I85PREP
⌘ K
Cisco 300-710 SNCF study materials
Cisco 300-710 SNCF study resources

Cisco 300-710 SNCF practice questions

One question at a time. Build your Cisco 300-710 SNCF understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Deployment and Initial Configuration

A firewall administrator wants to register a new Firepower Management Center (FMC) with Cisco Smart Licensing. Which FMC workflow is used to accomplish this registration?

  1. Devices > Device Management > License
  2. System > Licenses > Smart Licenses
  3. Policies > Access Control > Licensing
  4. System > Smart Software Licensing Correct answer.

Explanation

Smart Licensing registration is performed from the Smart Software Licensing page found under the System menu on the FMC, where the registration token is entered and the transport settings are configured. The other paths point at device management or policy areas that do not hold registration settings.

Question 2Deployment and Initial Configuration

During initial setup of an FTD device, which management mode allows the device to be managed locally by its own onboard manager without an FMC?

  1. Local mode managed by FDM Correct answer.
  2. Platform mode with FMC
  3. Clustered mode with FMC
  4. Multi-instance mode

Explanation

Local mode uses the on-box Firepower Device Manager (FDM) for configuration, which suits small deployments without a central manager. Platform mode and clustering require an FMC to push policies, and multi-instance mode is a container-based option that also relies on central management.

Question 3Deployment and Initial Configuration

An engineer is preparing the bootstrap configuration for a new FTD appliance before it registers with the FMC. Which setting must be defined so the device can reach the FMC?

  1. The FMC hostname or IP address and the registration key Correct answer.
  2. The syslog server facility code
  3. The intrusion policy variable set
  4. The access control policy name

Explanation

The FTD bootstrap configuration requires the manager's address and a registration key so the device can authenticate to and be added by the FMC. Policy names, variable sets, and syslog facility codes are configured after registration and are not part of the initial management connection.

Question 4Deployment and Initial Configuration

Which FMC deployment choice determines whether an FMC manages devices locally with its own database or is paired with a peer for high availability?

  1. The FMC platform model
  2. The access control policy action
  3. The FMC deployment type selected during setup Correct answer.
  4. The device license tier

Explanation

When the FMC is initialized, the administrator selects a deployment type such as standalone or high availability, which governs whether a peer is configured for redundancy. Hardware model, license tier, and policy actions do not determine the management redundancy model.

Question 5Deployment and Initial Configuration

A new FTD is being registered to an FMC. Which value must match between the device bootstrap configuration and the entry created on the FMC?

  1. The device serial number and the policy name
  2. The registration key and the device IP address Correct answer.
  3. The access control policy and the DNS suffix
  4. The NAT ID and the license token

Explanation

Registration succeeds only when the registration key entered on the device matches the key used when adding the device on the FMC, and the FMC must be able to reach the device's management IP. Serial numbers, NAT IDs, and policy names are not the matching pair for this handshake.

Question 6Deployment and Initial Configuration

An administrator needs a new FTD to be managed by an FMC that sits behind a NAT device. Which field on the FMC device-add screen accommodates this scenario?

  1. The group tag
  2. The transfer mode
  3. The license reservation code
  4. The NAT ID Correct answer.

Explanation

The NAT ID lets an FMC register a device whose management address is translated, allowing the FMC to correlate the device correctly. Group tags are for policy grouping, transfer mode is a licensing transport setting, and reservation codes are for offline licensing.

Question 7Deployment and Initial Configuration

Which statement describes how an FTD in platform mode obtains its initial policy after registering with the FMC?

  1. The device receives policies only through manual file import.
  2. The device generates a default policy locally and never contacts the FMC again.
  3. The device pulls a policy bundle from the FMC once it is added and a policy is applied. Correct answer.
  4. The device inherits policies from the FMC peer in an HA pair.

Explanation

After registration, the FMC deploys the assigned policy bundle to the device, which then enforces it. Local policy generation, manual file import, and peer inheritance are not how platform-mode devices receive policy.

Question 8Deployment and Initial Configuration

An engineer is configuring high availability between two FMCs. Which requirement must be met before the HA pair can be formed?

  1. Both FMCs must run the same software version and have matching hardware or resource profiles. Correct answer.
  2. Both FMCs must share a single management IP address.
  3. Both FMCs must use local mode device management.
  4. Both FMCs must be in different administrative domains.

Explanation

FMC high availability requires matching software versions and comparable platform resources so the standby can take over cleanly. Different domains, local mode, and a shared single IP are not valid requirements for forming the pair.

