Free Cisco 300-710 Actual Exam Questions

It’s A. IPsec is the go-to for securing failover communication on Cisco devices, not just general VPN use. MACsec isn’t commonly used on FTD failover links.

A/D? IPsec is widely used for secure device communication and is definitely supported by Cisco FTD for failover encryption, but MACsec’s link-layer encryption might be more specialized here. Worth considering both.

Application blocking (A) definitely helps prevent bad files from executing. Simple custom detection (B) also fits since it lets you block files based on custom rules. So I’d go with A and B.

A vs E? I ruled out C and D since file repository is just storage and exclusions would allow things through, not block them. Application blocking (A) makes sense because it stops certain apps from running, which could include blocking files. Application whitelisting (E) also fits since it blocks anything not explicitly allowed. So I’d go with A and E here.

Makes sense to rule out B since internet access wouldn’t explain why exe files are handled but others aren’t. I’d back C too because the file policy is what tells the system how to deal with each file type. If it’s missing, that explains why all except exe show unknown. Also, A sounds unlikely since a license issue would probably affect everything, not just specific file types. D feels less relevant because Spero analysis alone wouldn’t selectively exclude all but exe files.

B, since the FMC needs internet access for analysis, else unknown shows up.

Maybe D is the best choice here since it keeps the device inline without needing to change any IP routing or addressing. Options A and C would require IP adjustments, which goes against the “bump in the wire” idea where the device should be invisible. B involves routing, so it wouldn’t be just a transparent bump. Bridging in transparent mode lets the Firepower analyze traffic passively but still alert on threats, which matches the question’s requirements perfectly.

Totally agree that it’s about staying inline and invisible here. Another way to look at it: A and C both suggest changing IP configs or routing, which would mess with the “bump in the wire” aspect. B involves routing, which breaks the transparent mode promise. So D is really the only option that fits the need to inspect traffic without altering how devices see the network. D

Can’t edit ancestor templates directly, so B makes sense to work on a local copy.

Maybe C makes sense since you need ownership to unlock editing rights; copying alone won’t give you full control. Without ownership, changes might not be saved properly.

A imo. STP creates redundancy by preventing loops in the network, which is crucial in switches and can indirectly provide network redundancy. The other options like HSRP, GLBP, and VRRP focus more on gateway redundancy rather than switch-level redundancy. Since the question mentions a switched Firepower deployment, STP fits the bill for layer 2 network redundancy better than the rest.

B - HSRP is designed for Cisco gear, so it’s the natural fit here.

Probably D, Cisco Rapid Threat Containment mainly uses TrustSec segmentation to isolate threats.

I get why D sounds right, but changing authentication (A) can quickly lock down compromised accounts, which is another solid way to contain threats fast. So I’d go with A here.

A/E? Thresholds definitely get set on IPS rules, and preprocessors usually have their own settings that feel separate enough to count. B seems too broad since it includes E.

Maybe A and E, since preprocessors can have their own thresholds separately from policies.

Maybe D here. If the interfaces are mixed types or incompatible, that might stop any interface objects from appearing for QoS. It’s not necessarily about the device mode.

C/D? Since no interface objects show up, it might be because the device is in transparent mode (C), but it could also be a conflict between interface types preventing QoS (D).

D imo, child domains not being able to view ancestor dashboards seems too restrictive and would break basic visibility needs. So that option feels off compared to others.

A/B? I’d drop C and D since child domains definitely have some visibility, so it’s between view-only (A) or limited widgets (B). The view-only restriction makes more sense for control reasons.

I’m thinking option B might be an angle to consider. Instead of relying on a single FMC to handle all logs, a cluster could distribute the load and reduce the chance of bottlenecks. That way, FMC still handles analysis but with better scalability. Does anyone know if FMC clustering is commonly used or supported specifically for log management in this context?

It’s D for me. Sending connection events straight from FTD to the SIEM takes the load off FMC, and then just forwarding security events from FMC keeps things manageable. That way you’re not overloading FMC by pushing all logs through it. Option A might work but risks missing proper correlation or overload from FTD handling everything alone. Splitting the log destinations like in D seems like a better balance between performance and comprehensive logging.

A/D? Blocking the whole banking category (D) seems too broad if you want to allow a specific site. Enabling SSL decryption (A) lets you target that site specifically over HTTPS.

A/C? Without SSL decryption, the firewall can’t inspect HTTPS traffic at the URL level, so C (disabling SSL inspection) wouldn’t help because you still can’t filter by URL. A seems necessary to allow one specific banking site securely. D blocks the whole banking category, which contradicts the goal of allowing access to a specific site. B doesn’t make sense since the app is HTTPS, not HTTP. So A looks like the only option that actually meets the requirement.

D imo, summary tool sounds more like a static overview thing, not where you’d tweak widgets. Dashboards definitely handle widget layouts, but summary tool is probably just showing info.

A, because widgets are typically managed within the dashboard interface itself.

B imo makes most sense since each DMZ has a unique subnet—routed mode lets the firewall handle traffic between them cleanly without messing with IPs like NAT would.

C imo makes less sense since NAT changes IPs, which isn’t usually needed internally between DMZs with unique subnets. Routed mode without NAT fits better here.

C shows real-time user sessions, so it helps link malicious activity quickly.

A/D? Custom Analysis might let you tailor the view exactly how you want for user correlation, while Correlation Events sounds like it automatically links suspicious activity with users. Both could work depending on setup.