[2024年08月25日] 300-710テストエンジンお試しセット、300-710問題集PDF
最新のCisco 300-710のPDFと問題集で（2024）無料試験問題解答
質問 # 156
A network administrator configured a NAT policy that translates a public IP address to an internal web server IP address. An access policy has also been created that allows any source to reach the public IP address on port 80. The web server is still not reachable from the Internet on port 80. Which configuration change is needed?
- A. The access policy must allow traffic to the internal web server IP address.
- B. The intrusion policy must be disabled for port 80.
- C. The access policy rule must be configured for the action trust.
- D. The NAT policy must be modified to translate the source IP address as well as destination IP address.
正解：A
質問 # 157
Due to an Increase in malicious events, a security engineer must generate a threat report to include intrusion events, malware events, and security intelligence events. How Is this information collected in a single report?
- A. Create a Custom report.
- B. Generate a malware report.
- C. Export the Attacks Risk report.
- D. Run the default Firepower report.
正解：A
質問 # 158
An administrator is working on a migration from Cisco ASA to the Cisco FTD appliance and needs to test the rules without disrupting the traffic. Which policy type should be used to configure the ASA rules during this phase of the migration?
- A. Access Control
- B. identity
- C. Prefilter
- D. Intrusion
正解：A
解説：
Reference:
https://www.cisco.com/c/en/us/td/docs/security/firepower/migration-tool/migration-guide/ASA2FTD-with-FP-Migration-Tool/b_Migration_Guide_ASA2FTD_chapter_01011.html
質問 # 159
An engineer must define a URL object on Cisco FMC. What is the correct method to specify the URL without performing SSL inspection?
- A. Use Subject Common Name value.
- B. Specify the protocol in the object.
- C. Include all URLs from CRL Distribution Points.
- D. Specify all subdomains in the object group.
正解：A
質問 # 160
A network administrator notices that inspection has been interrupted on all non-managed interfaces of a device. What is the cause of this?
- A. The value of the highest MTU assigned to any non-management interface was changed.
- B. The value of the highest MSS assigned to any non-management interface was changed.
- C. Multiple inline interface pairs were added to the same inline interface.
- D. A passive interface was associated with a security zone.
正解：A
質問 # 161
What is the disadvantage of setting up a site-to-site VPN in a clustered-units environment?
- A. VPN connections can be re-established only if the failed master unit recovers.
- B. Only established VPN connections are maintained when a new master unit is elected.
- C. VPN connections must be re-established when a new master unit is elected.
- D. Smart License is required to maintain VPN connections simultaneously across all cluster units.
正解：C
解説：
Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/clustering/ftd-cluster-solution.html#concept_g32_yml_y2b
質問 # 162
Which two considerations must be made when deleting and re-adding devices while managing them via Cisco FMC (Choose two).
- A. An option to re-apply NAT and VPN policies during registration is available, so users do not need to re-apply the polices after registration is completed.
- B. The Cisco FMC web interface prompts users to re-apply access control policies.
- C. Once a device has been deleted, It must be reconfigured before it is re-added to the Cisco FMC.
- D. There is no option to re-apply NAT and VPN policies during registration is available, so users need to re-apply the policies after registration is completed.
- E. Before re-adding the device In Cisco FMC, the manager must be added back.
正解：B、D
質問 # 163
Which protocol establishes network redundancy in a switched Firepower device deployment?
- A. VRRP
- B. HSRP
- C. GLBP
- D. STP
正解：D
解説：
Section: Deployment
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config- guide-v62/firepower_threat_defense_high_availability.html
質問 # 164
When creating a report template, how can the results be limited to show only the activity of a specific subnet?
- A. Select IP Address as the X-Axis in each section of the report.
- B. Create a custom search in Firepower Management Center and select it in each section of the report.
- C. Add a Table View section to the report with the Search field defined as the network in CIDR format.
- D. Add an Input Parameter in the Advanced Settings of the report, and set the type to Network/IP.