Question 9Deployment and Initial Configuration

Which FMC feature must be configured so that managed devices can resolve and report to the manager across routed networks?

  1. A prefilter policy with a fastpath action
  2. An access control rule with a block action
  3. A correct default route and DNS settings on the device management interface Correct answer.
  4. A NAT rule translating the management address

Explanation

Devices need proper routing and name resolution on their management interface to reach the FMC reliably. Blocking rules, fastpath prefilters, and management NAT do not establish the base connectivity required for registration and heartbeats.

Question 10Deployment and Initial Configuration

Which command-line approach is used to configure the initial management settings on an FTD appliance that will be managed by an FMC?

  1. The setup script invoked from the console during first boot Correct answer.
  2. The Smart Software Manager portal
  3. The FMC policy editor
  4. The device's web-based FDM interface

Explanation

The initial bootstrap, including management address, gateway, and manager details, is entered through the console setup script on first boot. The FMC editor, licensing portal, and FDM all operate after or outside this bootstrap step.

Question 11Deployment and Initial Configuration

A device fails to register with the FMC. Which troubleshooting step best verifies basic reachability between the device management interface and the FMC?

  1. Change the license tier on the FMC
  2. Ping the FMC from the device CLI and confirm the registration key matches Correct answer.
  3. Reinstall the access control policy
  4. Reset the device to factory defaults

Explanation

Confirming ICMP reachability and verifying that the registration key matches addresses the two most common registration failures. Policy reinstallation, factory reset, and license changes do not resolve a connectivity or credential mismatch.

Question 12Deployment and Initial Configuration

Which FMC object grouping is used to organize devices so that policies can be applied to a set of devices at once?

  1. Port objects
  2. Security zones
  3. Device groups Correct answer.
  4. Variable sets

Explanation

Device groups let administrators apply policies to multiple managed devices collectively. Port objects, variable sets, and security zones are policy constructs used inside rules, not device organization containers.

Question 13Deployment and Initial Configuration

An administrator is adding a second FTD to an existing FMC. What is the correct order of operations?

  1. Apply policy first, then bootstrap the device
  2. Bootstrap the device, add it on the FMC with a registration key, then apply policy Correct answer.
  3. Register the license first, then bootstrap the device
  4. Create the access control rule first, then bootstrap the device

Explanation

A device must be bootstrapped and registered before the FMC can deploy any policy to it. Applying policy, licensing, or creating rules before the device is known to the FMC cannot succeed because no managed device exists yet.

Question 14Deployment and Initial Configuration

Which transport is used by default for Smart Licensing communication between the FMC and Cisco Smart Software Manager?

  1. SNMP traps
  2. NetFlow export
  3. Syslog over UDP
  4. Smart Call Home over HTTPS Correct answer.

Explanation

Smart Licensing uses the Smart Call Home transport over HTTPS to exchange entitlement and registration messages with Cisco. SNMP, syslog, and NetFlow are monitoring and logging protocols not used for licensing.

Question 15Deployment and Initial Configuration

An FMC is being configured to manage devices in a multi-tenant environment. Which feature allows separation of devices and policies among different customers?

  1. Security zones
  2. Policy layers
  3. Domains Correct answer.
  4. Interface groups

Explanation

Domains partition the FMC so separate administrators manage distinct sets of devices and policies. Security zones, interface groups, and policy layers organize traffic matching within a policy but do not provide tenant separation.

Question 16Deployment and Initial Configuration

Which FTD deployment mode is required when the device must be managed by an FMC and also participate in a high-availability pair?

  1. Local mode
  2. Multi-instance mode
  3. Evaluation mode
  4. Platform mode Correct answer.

Explanation

Platform mode is the FMC-managed mode that supports HA pairs and clustering. Local mode uses FDM and does not provide FMC-managed HA, multi-instance is container-based, and evaluation mode is not a valid deployment mode for HA.

Question 17Deployment and Initial Configuration

An engineer wants to verify that an FTD has successfully registered with the FMC. Where on the FMC can the device status be confirmed?

  1. The Smart Licensing page showing the token
  2. The intrusion policy variable editor
  3. The access control policy editor
  4. The Device Management page showing the device as managed Correct answer.

Explanation

The Device Management page lists managed devices and shows whether each is successfully registered and reachable. Licensing, policy, and variable pages do not display device registration status.

