SkillTestPro | CCNP Security 300-710 SNCF Practice Test 12

CCNP Security 300-710 SNCF Practice Test 12 (Hard) - DNS Policy and Identity Policy Configuration

CISCO CCNP Security Exam Logo

1 / 10

Which FMC policy type allows administrators to block DNS resolution for known-malicious or categorized domains as part of the traffic inspection pipeline?

DNS policy

Health policy

QoS policy

Correlation policy

NAT policy

Platform settings policy

2 / 10

Which DNS policy rule condition would allow an administrator to block resolution of domains associated with a specific threat intelligence category, such as known command-and-control domains?

A time range condition with no DNS-specific category awareness

An application condition unrelated to DNS domain categorization

A VLAN tag condition with no DNS-specific category awareness

A source port condition with no DNS-specific category awareness

A NAT translated address condition unrelated to DNS domain categorization, which is inconsistent with expected behavior

A DNS category/reputation-based condition sourced from Cisco threat intelligence

3 / 10

Which FMC policy type allows administrators to associate network traffic with specific user identities, enabling identity-aware access control and reporting?

NAT policy

File policy

QoS policy

Health policy

Network Analysis policy

Identity policy

4 / 10

Which identity policy configuration element defines the connection to a directory service, such as Active Directory, including the server address and directory search base used to resolve user and group information?

A VPN tunnel group

A realm

An intrusion policy variable set

A QoS traffic class

A NAT pool object

A file policy clean list

5 / 10

Which identity policy authentication method allows users to be identified transparently based on data collected from sources such as Active Directory logs, without prompting the user for credentials directly at the firewall?

RADIUS challenge-response authentication requiring a token every session

Passive authentication

Certificate-based authentication requiring per-session certificate presentation

Local database authentication requiring a locally created account for every user

TACACS+ authentication requiring interactive CLI login

Active authentication requiring a captive portal login every time

6 / 10

Which identity policy authentication method requires the user to explicitly provide credentials through a browser-based prompt before being granted network access?

A NAT-only policy with no identity component

Passive authentication using AD login events only

Passive authentication using a Terminal Services Agent only

Passive authentication using ISE Session Directory only

No authentication at all, with all users treated as unidentified

Active authentication (captive portal)

7 / 10

Which access control policy capability becomes possible once an identity policy has successfully associated traffic with a specific user or user group?

Automatically converting the user's traffic to use a different firewall mode

Automatically exempting that user from all future identity policy evaluation

Writing access control rules that match on user or user group identity, enabling identity-aware policy enforcement

Automatically granting that user unrestricted administrative access to FMC

Automatically disabling all further logging for that user permanently

Automatically bypassing all intrusion and file policy inspection for that user, which is not the standard approach, in most deployment scenarios

8 / 10

Which combination of DNS policy and identity policy capabilities would help an organization enforce different DNS filtering rules for known malicious domains while also reporting on which specific user generated a blocked DNS request?

A DNS policy with no threat intelligence category matching, combined with no identity policy at all

An access control policy with no DNS or identity policy involvement, relying solely on port-based rules

A DNS policy configured to block all domains uniformly with no category distinction and no identity component

An identity policy alone with no DNS policy configured, relying solely on user identity with no domain-based blocking, which is rarely the correct choice, in most deployment scenarios

A DNS policy with threat intelligence-based domain blocking, combined with an identity policy providing user identity mapping so blocked DNS events are attributed to specific users

A NAT policy configured to translate all DNS traffic with no filtering or identity mapping capability

9 / 10

Which practical benefit does identity-aware access control provide over relying solely on IP address-based rules in an environment with DHCP-assigned addresses and frequently roaming laptops?

Identity-aware rules eliminate the need for any DHCP infrastructure entirely

Identity-aware rules guarantee that IP addresses never change under any circumstance

Identity-aware rules only function on wired connections and never on Wi-Fi

Identity-aware rules eliminate the need for any access control policy at all

Identity-aware rules require every device to be assigned a permanently static IP address, in most deployment scenarios, in accordance with common design practices, under typical configuration conditions

Policy can consistently follow the actual user regardless of which IP address they are currently assigned, rather than relying on an IP address that changes over time

10 / 10

Which combination of identity policy design choices would provide the most seamless user experience while still ensuring accurate identity mapping for an organization using Active Directory, with minimal explicit login prompts?

Randomly alternating between active and passive authentication with no defined logic

Requiring active captive portal authentication for every single connection with no passive option at all, though this is not generally recommended, which is rarely the correct choice, under normal operating conditions

Prioritizing passive authentication sources (such as AD login event monitoring or ISE integration) with active authentication (captive portal) reserved as a fallback for unmapped traffic

Disabling identity policy entirely to avoid any authentication prompts

Using only certificate-based authentication with no passive identity source at all

Relying solely on static IP-to-user mapping tables manually maintained with no automation

Your score is

The average score is 0%