正解：D
質問 # 165
Drag and drop the steps to restore an automatic device registration failure on the standby Cisco FMC from the left into the correct order on the right. Not all options are used.
正解：
解説：
質問 # 166
Which two conditions must be met to enable high availability between two Cisco FTD devices? (Choose two.)
- A. same DHCP/PPoE configuration
- B. same flash memory size
- C. same number of interfaces
- D. same host name
- E. same NTP configuration
正解：C、E
解説：
Explanation
https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699-configure-ftd-high-aConditions In order to create an HA between 2 FTD devices, these conditions must be met:
Same model
Same version (this applies to FXOS and to FTD - (major (first number), minor (second number), and maintenance (third number) must be equal)) Same number of interfaces Same type of interfaces Both devices as part of same group/domain in FMC Have identical Network Time Protocol (NTP) configuration Be fully deployed on the FMC without uncommitted changes Be in the same firewall mode: routed or transparent.
Note that this must be checked on both FTD devices and FMC GUI since there have been cases where the FTDs had the same mode, but FMC does not reflect this.
Does not have DHCP/Point-to-Point Protocol over Ethernet (PPPoE) configured in any of the interface Different hostname (Fully Qualified Domain Name (FQDN)) for both chassis. In order to check the chassis hostname navigate to FTD CLI and run this command
質問 # 167
An administrator is adding a new URL-based category feed to the Cisco FMC for use within the policies. The intelligence source does not use STIX. but instead uses a .txt file format. Which action ensures that regular updates are provided?
- A. Add a TAXII feed source and input the URL for the feed.
- B. Upload the .txt file and configure automatic updates using the embedded URL.
- C. Add a URL source and select the flat file type within Cisco FMC.
- D. Convert the .txt file to STIX and upload it to the Cisco FMC.
正解：C
質問 # 168
What is the maximum SHA level of filtering that Threat Intelligence Director supports?
- A. SHA-256
- B. SHA-1024
- C. SHA-512
- D. SHA-4096
正解：A
質問 # 169
Which Cisco Firepower Threat Defense, which two interface settings are required when configuring a routed interface? (Choose two.)
- A. EtherChannel
- B. Media Type
- C. Redundant Interface
- D. Speed
- E. Duplex
正解：D、E
解説：
https://www.cisco.com/c/en/us/td/docs/security/firepower/610/fdm/fptd-fdm-config-guide-610/fptd-fdm- interfaces.html
質問 # 170
Refer to the exhibit.
What must be done to fix access to this website while preventing the same communication to all other websites?
- A. Create an access control policy rule to allow port 80 to only 172.1.1 50.
- B. Create an intrusion policy rule to have Snort allow port 443 to only 172.1.1.50
- C. Create an intrusion policy rule to have Snort allow port 80 to only 172.1.1 50.
- D. Create an access control policy rule to allow port 443 to only 172.1.1 50
正解：A
質問 # 171
An engineer is building a new access control policy using Cisco FMC. The policy must inspect a unique IPS policy as well as log rule matching. Which action must be taken to meet these requirements?
- A. Disable the default IPS policy and enable per-rule logging.
- B. Configure an IPS policy and enable per-rule logging.
- C. Disable the default IPS policy and enable global logging.
- D. Configure an IPS policy and enable global logging.
正解：D
質問 # 172
Which two statements about bridge-group interfaces in Cisco FTD are true? (Choose two.)
- A. Each directly connected network must be on the same subnet.
- B. Bridge groups are supported only in transparent firewall mode.
- C. Bidirectional Forwarding Detection echo packets are allowed through the FTD when using bridge-group members.
- D. The BVI IP address must be in a separate subnet from the connected network.
- E. Bridge groups are supported in both transparent and routed firewall modes.
正解：B、C
解説：
Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html
質問 # 173
An administrator Is setting up a Cisco PMC and must provide expert mode access for a security engineer. The engineer Is permitted to use only a secured out-of-band network workstation with a static IP address to access the Cisco FMC. What must be configured to enable this access?
- A. Enable HTTP and define an access list.
- B. Enable SSH and define an access list.