Question 18Deployment and Initial Configuration

A candidate is asked which FMC initial configuration item sets the time source used for correlation of events across devices.

  1. The syslog facility
  2. The access control policy default action
  3. The NTP server configuration Correct answer.
  4. The DNS suffix list

Explanation

Configuring NTP on the FMC keeps timestamps consistent so events from multiple devices correlate correctly. DNS suffixes, syslog facilities, and policy default actions do not affect time synchronization.

Question 19Deployment and Initial Configuration

Which consideration applies when deciding between registering an FTD with an FMC versus managing it with FDM?

  1. Both options require an external manager appliance.
  2. FDM requires a Smart Licensing reservation code in all cases.
  3. FMC provides centralized multi-device policy management, while FDM manages a single device locally. Correct answer.
  4. FDM provides centralized management of many devices.

Explanation

The FMC is designed for centralized management of many devices, whereas FDM manages only the local device. FDM is not a multi-device manager and does not inherently require reservation codes.

Question 20Deployment and Initial Configuration

A device shows as pending in the FMC after an add attempt. Which condition most likely explains a pending rather than managed state?

  1. The device is missing an intrusion policy.
  2. The device has not yet completed its registration handshake with the FMC. Correct answer.
  3. The device has too many syslog servers configured.
  4. The device has an expired access control policy.

Explanation

A pending state indicates the FMC has an entry but the device has not completed the handshake, often due to reachability or key mismatch. Policy expiration, intrusion policy absence, and syslog counts do not produce a pending registration state.

Question 21Deployment and Initial Configuration

Which statement accurately describes the FMC backup and restore capability as part of initial deployment planning?

  1. A backup is only possible after forming an HA pair.
  2. A backup captures FMC configuration so it can be restored to a replacement or recovered appliance. Correct answer.
  3. A backup captures only device traffic logs for archival.
  4. A backup replaces the need for Smart Licensing registration.

Explanation

FMC backups preserve configuration data so it can be restored during recovery or migration to a replacement appliance. They do not archive traffic logs, replace licensing, or depend on HA being configured.

Question 22Deployment and Initial Configuration

An administrator must deploy an FTD in a network segment where the management interface cannot reach the FMC directly. Which approach allows registration in this design?

  1. Convert the device to local mode
  2. Provide a routed path or NAT so the device and FMC can exchange registration traffic Correct answer.
  3. Disable the management interface entirely
  4. Remove the registration key requirement

Explanation

Registration requires bidirectional reachability between device and FMC, which can be achieved through routing or a NAT ID when translation is involved. Disabling management, switching modes, or removing the key does not enable the handshake.

Question 23Deployment and Initial Configuration

Which FMC setting controls how often managed devices send health and status information to the manager?

  1. The access control rule schedule
  2. The syslog severity level
  3. The NAT policy timeout
  4. The device heartbeat interval Correct answer.

Explanation

The heartbeat interval determines how frequently devices report status to the FMC, which affects how quickly the manager detects an unreachable device. Rule schedules, syslog severity, and NAT timeouts do not govern device status reporting.

Question 24Deployment and Initial Configuration

During FMC initial setup, which account type should be created to avoid using the default administrative credentials in production?

  1. A new administrative user with a strong password, then disable or change the default account Correct answer.
  2. A read-only guest account only
  3. A shared service account used by all staff
  4. An account with no password for convenience

Explanation

Best practice is to create a named administrative account with a strong password and remove or secure the default account to reduce unauthorized access risk. Read-only-only, shared, or passwordless accounts weaken accountability and security.

Question 25Deployment and Initial Configuration

An engineer is planning device registration for a large deployment and wants to reduce manual steps. Which FMC capability supports adding many devices efficiently?

  1. Bulk device registration using a CSV import Correct answer.
  2. Disabling device management entirely
  3. Manual entry of each device one at a time
  4. Configuring each device through FDM

Explanation

The FMC supports bulk registration through a CSV file, which streamlines onboarding many devices compared with individual manual entry. FDM is per-device, and disabling management prevents registration altogether.

Question 26Deployment and Initial Configuration

An engineer is preparing an FTD appliance for management by an FMC and needs to confirm which interface is dedicated to out-of-band management on the hardware platform. Which interface fulfills this role by default?

