300-710 Free Practice Test

- (Exam Topic 5)
After using Firepower for some time and learning about how it interacts with the network, an administrator is trying to correlate malicious activity with a user Which widget should be configured to provide this visibility on the Cisco Firepower dashboards?

1. A. Custom Analysis
2. B. Current Status
3. C. Current Sessions
4. D. Correlation Events

Correct Answer: A

- (Exam Topic 1)
On the advanced tab under inline set properties, which allows interfaces to emulate a passive interface?

1. A. transparent inline mode
2. B. TAP mode
3. C. strict TCP enforcement
4. D. propagate link state

Correct Answer: D
Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config- guide-v64/inline_sets_and_passive_interfaces_for_firepower_threat_defense.html

- (Exam Topic 5)
An engineer has been tasked with using Cisco FMC to determine if files being sent through the network are malware. Which two configuration takes must be performed to achieve this file lookup? (Choose two.)

1. A. The Cisco FMC needs to include a SSL decryption policy.
2. B. The Cisco FMC needs to connect to the Cisco AMP for Endpoints service.
3. C. The Cisco FMC needs to connect to the Cisco ThreatGrid service directly for sandboxing.
4. D. The Cisco FMC needs to connect with the FireAMP Cloud.
5. E. The Cisco FMC needs to include a file inspection policy for malware lookup.

Correct Answer: DE

- (Exam Topic 5)
A security engineer needs to configure a network discovery policy on a Cisco FMC appliance and prevent excessive network discovery events from overloading the FMC database? Which action must be taken to accomplish this task?

1. A. Change the network discovery method to TCP/SYN.
2. B. Configure NetFlow exporters for monitored networks.
3. C. Monitor only the default IPv4 and IPv6 network ranges.
4. D. Exclude load balancers and NAT devices in the policy.

Correct Answer: D

- (Exam Topic 4)
Which action should you take when Cisco Threat Response notifies you that AMP has identified a file as malware?

1. A. Add the malicious file to the block list.
2. B. Send a snapshot to Cisco for technical support.
3. C. Forward the result of the investigation to an external threat-analysis engine.
4. D. Wait for Cisco Threat Response to automatically block the malware.

Correct Answer: A