- C. Enable SCP under the Access List section.
- D. Enable HTTPS and SNMP under the Access List section.
正解：B
質問 # 174
Which two conditions are necessary for high availability to function between two Cisco FTD devices? (Choose two.)
- A. Both devices can be part of a different group that must be in the same domain when configured within the FMC.
- B. The units must be the same version
- C. The units must be configured only for firewall routed mode.
- D. The units must be different models if they are part of the same series.
- E. The units must be the same model.
正解：B、E
解説：
Section: Deployment
Explanation/Reference: https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699- configure-ftd-high-availability-on-firep.html
質問 # 175
What is a result of enabling Cisco FTD clustering?
- A. Site-to-site VPN functionality is limited to the master unit, and all VPN connections are dropped if the master unit fails.
- B. All Firepower appliances can support Cisco FTD clustering.
- C. For the dynamic routing feature, if the master unit fails, the newly elected master unit maintains all existing connections.
- D. Integrated Routing and Bridging is supported on the master unit.
正解：A
解説：
Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/clustering_for_the_firepower_threat_defense.html
質問 # 176
Network users are experiencing Intermittent issues with internet access. An engineer ident med mat the issue Is being caused by NAT exhaustion. How must the engineer change the dynamic NAT configuration to provide internet access for more users without running out of resources?
- A. Add an identity NAT rule to handle the overflow of users.
- B. Define an additional static NAT for the network object in use.
- C. Convert the dynamic auto NAT rule to dynamic manual NAT.
- D. Configure fallthrough to interface PAT on 'he Advanced tab.
正解：D
解説：
Explanation
Fallthrough to interface PAT is a feature that allows the dynamic NAT configuration to use the interface IP address as a last resort when the NAT pool is exhausted. This way, more users can access the internet without running out of resources. To enable this feature, the engineer must check the Enable PAT Fallback check box on the Advanced tab of the NAT rule editor1
質問 # 177
Which two conditions must be met to enable high availability between two Cisco FTD devices? (Choose two.)
- A. same DHCP/PPoE configuration
- B. same flash memory size
- C. same number of interfaces
- D. same host name
- E. same NTP configuration
正解：C、E
解説：
https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699-configure-ftd-high-availability-on-firep.html Conditions In order to create an HA between 2 FTD devices, these conditions must be met:
Same model
Same version (this applies to FXOS and to FTD - (major (first number), minor (second number), and maintenance (third number) must be equal)) Same number of interfaces Same type of interfaces Both devices as part of same group/domain in FMC Have identical Network Time Protocol (NTP) configuration Be fully deployed on the FMC without uncommitted changes Be in the same firewall mode: routed or transparent.
Note that this must be checked on both FTD devices and FMC GUI since there have been cases where the FTDs had the same mode, but FMC does not reflect this.
Does not have DHCP/Point-to-Point Protocol over Ethernet (PPPoE) configured in any of the interface Different hostname (Fully Qualified Domain Name (FQDN)) for both chassis. In order to check the chassis hostname navigate to FTD CLI and run this command
質問 # 178
Which CLI command is used to control special handling of ClientHello messages?
- A. system support ssl-client-hello-display
- B. system support ssl-client-hello-tuning
- C. system support ssl-client-hello-enabled
- D. system support ssl-client-hello-force-reset
正解：B
質問 # 179
......
Ciscoは、ネットワークおよびサイバーセキュリティソリューションの分野でトップ企業です。彼らは、ネットワーク技術の異なる分野でプロフェッショナルの知識とスキルを検証するための幅広い認定試験を提供しています。そのうちの1つが、Cisco 300-710（Cisco Firepowerを使用したネットワークの保護）認定試験です。
あなたを合格させるCCNP Security 300-710試験問題集で2024年08月25日には279問あります：https://jp.fast2test.com/300-710-premium-file.html
300-710無料試験学習ガイド！（更新された279問あります)：https://drive.google.com/open?id=1bzbUvB-f652jMKBSKWSXBWXUluW4ASai