  1. The diagnostic interface, which carries both management and traffic
  2. The first data interface in the configuration, which carries both management and traffic
  3. The management interface, which is separate from the data forwarding interfaces Correct answer.
  4. The console port, which carries management traffic once the device boots

Explanation

On FTD hardware appliances the dedicated management interface provides out-of-band access for management traffic such as FMC registration and CLI access, separate from the data-plane interfaces. Data interfaces are reserved for traffic inspection and routing, and the console port is a local serial connection rather than an IP management path.

Question 27Deployment and Initial Configuration

During initial configuration of an FTD that will be managed by an FMC, which setting must be supplied so the device can reach the manager across a routed network?

  1. A site-to-site VPN tunnel to the FMC
  2. A NAT exemption policy applied to the data interfaces
  3. A default gateway on the management interface Correct answer.
  4. A dynamic routing protocol instance on the data interfaces

Explanation

The management interface needs an IP address, mask, and default gateway so that registration traffic can be routed to the FMC when the manager is not on the same subnet. NAT, dynamic routing, and VPN configuration are data-plane features that are not required simply to reach the FMC.

Question 28Deployment and Initial Configuration

An administrator is planning the initial deployment of an FMC and wants to ensure time synchronization across managed devices for accurate event correlation. Which configuration satisfies this requirement?

  1. Configure a DNS server on the FMC and on each managed FTD
  2. Configure the FMC to distribute time through the registration tunnel
  3. Configure the FMC to act as a syslog server for the managed devices
  4. Configure an NTP server on the FMC and on each managed FTD Correct answer.

Explanation

Consistent time across the FMC and managed devices is achieved by pointing each system to a common NTP source, which keeps timestamps aligned for event correlation. Registration tunnels, syslog, and DNS do not provide time synchronization.

Question 29Deployment and Initial Configuration

An engineer is deploying an FTD in routed mode and must decide how to address the interfaces before registering with the FMC. Which statement describes the correct approach?

  1. Configure all interfaces as switched ports and rely on the FMC to assign addresses
  2. Configure IP addresses on the routed interfaces and set the management interface for FMC connectivity Correct answer.
  3. Configure only the management interface and leave all data interfaces unaddressed
  4. Configure the data interfaces with addresses but leave the management interface unaddressed

Explanation

In routed mode the data interfaces need IP addresses to forward traffic, while the management interface must be reachable by the FMC for registration and management. Leaving the management interface unaddressed prevents the device from being managed remotely.

Question 30Deployment and Initial Configuration

An administrator is adding an FTD to the FMC and must choose the correct registration method. Which method allows the device to be added without providing credentials from the device side?

  1. Adding the device by its IP address and registration key from the FMC Correct answer.
  2. Using the device's hostname and DNS record
  3. Using the device's serial number and license file
  4. Importing a configuration backup from the device

Explanation

Registration is performed from the FMC by specifying the device IP address and a registration key, after which the device contacts the manager to complete the process. Configuration backups, serial numbers, and DNS records are not registration mechanisms.

Question 31Deployment and Initial Configuration

An engineer is configuring an FTD in transparent mode and needs to know how to manage the device. Which statement is correct?

  1. The management interface is used for FMC connectivity while the transparent interfaces bridge traffic Correct answer.
  2. The transparent interfaces must be assigned IP addresses for management
  3. The device cannot be managed by an FMC in transparent mode
  4. The device must be managed locally through the console port only

Explanation

In transparent mode the data interfaces are bridged and do not require IP addresses for forwarding, while the management interface provides the path to the FMC. Transparent mode devices can still be managed centrally by an FMC.

Question 32Deployment and Initial Configuration

An administrator is preparing to register an FTD with an FMC and must ensure the device has the correct license before registration. Which statement describes the licensing requirement?

  1. The device must have a permanent license file installed offline
  2. The device must be licensed through the FMC after registration only
  3. The device must be licensed through Smart Licensing before or during registration Correct answer.
  4. The device does not require a license to be managed by the FMC

Explanation

FTD uses Smart Licensing, and the device must be licensed so that features and management by the FMC function correctly. Licensing is not limited to an offline permanent file, and a license is required for management.

Question 33Deployment and Initial Configuration

An engineer is configuring the FMC for the first time and must set up the initial administrative access. Which step is required to allow HTTPS access to the FMC web interface?

  1. Configure the FMC to forward management traffic through a data interface
  2. Configure the FMC to use the console port for web access
  3. Configure the FMC with an IP address, mask, and gateway and enable the web interface Correct answer.
  4. Configure the FMC as a DHCP server for the management network

Explanation

Initial FMC setup requires addressing the management interface and enabling HTTPS access so administrators can reach the web interface. DHCP services and data-interface forwarding are not part of enabling administrative web access.

