300-210 Sample Questions & Answers
FirePOWER IPS configuration and security intelligence make up the heaviest weight, from protecting web, email and cloud traffic with content-security appliances to malware protection via a next-gen firewall, Security Manager integration, and troubleshooting.
Launch the full 300-210 simulator →Showing 8 of 17 free samples.
- Question 1Intermediate
Content Security · Web Security Appliance (WSA)
A multinational financial organization is deploying Cisco Web Security Appliances (WSA) across three regional data centers. The network architecture team requires that the WSAs be deployed without altering the existing client browser configurations or the IP addressing scheme of the end-user subnets. The solution must support WCCP v2 for traffic redirection from the core switches. Which deployment mode and interface configuration meets these specific requirements?
Show answer & explanation
Correct answer: A
Transparent Mode allows the WSA to filter traffic without requiring client-side browser configuration changes. Combined with WCCP v2 redirection from the network infrastructure, this meets the requirement to maintain existing IP schemes and client settings while inspecting traffic.
- Question 2Intermediate
Content Security · Email Security Appliance (ESA)
An administrator is troubleshooting an issue where legitimate internal emails are being blocked by the Cisco Email Security Appliance (ESA). The message tracking logs indicate the messages are being stopped at the connection level before content scanning occurs. Which configuration component should be analyzed first to resolve this issue?
Show answer & explanation
Correct answer: C
The Host Access Table (HAT) is the first line of defense in the ESA pipeline. It controls incoming connections based on the sender's IP address or reputation. If messages are blocked at the connection level before content scanning, it indicates a rejection by a HAT policy or SenderGroup.
- Question 3Intermediate
Network Threat Defense · Next-Generation Firewall (NGFW)
A security architect is designing a Cisco Firepower Threat Defense (FTD) deployment for a high-frequency trading firm. The primary requirement is microsecond-level latency, and the FTD device must sit between the core switch and the edge router without acting as a hop in the network routing table. Which interface mode should be configured?
Show answer & explanation
Correct answer: C
Transparent Mode (Layer 2) allows the FTD to act as a 'bump in the wire,' inspecting traffic without being a routed hop. This minimizes network redesign and is ideal for environments requiring stealthy insertion or minimal routing changes.
- Question 4Beginner
Network Threat Defense · Advanced Malware Protection (AMP)
While analyzing a malware incident, a security analyst notices that a file previously marked as 'Clean' by Cisco AMP has suddenly generated a 'Malicious' alert without the file being re-downloaded. What AMP capability is responsible for this behavior?
Show answer & explanation
Correct answer: C
Retrospection is the AMP feature that continuously analyzes file dispositions. If threat intelligence updates change a file's disposition from clean to malicious (or vice versa), AMP sends a retrospective alert for all systems where that file was previously seen.
- Question 5Intermediate
Cisco Security Manager and Other Tools · Integration and Orchestration
A network administrator needs to integrate Cisco Identity Services Engine (ISE) with the Firepower Management Center (FMC) to enforce user-based access control policies. Which protocol is primarily used for the exchange of contextual information between ISE and FMC?
Show answer & explanation
Correct answer: C
pxGrid is the Cisco proprietary protocol used to share context (user identity, device type, security posture) between ISE and other ecosystem partners like FMC. This allows FMC to write policies based on 'User' rather than just IP addresses.
- Question 6Advanced
Cisco FirePOWER Next-Generation IPS (NGIPS) · NGIPS Configuration
In a Cisco Firepower NGIPS deployment, an administrator wants to ensure that the IPS rules are automatically tuned based on the operating systems and services actually running on the network. Which feature must be enabled and properly configured to achieve this adaptive security posture?
Show answer & explanation
Correct answer: C
The Firepower Recommendations feature uses data from Firepower Network Discovery (host profiles) to analyze the network environment and recommend which intrusion rules should be enabled or disabled. This allows the policy to adapt to the specific OS and services detected.
- Question 7Beginner
Network Threat Defense · Next-Generation Firewall (NGFW)
You are configuring an Access Control Policy on a Firepower Management Center. You need to ensure that traffic from the 'HR-VLAN' destined for the 'Finance-Server' is inspected by the IPS, but you do not want to block any traffic yet, only log what would have been blocked. Which action should you select for the rule?
Show answer & explanation
Correct answer: B
To inspect traffic without dropping it (unless the IPS rule itself is set to drop), you use the 'Allow' action and associate an Intrusion Policy. To achieve 'log only' behavior for IPS events, the Intrusion Policy itself would need to be in a non-blocking state (e.g., rules set to 'Generate Events' only), or you accept that 'Allow' permits the connection subject to IPS inspection.
- Question 8Advanced
Cisco Security Manager and Other Tools · Cisco Security Manager (CSM)
Case Study:
Company X is using Cisco Security Manager (CSM) to manage 50 ASA firewalls. A junior engineer creates a new policy bundle for the 'Branch-Office' device group. However, after deployment, users at the branch offices report they can no longer access the corporate intranet, although internet access works fine.
The engineer discovers that a global mandatory rule was accidentally overridden by a local rule in the new policy bundle.
Which CSM feature should have been used or checked to prevent local rules from overriding critical global mandatory rules?
Show answer & explanation
Correct answer: C
In CSM, Rule Inheritance determines the order of rule enforcement. Policies are typically structured as Mandatory (Global) -> Default (Local) -> Mandatory (Global). Ensuring the critical intranet access rules were in the Mandatory section would prevent local policy bundles from overriding them.
Ready for the real thing?
The full 300-210 simulator has every exam-style question, timed mode, and instant scoring.