300-710認証試験の問題集解答を提供しています [2026年08月]
更新された300-710試験練習テスト問題
質問 # 51
An engineer currently has a Cisco FTD device registered to the Cisco FMC and is assigned the address of 10 10.50.12. The organization is upgrading the addressing schemes and there is a requirement to convert the addresses to a format that provides an adequate amount of addresses on the network What should the engineer do to ensure that the new addressing takes effect and can be used for the Cisco FTD to Cisco FMC connection?
- A. Update the IP addresses from IFV4 to IPv6 without deleting the device from Cisco FMC
- B. Delete and reregister the device to Cisco FMC
- C. Format and reregister the device to Cisco FMC.
- D. Cisco FMC does not support devices that use IPv4 IP addresses.
正解：A
質問 # 52 
Refer to the exhibit. An engineer analyzes a Cisco Firepower Management Center dashboard. Which action must be taken by the user to decrease the risk of data loss?
- A. Block all the BitTorrent applications.
- B. Stop all URLs that have an unknown reputation.
- C. Block the use of Dropbox.
- D. Stop all the URLs that are uncategorized.
正解：D
質問 # 53
A network administrator manages a network with multiple firewalls in a datacenter using Cisco Secure Firepower Management Center. The administrator must change a next-generation firewall from routed to transparent mode. Which action must the administrator take next to meet the requirement?
- A. Manually delete the interface configuration from the CLI.
- B. Create one or more bridge groups from the CLI.
- C. Deregister the firewall in Cisco Secure Firewall Management Center.
- D. Enter the configure transparent firewall command from the CLI.
正解：C
質問 # 54
An engineer is troubleshooting connectivity to the DNS servers from hosts behind a new Cisco FTD device. The hosts cannot send DNS queries to servers in the DMZ. Which action should the engineer take to troubleshoot this issue using the real DNS packets?
- A. Use the Connection Events dashboard to check the block reason and adjust the inspection policy as needed.
- B. Use the packet tracer tool to determine at which hop the packet is being dropped.
- C. Use the show blocks command in the Threat Defense CLI tool and create a policy to allow the blocked traffic.
- D. Use the packet capture tool to check where the traffic is being blocked and adjust the access control or intrusion policy as needed.
正解：A
質問 # 55
Which Firepower feature allows users to configure bridges in routed mode and enables devices to perform Layer 2 switching between interfaces?
- A. FlexConfig
- B. BDI
- C. IRB
- D. SGT
正解：C
解説：
Section: Configuration
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/relnotes/ Firepower_System_Release_Notes_Version_620/new_features_and_functionality.html
質問 # 56
What is the result of specifying of QoS rule that has a rate limit that is greater than the maximum throughput of an interface?
- A. Matching traffic is not rate limited.
- B. The system rate-limits all traffic.
- C. The system repeatedly generates warnings.
- D. The rate-limiting rule is disabled.
正解：A
解説：
Section: Configuration
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config- guide-v62/quality_of_service_qos.pdf
質問 # 57
An engineer must configure and generate a report in Cisco Secure Firewall Management Center.
The report must allow for the addition of headers and footers, and it will contain many pages.
Which format must the engineer configure the report to use?
- A. doc
- B. pdf
- C. xls
- D. xml
正解：B
解説：
A report is a document file formatted in PDF, HTML, or CSV.
https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management- center/admin/740/management-center-admin-74/report-reports.html
質問 # 58
A network administrator notices that inspection has been interrupted on all non-managed interfaces of a device. What is the cause of this?
- A. The value of the highest MSS assigned to any non-management interface was changed.
- B. A passive interface was associated with a security zone.
- C. Multiple inline interface pairs were added to the same inline interface.
- D. The value of the highest MTU assigned to any non-management interface was changed.
正解：D
解説：
Changing the highest MTU value among all non-management interfaces on the device restarts the Snort process when you deploy configuration changes, temporarily interrupting traffic inspection. Inspection is interrupted on all non-management interfaces, not just the interface you modified. Whether this interruption drops traffic or passes it without further inspection depends on the model of the managed device and the interface type. See Snort® Restart Traffic Behavior for more information.
https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config- guide-v60/fpmc-config-guide-v60_chapter_01101010.html
質問 # 59
An engineer is configuring Cisco Security Devices by using Cisco Secure Firewall Management Center. Which configuration command must be run to compare the CA certificate bundle on the local system to the latest CA bundle from the Cisco server?
- A. configure cert-update compare
- B. configure cert-update test
- C. configure cert-update run-now
- D. configure cert-update auto-update enable
正解：A
解説：
The **configure cert-update compare** command is used in Cisco Secure Firewall Management Center to compare the local CA certificate bundle with the latest bundle available from Cisco's update server. This helps verify whether the local system has the most up-to-date CA certificates before performing a manual or automatic update.
質問 # 60
With Cisco Firepower Threat Defense software, which interface mode must be configured to passively receive traffic that passes through the appliance?
- A. inline tap
- B. routed
- C. inline set
- D. passive
正解：D
解説：
Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/interface_overview_for_firepower_threat_defense.html
質問 # 61
Which two remediation options are available when Cisco FMC is integrated with Cisco ISE?
(Choose two.)
