Cisco 300-710 SNCF flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

FMC management interface

Dedicated interface on the Firepower Management Center used for management, device registration, and UI/API access; it must be reachable from every managed device and is separate from data traffic.

FTD routed mode

Deployment where each FTD data interface has an IP address and the device participates in routing, supporting static routes, dynamic routing, and NAT between inside and outside networks.

FTD transparent mode

Deployment where data interfaces are grouped into a bridge group without IP addresses, so the FTD acts as a Layer 2 bump-in-the-wire; a management IP is still required.

Inline set

An IPS-only interface pair on FTD with no IP addressing; traffic entering one interface is inspected and exits the peer interface, with fail-open or fail-closed behavior on failure.

configure manager add

FTD CLI command that points the device at an FMC using the FMC IP or hostname and a registration key; the same key must be entered when adding the device in FMC.

Smart Licensing registration

Process where FMC or FTD registers with Cisco Smart Software Manager using a registration token or specific license reservation, enabling IPS, Malware, URL, and Threat entitlements.

FMC high availability

Active/standby pair of FMC appliances or VMs with identical versions, synchronized configuration, and a dedicated failover link; the standby takes over if the active node fails.

Access control policy

Top-level FMC policy that evaluates traffic against ordered rules and references Security Intelligence, SSL, identity, prefilter, intrusion, file, and malware policies for matched flows.

First-match rule evaluation

ACP rules are evaluated top-down and the first matching rule's action applies; later rules are not evaluated for that connection, so specific rules must precede broad ones.

Default action

The final action at the bottom of an access control policy applied to traffic matching no rule; commonly Intrusion Prevention or Access Control Block All, and cannot be moved above rules.

Prefilter policy

Policy evaluated before the ACP that handles tunnel and SSL-decapsulated traffic and can fastpath flows to bypass further inspection or forward them to the ACP.

Security Intelligence

Reputation-based blocking using IP, DNS, URL, and SHA-256 feeds plus custom lists; it is evaluated before ACP rules and has its own allow and block overrides.

Policy deployment

FMC operation that pushes saved policy and object changes to managed devices; a failed deployment leaves the previously deployed policy active on the device.

Object management

Reusable FMC definitions for hosts, networks, ports, URLs, and applications; editing an object changes every policy that references it, so changes propagate on next deploy.

Health Monitor

FMC page showing managed device status such as CPU, disk, interface state, and policy deployment status, plus alerts for conditions that can interrupt inspection or event logging.

Trust rule

ACP rule action that allows matching traffic to pass without further inspection, bypassing intrusion, file, and malware policies; it is the fastest path through the device.

Application filter

ACP matching condition combining application category, risk level, business relevance, and tags, letting one rule match groups of applications detected by OpenAppID signatures.

URL filtering license

Entitlement required to match URL categories and reputations in ACP rules; HTTPS category matching depends on SSL decryption or on SNI and certificate metadata.

SSL policy

FMC policy referenced by the ACP that decides which flows are decrypted, using rules with Do Not Decrypt, Decrypt re-sign, or Decrypt known-key actions and a certificate authority.

Identity policy

Policy that maps traffic to users and groups via passive AD or LDAP, ISE, or captive portal, enabling ACP rules to match user identity instead of only IP addresses.

Interactive block

ACP action that drops the connection but returns a customizable block page to HTTP users, informing them why access was denied; Block drops silently without a page.

Rate limiting in ACP

Per-rule setting that caps bandwidth for matching flows, applied after the rule action matches; it limits aggregate flow throughput rather than individual packets.

Intrusion policy

Collection of Snort rules with a base policy and per-rule overrides (Drop, Alert, Disabled) that determines which signatures are active and whether matches block traffic.

Variable set

Definitions of $HOME_NET, $EXTERNAL_NET, and port variables referenced by intrusion rules; wrong values cause false positives or missed detections and can be overridden per policy.

Drop versus Alert

Rule action that blocks the packet in inline IPS deployments versus one that only generates an event; in passive deployments Drop behaves like Alert because traffic cannot be stopped.

File policy

Policy attached to an ACP rule that inspects transferred files for malware and can block by disposition, file type, or size; it requires the Malware license.

Malware dispositions

Verdicts assigned to files, such as Malware, Clean, Unknown, and Custom Detection; Block Malware blocks malicious and unknown files, while Detect Files only alerts.

Event filtering

Intrusion policy tuning using suppress, threshold, and rate-based filters to reduce event volume from noisy signatures without disabling the underlying rule entirely.

SSL decryption prerequisite

Encrypted traffic must be decrypted before intrusion, file, and malware inspection can see payloads; without it only metadata such as SNI and certificate fields is visible.

show managers

FTD CLI command that displays the managing FMC, registration state, and connectivity, used as a first check when a device does not appear or deploy in FMC.

Connection events

FMC records of flows showing the matched ACP rule, action taken, and reason, used to confirm whether traffic was allowed, blocked, trusted, or decrypted.

capture-traffic

FTD CLI command that captures packets on an interface with a BPF filter, writing to a file for analysis; useful when events do not explain why traffic was dropped.

Deployment failure causes

Common causes are unreachable devices, version mismatch, invalid object references, or insufficient disk; the detail appears in Task Status and the previous policy stays active.