Question 1

An organization has implemented Cisco Firepower without IPS capabilities and now wants to enable inspection for their traffic. They need to be able to detect protocol anomalies and utilize the Snort rule sets to detect malicious behavior. How is this accomplished?

Accepted Answer

A)  Modify the network discovery policy to detect new hosts to inspect. 
B)  Modify the access control policy to redirect interesting traffic to the engine. 
C)  Modify the intrusion policy to determine the minimum severity of an event to inspect. 
D)  Modify the network analysis policy to process the packets for inspection.

Question 2

An administrator is creating interface objects to better segment their network but is having trouble adding interfaces to the objects. What is the reason for this failure?

Accepted Answer

A)  The interfaces are being used for NAT for multiple networks 
B)  The administrator is adding interfaces of multiple types 
C)  The administrator is adding an interface that is in multiple zones 
D)  The interfaces belong to multiple interface groups

Question 3

The event dashboard within the Cisco FMC has been inundated with low priority intrusion drop events, which are overshadowing high priority events. An engineer has been tasked with reviewing the policies and reducing the low priority events. Which action should be configured to accomplish this task?

Accepted Answer

A)  drop packet 
B)  generate events 
C)  drop connection 
D)  drop and generate

Question 4

Which Cisco Firepower rule action displays an HTTP warning page?

Accepted Answer

A)  Monitor 
B)  Block 
C)  Interactive Block 
D)  Allow with Warning

Question 5

After deploying a network-monitoring tool to manage and monitor networking devices in your organization, you realize that you need to manually upload an MIB for the Cisco FMC. In which folder should you upload the MIB file?

Accepted Answer

A)  /etc/sf/DCMIB.ALERT 
B)  /sf/etc/DCEALERT.MIB 
C)  /etc/sf/DCEALERT.MIB 
D)  system/etc/DCEALERT.MIB

Question 6

An engineer is configuring a Cisco FTD appliance in IPS-only mode and needs to utilize fail-to-wire interfaces. Which interface mode should be used to meet these requirements?

Accepted Answer

A)  passive 
B)  routed 
C)  transparent 
D)  inline set

Question 7

Which CLI command is used to control special handling of ClientHello messages?

Accepted Answer

A)  system support ssl-client-hello-tuning 
B)  system support ssl-client-hello-display 
C)  system support ssl-client-hello-force-reset 
D)  system support ssl-client-hello-reset

Question 8

A network administrator is seeing an unknown verdict for a file detected by Cisco FTD. Which malware policy configuration option must be selected in order to further analyze the file in the Talos cloud?

Accepted Answer

A)  malware analysis 
B)  dynamic analysis 
C)  sandbox analysis 
D)  Spero analysis

Question 9

A network administrator notices that SI events are not being updated. The Cisco FTD device is unable to load all of the SI event entries and traffic is not being blocked as expected. What must be done to correct this issue?

Accepted Answer

A)  Restart the affected devices in order to reset the configurations. 
B)  Redeploy configurations to affected devices so that additional memory is allocated to the SI module. 
C)  Replace the affected devices with devices that provide more memory. 
D)  Manually update the SI event entries to that the appropriate traffic is blocked.

Question 10

An engineer configures a network discovery policy on Cisco FMC. Upon configuration, it is noticed that excessive and misleading events are filling the database and overloading the Cisco FMC. A monitored NAT device is executing multiple updates of its operating system in a short period of time. What configuration change must be made to alleviate this issue?

Accepted Answer

A)  Exclude load balancers and NAT devices. 
B)  Leave default networks. 
C)  Increase the number of entries on the NAT device. 
D)  Change the method to TCP/SYN.

Question 11

Which two dynamic routing protocols are supported in Firepower Threat Defense without using FlexConfig? (Choose two.)

Accepted Answer

A)  EIGRP 
B)  OSPF 
C)  static routing 
D)  IS-IS 
E)  BGP

Question 12

Which command is run on an FTD unit to associate the unit to an FMC manager that is at IP address 10.0.0.10, and that has the registration key Cisco123?

Accepted Answer

A)  configure manager local 10.0.0.10 Cisco123 
B)  configure manager add Cisco123 10.0.0.10 
C)  configure manager local Cisco123 10.0.0.10 
D)  configure manager add 10.0.0.10 Cisco123

Question 13

Refer to the exhibit. An organization has an access control rule with the intention of sending all social media traffic for inspection. After using the rule for some time, the administrator notices that the traffic is not being inspected, but is being automatically allowed. What must be done to address this issue?

Accepted Answer

A)  Add the social network URLs to the block list. 
B)  Change the intrusion policy to connectivity over security. 
C)  Modify the selected application within the rule. 
D)  Modify the rule action from trust to allow.

Question 14

A security engineer is configuring an Access Control Policy for multiple branch locations. These locations share a common rule set and utilize a network object called INSIDE_NET which contains the locally significant internal network subnets at each location. What technique will retain the policy consistency at each location but allow only the locally significant network subnet within the application rules?

Accepted Answer

A)  utilizing a dynamic ACP that updates from Cisco Talos 
B)  creating a unique ACP per device 
C)  utilizing policy inheritance 
D)  creating an ACP with an INSIDE_NET network object and object overrides

Question 15

Which command is typed at the CLI on the primary Cisco FTD unit to temporarily stop running high-availability?

Accepted Answer

A)  configure high-availability resume 
B)  configure high-availability disable 
C)  system support network-options 
D)  configure high-availability suspend

Question 16

A network engineer wants to add a third-party threat feed into the Cisco FMC for enhanced threat detection. Which action should be taken to accomplish this goal?

Accepted Answer

A)  Enable Rapid Threat Containment using REST APIs. 
B)  Enable Rapid Threat Containment using STIX and TAXII. 
C)  Enable Threat Intelligence Director using REST APIs. 
D)  Enable Threat Intelligence Director using STIX and TAXII.

Question 17

A network administrator discovers that a user connected to a file server and downloaded a malware file. The Cisco FMC generated an alert for the malware event, however the user still remained connected. Which Cisco AMP file rule action within the Cisco FMC must be set to resolve this issue?

Accepted Answer

A)  Malware Cloud Lookup 
B)  Reset Connection 
C)  Detect Files 
D)  Local Malware Analysis

Question 18

Which license type is required on Cisco ISE to integrate with Cisco FMC pxGrid?

Accepted Answer

A)  apex 
B)  plus 
C)  base 
D)  mobility

Question 19

In which two ways do access control policies operate on a Cisco Firepower system? (Choose two.)

Accepted Answer

A)  Traffic inspection is interrupted temporarily when configuration changes are deployed. 
B)  The system performs intrusion inspection followed by file inspection. 
C)  They block traffic based on Security Intelligence data. 
D)  File policies use an associated variable set to perform intrusion prevention. 
E)  The system performs a preliminary inspection on trusted traffic to validate that it matches the trusted parameters.

Question 20

Which two statements about bridge-group interfaces in Cisco FTD are true? (Choose two.)

Accepted Answer

A)  The BVI IP address must be in a separate subnet from the connected network. 
B)  Bridge groups are supported in both transparent and routed firewall modes. 
C)  Bridge groups are supported only in transparent firewall mode. 
D)  Bidirectional Forwarding Detection echo packets are allowed through the FTD when using bridge-group members. 
E)  Each directly connected network must be on the same subnet.

Exam 23: Implementing and Configuring Cisco Identity Services Engine (300-715 SISE)