- A. host shutdown
- B. dynamic null route configured
- C. DHCP pool disablement
- D. quarantine
- E. port shutdown
正解：D、E
解説：
Firepower 6.1 Remediation module allows Firepower system to use ISE EPS capabilities (quarantine, unquarantine, port shutdown) as a remediation when correlation rule is matched.
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/210524-configure-firepower-6-1-pxgrid-remediati.html
質問 # 62
An administrator Is setting up a Cisco PMC and must provide expert mode access for a security engineer. The engineer Is permitted to use only a secured out-of-band network workstation with a static IP address to access the Cisco FMC. What must be configured to enable this access?
- A. Enable SCP under the Access List section.
- B. Enable HTTP and define an access list.
- C. Enable SSH and define an access list.
- D. Enable HTTPS and SNMP under the Access List section.
正解：C
質問 # 63
How is IRB on next-generation firewall running in transparent mode supported?
- A. IRB requires an external switch.
- B. IPv4 routes must be configured on the BVI.
- C. IRB is supported only in routed mode.
- D. IPv4 routes must be configured on the physical interface.
正解：B
解説：
When using Integrated Routing and Bridging (IRB) on a next-generation firewall in transparent mode, IPv4 routes must be configured on the BVI (Bridge Virtual Interface).
The BVI acts as the routed interface for the bridged traffic, enabling Layer 3 connectivity within a transparent deployment.
質問 # 64
A network administrator is reviewing a monthly advanced malware risk report and notices a host that Is listed as CnC Connected. Where must the administrator look within Cisco FMC to further determine if this host is infected with malware?
- A. Analysis > Hosts > Host Attributes
- B. Analysts > Files > Malware Events
- C. Analysis > Hosts > indications of Compromise
- D. Analysis > Flies > Network File Trajectory
正解：C
解説：
Explanation
To determine if a host is infected with malware, the network administrator can look at the Indications of Compromise (IOC) feature in Cisco FMC. The IOC feature analyzes network and endpoint data collected by Firepower sensors and AMP for Endpoints connectors, and identifies hosts that exhibit signs of compromise or infection. The IOC feature uses predefined rules based on Cisco Talos intelligence and other sources to detect IOCs on hosts. One of these rules is CnC Connected, which indicates that a host has communicated with a command-and-control (CnC) server that is known to be associated with malware activity2.
To view the IOC information for a host, the network administrator can navigate to Analysis > Hosts > Indications of Compromise in Cisco FMC, and select a host from the table. The IOC Details page will show the IOC events for that host, including the CnC Connected event, along with other information such as severity, timestamp, source, destination, protocol, and rule name. The network administrator can also view more details about each IOC event by clicking on it2.
The other options are incorrect because:
Analysis > Files > Malware Events shows information about files that have been detected as malware by Firepower sensors or AMP for Endpoints connectors. This does not show information about hosts that are infected with malware or have communicated with CnC servers3.
Analysis > Hosts > Host Attributes shows information about hosts that have been discovered by Firepower sensors, such as IP address, MAC address, operating system, applications, users, vulnerabilities, and so on. This does not show information about IOCs or CnC connections on hosts4.
Analysis > Files > Network File Trajectory shows information about files that have traversed your network and have been detected by Firepower sensors or AMP for Endpoints connectors. This allows you to track where a file came from, where it went, and what happened to it along the way. This does not show information about hosts that are infected with malware or have communicated with CnC servers5.
質問 # 65
A network engineer must configure IPS mode on a Cisco Secure firewall Threat Defense device to inspect traffic and act as an IDS. The engineer already configured the passive-interface on the secure firewall threat Defence device and SPAN on the switch. What must be configured next by the engineer?
- A. DHCP on the switch
- B. intrusion policy on the Secure Firewall Threat Defense device
- C. active Interface on me Secure Firewall threat Defense device
- D. active SPAN port on the switch
正解：B
解説：
To configure IPS mode on a Cisco Secure Firewall Threat Defense (FTD) device to inspect traffic and act as an IDS, the network engineer must configure an intrusion policy on the FTD device. The passive-interface and SPAN on the switch have already been configured, which means the traffic is being mirrored to the FTD.
The next step is to set up an intrusion policy that defines the rules and actions for detecting and responding to malicious traffic.
Steps:
* In FMC, navigate toPolicies > Intrusion.
* Create a new intrusion policy or edit an existing one.
* Define the rules and actions for detecting threats.
* Apply the intrusion policy to the relevant interfaces or access control policies.
This configuration enables the FTD to inspect the mirrored traffic and take appropriate actions based on the defined intrusion policy.
References:Cisco Secure Firewall Management Center Administrator Guide, Chapter on Intrusion Policies.
質問 # 66
......
この試験は60〜70問から成り、英語と日本語で利用可能です。候補者は試験を完了するために90分の時間があり、認定を取得するためには70％以上の合格点を取得する必要があります。この試験は、NGFWの機能や機能、FMCの設定と管理、ISEの展開と設定、侵入防止システム（IPS）、高度なマルウェア保護（AMP）、URLフィルタリングなどの脅威防御技術を含む幅広いトピックをカバーしています。
検証済みの300-710問題集と解答を使って100%一発合格保証で更新された問題集：https://drive.google.com/open?id=1bzbUvB-f652jMKBSKWSXBWXUluW4ASai
合格させるCCNP Security 300-710試験には423問があります：https://jp.fast2test.com/300-710-premium-file.html