Question 34Deployment and Initial Configuration

An administrator wants to verify that an FTD has the correct management configuration before registering it with the FMC. Which command-line action is appropriate?

  1. Display the management interface configuration and default route on the device Correct answer.
  2. Display the device's license file contents
  3. Display the device's NAT translation table
  4. Display the data-plane access control policy on the device

Explanation

Verifying the management interface address and default route confirms the device can reach the FMC. Access control policy, license contents, and NAT tables do not verify management reachability.

Question 35Deployment and Initial Configuration

An engineer is deploying an FTD in a high-availability pair managed by an FMC. Which configuration is required on both devices before forming the HA pair?

  1. Matching license files installed on both devices
  2. Matching hardware models and software versions with dedicated failover links Correct answer.
  3. Matching data interface IP addresses on both devices
  4. Matching hostnames and management IP addresses

Explanation

HA pairs require matching hardware and software plus dedicated failover and state links so the devices can synchronize. Hostnames and management IPs must be unique, and data interface addressing follows HA configuration rules rather than requiring identical addresses.

Question 36Deployment and Initial Configuration

An administrator is configuring the FMC to manage devices that are behind NAT and must ensure the devices can register. Which FMC setting is relevant?

  1. The device's license entitlement
  2. The device's data interface IP address
  3. The device's DNS server address
  4. The NAT ID configured on the device and referenced during registration Correct answer.

Explanation

When a device is behind NAT, a NAT ID is configured on the device and used during registration so the FMC can identify and communicate with it. Data interface addresses, DNS, and license entitlements do not address NAT traversal for registration.

Question 37Deployment and Initial Configuration

An engineer is planning to deploy multiple FTDs managed by a single FMC and wants to apply consistent policies efficiently. Which FMC construct allows policies to be applied to a group of devices at once?

  1. Device groups Correct answer.
  2. Network objects
  3. Port objects
  4. Access control rules

Explanation

Device groups let administrators organize managed devices and apply policies to the group rather than to each device individually. Access control rules, network objects, and port objects are policy elements, not device organization constructs.

Question 38Deployment and Initial Configuration

An administrator is troubleshooting a failed FTD registration with the FMC and suspects a certificate or trust issue. Which step best isolates the cause?

  1. Verify the registration key and confirm the device can reach the FMC management address Correct answer.
  2. Replace the FMC hardware
  3. Reconfigure the data-plane access control policy
  4. Reinstall the FTD software image

Explanation

Registration failures commonly stem from an incorrect registration key or unreachable FMC management address, so verifying both isolates the cause. Reinstalling software, replacing hardware, or changing data-plane policy does not address registration trust.

Question 39Deployment and Initial Configuration

An engineer is evaluating whether to manage an FTD with an FMC or locally with FDM for a small branch deployment. Which consideration is most relevant to the decision?

  1. FMC cannot manage devices in routed mode
  2. FDM supports more devices than FMC
  3. FMC provides centralized multi-device management, while FDM manages a single device locally Correct answer.
  4. FDM requires a separate license server for each device

Explanation

The FMC is designed for centralized management of multiple devices, whereas FDM provides local management of a single device. FDM does not scale beyond one device, and FMC supports routed mode deployments.

Question 40Deployment and Initial Configuration

An administrator is planning the initial FMC deployment and must decide how to handle backups. Which statement accurately describes FMC backup planning?

  1. Backups should be scheduled and stored off-box to support recovery of configuration and policies Correct answer.
  2. Backups are unnecessary because the FMC replicates configuration to managed devices
  3. Backups capture only device licenses, not policies
  4. Backups can only be taken during initial setup

Explanation

FMC backups capture configuration and policies and should be scheduled and stored off-box so the manager can be restored after failure. Managed devices do not serve as configuration backups, and backups are not limited to initial setup or licenses.

Question 41Configuration and Management of Cisco Firepower Management Center

An administrator registers a new managed device to the FMC and wants the device's health and policy status to appear in the FMC dashboard without manual polling. Which configuration must be enabled on the device record?

  1. Add the device to a device group
  2. Assign the device to a NAT policy
  3. Enable the health monitoring and eventing settings on the device entry Correct answer.
  4. Configure a syslog alert for the device

Explanation

Health monitoring and eventing must be enabled on the managed device record so the FMC receives health status and policy deployment state automatically. Syslog alerts, NAT policies, and device groups do not drive the health dashboard feed.

