean, but in IDS mode, those packets are discarded after inspection in an IDS configuration, and don’t go through the device.
With Cisco FTD software, which interface mode must be configured to passively receive traffic that passes through the appliance?
A. ERSPAN
B. firewall
C. tap
D. IPS-only
Answer D
There are only two interface modes on FTD, “You can deploy FTD interfaces in two modes: Regular firewall mode and IPS-only mode. You can include both firewall and IPS-only interfaces on the same device. IPS-only interfaces can be deployed as the following types: Inline Set, with optional Tap mode”. So you could have IPS-only as inline with tap that would make it into IDS and therefore passive. Firewall interface mode can be deployed as Routed or Bridge Groups with BVI.
An organization has a compliancy requirement to protect servers from clients, however, the clients and servers all reside on the same Layer 3 network. Without readdressing IP subnets for clients or servers, how is segmentation achieved?
A. Change the IP addresses of the servers, while remaining on the same subnet.
B. Deploy a firewall in routed mode between the clients and servers.
C. Change the IP addresses of the clients, while remaining on the same subnet.
D. Deploy a firewall in transparent mode between the clients and servers.
Answer D
Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of its screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a “bump in the wire,” or a “stealth firewall,” and is not seen as a router hop to connected devices. However, like any other firewall, access control between interfaces is controlled, and all of the usual firewall checks are in place. Layer 2 connectivity is achieved by using a “bridge group” where you group together the inside and outside interfaces for a network, and the Firepower Threat Defense device uses bridging techniques to pass traffic between the interfaces. Each bridge group includes a Bridge Virtual Interface (BVI) to which you assign an IP address on the network. You can have multiple bridge groups for multiple networks. In transparent mode, these bridge groups cannot communicate with each other.
In a multi-tenant deployment where multiple domains are in use, which update should be applied outside of the Global Domain?
A. minor upgrade
B. local import of intrusion rules
C. Cisco Geolocation Database
D. local import of major upgrade
Answer B
In a multidomain deployment, you can import local intrusion rules in any domain. You can view local intrusion rules imported in the current domain and ancestor domains.
After using Firepower for some time and learning about how it interacts with the network, an administrator is trying to correlate malicious activity with a user.
Which widget should be configured to provide this visibility on the Cisco Firepower dashboards?
A. Current Sessions
B. Correlation Events
C. Current Status
D. Custom Analysis
Answer B
The Correlation Events widget shows the average number of correlation events per second, by priority.
What is the maximum bit size that Cisco FMC supports for HTTPS certificates?
A. 1024
B. 8192
C. 4096
D. 2048
Answer D
The FMC supports 2048-bit HTTPS certificates. If the certificate used by the FMC was generated using a public server key larger than 2048 bits, you will not be able to log in to the FMC web interface. If this happens, contact Cisco TAC.
Newer version of FMC version 6.6 supports 4096
Refer to the exhibit. An organization has an access control rule with the intention of sending all social media traffic for inspection. After using the rule for some time, the administrator notices that the traffic is not being inspected, but is being automatically allowed. What must be done to address this issue?
Answer C
“Trust” traffic is not being inspected.
