Cisco 300-710 SNCF key terms

Centralized appliance or virtual machine that configures, licenses, and monitors managed Firepower devices, distributes policies to them, and stores events they generate.

A Firepower threat defense, NGIPS, or ASA with FirePOWER Services device registered to an FMC, which receives policies from and reports events back to that manager.

Process of adding a sensor to an FMC by providing its IP address, registration key, and NAT identifiers so the two appliances can authenticate and exchange configuration and events.

Identifier shared between FMC and a managed device that allows registration and communication across NAT boundaries, typically matching the device's management IP or a unique string.

Unified software image combining Snort-based intrusion prevention, access control, and optional VPN or routing features, deployed on physical appliances, virtual platforms, or the FMC-managed chassis.

Action of pushing the current policy configuration from FMC to managed devices; changes are staged until deployed, and devices run their last successfully deployed policy until then.

Backup and restore mechanism that saves an FMC configuration to a remote server or local file and can reapply it later, useful for migrations and disaster recovery.

Pairing of two identical FMC or FTD appliances so one actively serves traffic or management duties while the peer stays synchronized and takes over after a failure.

Ordered set of rules evaluated top-down for traffic entering a managed device; the first matching rule determines which action, inspection, and logging occur.

Individual entry inside an access control policy that matches traffic on zones, networks, ports, applications, users, and URLs, then applies an action such as allow, block, or trust.

Behavior applied to traffic that matches no rule in an access control policy; options include access control with intrusion inspection, block, trust, or network discovery only.

Named grouping of interfaces that share a trust level, used in policies as a reusable match criterion for source and destination traffic instead of listing interfaces individually.

Reusable definition of a host, range, subnet, or group of addresses referenced by policies, so an address change is made once and inherited wherever the object is used.

Reusable definition of a TCP or UDP port or port range, grouped and referenced by access control and other policies to keep rule definitions consistent and maintainable.

FMC section where reusable network, port, URL, application, geolocation, and variable set objects are created, grouped, and shared across multiple policies.

Collection of enabled Snort rules and preprocessor settings that defines which exploits and attacks a device detects, and how it responds when traffic matches those rules.

Signature written in Snort syntax with header, options, and rule message that describes traffic patterns to detect; FMC stores rules in policies and pushes them to sensors.

Response assigned to a triggered intrusion rule, such as alert, drop, or reject, determining whether the packet is logged, discarded, or reset.

Named collection of values for Snort variables such as home and external networks, which rules use to decide traffic direction and applicability.

Detection engine inside FTD that evaluates packets against intrusion rules and preprocessors, producing intrusion events that are forwarded to the manager.

Record generated when traffic matches an enabled intrusion rule, containing packet details, rule identity, classification, and the action the sensor took.

Configuration that controls file inspection for malware, including which file types to inspect, whether to block malware, and how to handle local malware analysis.

Rule set that determines which files are inspected, blocked, or submitted for analysis based on file type, direction, and application, referenced by access control rules.

Process of sending eligible files to Cisco secure malware analytics for reputation and sandbox inspection, returning a verdict such as clean, malware, or unknown.

Policy that governs decryption of outbound and inbound encrypted sessions, identifying traffic to decrypt or bypass and re-signing certificates for inspection.

Entry in an SSL policy that matches traffic by zone, network, category, or certificate and specifies whether to decrypt, not decrypt, or block the encrypted session.

Policy that controls which hosts and applications the sensor identifies from monitored traffic and whether it collects user or host information for the network map.

FMC view of discovered hosts, their operating systems, open ports, and applications, built from network discovery data and used for investigation and policy tuning.

Matching and acting on traffic by application identity rather than only port, using Snort application detectors and optional custom detectors in access control rules.

Classification and control of web requests by category or reputation, requiring a URL license and configured as match criteria within access control rules.

Log record describing a completed or attempted session, including source, destination, application, rule that handled it, and bytes transferred.

Feature that blocks or monitors traffic using reputation feeds and lists of known-bad IPs, domains, and URLs, evaluated before access control rules.

FMC workflow for searching, filtering, and investigating connection, intrusion, malware, and file events using tables, dashboards, and drill-down views.

FMC page showing status of managed devices and their processes, interfaces, and disk usage, with alerts when health policies detect degraded conditions.

CLI tools on FTD and FMC such as show, ping, traceroute, and packet capture utilities used to verify connectivity, policy state, and traffic flow during fault isolation.

Diagnostic feature that records traffic on a managed device or FMC interface, optionally filtered, to prove whether packets arrive and how they are handled.

Per-device configuration in FMC covering shared settings such as timeouts, BFD, SNMP, syslog, and SSL settings that apply beneath the traffic policies.