Question 42Configuration and Management of Cisco Firepower Management Center

Which two components must match between the FMC and a managed device for a successful registration? (Choose the best answer.)

  1. The device's serial number and the FMC's license
  2. The access control policy name and the device hostname
  3. The management IP reachability and matching registration key Correct answer.
  4. The FMC's time zone and the device's time zone

Explanation

Registration requires IP reachability between FMC and the device plus a matching registration key entered on both sides within the timeout window. Time zone, serial number, and policy names are not registration prerequisites.

Question 43Configuration and Management of Cisco Firepower Management Center

An engineer wants to push configuration changes to a managed device without waiting for the next scheduled policy apply. Which action accomplishes this from the FMC?

  1. Restart the device from the FMC
  2. Use the Deploy > Advanced Deploy option for that device Correct answer.
  3. Disable health monitoring on the device
  4. Edit the device's registration key

Explanation

The Advanced Deploy option lets an administrator push pending configuration to a specific device immediately rather than waiting for the scheduled deployment. Restarting the device, editing the key, or disabling health monitoring does not push policy.

Question 44Configuration and Management of Cisco Firepower Management Center

Which object type should be used to represent a group of IP addresses that will be referenced across multiple access control rules?

  1. Variable set
  2. Port object group
  3. Network object group Correct answer.
  4. Security intelligence feed

Explanation

A network object group bundles multiple host, range, or subnet objects so they can be referenced once across many rules. Port object groups hold ports, security intelligence feeds hold reputation data, and variable sets hold reusable values for templates.

Question 45Configuration and Management of Cisco Firepower Management Center

What is the purpose of a device group in the FMC?

  1. To group devices so a single policy can be applied to all members Correct answer.
  2. To cluster devices for high availability
  3. To synchronize time across devices
  4. To share licenses among devices

Explanation

Device groups let administrators apply a single policy to many managed devices at once, simplifying management at scale. They do not provide HA clustering, license sharing, or time synchronization.

Question 46Configuration and Management of Cisco Firepower Management Center

An administrator needs to back up the FMC configuration before an upgrade. Which backup type captures the full configuration including events?

  1. Configuration backup only
  2. Full backup Correct answer.
  3. Policy export
  4. Rule export

Explanation

A full backup includes both configuration and event data, whereas a configuration-only backup excludes events. Policy and rule exports capture only policy definitions, not the full system state.

Question 47Configuration and Management of Cisco Firepower Management Center

Which FMC feature allows an administrator to schedule recurring tasks such as backups and report generation?

  1. Task scheduler Correct answer.
  2. Audit log
  3. Dashboard
  4. Health monitor

Explanation

The task scheduler in the FMC lets administrators define recurring jobs such as backups, report generation, and policy deployments. Audit logs record actions, the health monitor shows status, and the dashboard displays widgets.

Question 48Configuration and Management of Cisco Firepower Management Center

Where in the FMC would an administrator configure the email server used for alert notifications?

  1. Objects > Object Management
  2. System > Configuration > Email Correct answer.
  3. Devices > Device Management
  4. Policies > Access Control

Explanation

Email server settings for alerting are configured under System > Configuration > Email. Access control, device management, and object management pages do not host SMTP settings.

Question 49Configuration and Management of Cisco Firepower Management Center

An administrator wants the FMC to send an alert when a managed device fails to receive a policy deployment. Which configuration supports this?

  1. Configure a correlation policy with a deployment failure trigger Correct answer.
  2. Create an access control rule with logging enabled
  3. Enable SNMP traps on the managed device
  4. Add the device to a device group

Explanation

Correlation policies can trigger alerts based on system events such as deployment failures. SNMP traps, access control logging, and device groups do not generate deployment-failure alerts in the FMC.

Question 50Configuration and Management of Cisco Firepower Management Center

An engineer must ensure that only members of a specific LDAP group can log in to the FMC with administrator rights. Which configuration achieves this?

  1. Configure a RADIUS server without group mapping
  2. Enable SNMPv3 on the FMC
  3. Create a local user for each LDAP member
  4. Configure an LDAP external authentication object and map the group to the Administrator role Correct answer.

Explanation

External authentication objects map directory groups to FMC roles, so LDAP group membership determines role assignment at login. Local accounts, SNMPv3, and unmapped RADIUS do not enforce group-based role assignment.