CCNP Security 300-710 SNCF Practice Test 11

Correct Answer: Access control policy
Explanation: The access control policy is the primary mechanism for deciding how traffic is allowed, blocked, or further inspected, which is distinct from platform settings (device configuration), health policy (monitoring), correlation policy (event-driven response), and the narrower roles of DNS or identity policy alone.

Correct Answer: The default action
Explanation: The default action determines how unmatched traffic is handled, which is distinct from a variable set (used within intrusion policies), an intrusion rule state, a file policy timeout, an identity policy authentication method, or a NAT interface PAT setting.

Correct Answer: The Application condition (using application detectors)
Explanation: The Application condition uses application detectors to match traffic by the actual application generating it, unlike VLAN tag, source port, time range, URL, or realm conditions alone, which do not provide application-layer identification on their own.

Correct Answer: Allow (with associated intrusion and/or file policy inspection configured on the rule)
Explanation: An Allow rule with intrusion/file policy inspection attached sends matching traffic through deeper inspection before final handling, unlike Block/Block with reset (immediate drop), Trust (bypasses Snort inspection), Monitor (log-only, no blocking or deep inspection tie-in for the final verdict), or Interactive Block (blocks with an option to bypass, not deep-inspect-then-decide).

Correct Answer: Rule categories
Explanation: Rule categories provide logical grouping of rules for organizational clarity, which is distinct from the default action, SSL decryption policy targeting, identity policy realm assignment, intrusion policy variable sets, or malware defense cloud lookup timeouts.

Correct Answer: Rules are evaluated from top to bottom, and the first rule that matches the traffic's conditions is applied
Explanation: Access control rules are evaluated top-down, with the first matching rule applied, unlike random order, simultaneous application with automatic conflict merging, alphabetical-by-name ordering, only evaluating the last rule, or strict reverse-chronological-by-creation-date ordering.

Correct Answer: The rule-level intrusion policy assignment within an individual access control rule's inspection settings
Explanation: Rule-level intrusion policy assignment lets different rules apply different intrusion policies to their matched traffic, unlike the SSH access list, health policy thresholds, NAT PAT pools, identity policy authentication methods, or correlation policy response groups, none of which control per-rule inspection policy assignment.

Correct Answer: Logging at the beginning and/or end of connection (Log at Beginning of Connection / Log at End of Connection)
Explanation: The connection logging settings (beginning/end of connection) control whether connection events are sent to FMC for analysis, which is distinct from application, source zone, VLAN tag, and URL category conditions, or a file policy assignment (which governs file/malware inspection, not connection logging).

Correct Answer: Permitting known, high-volume, low-risk internal traffic (such as backup replication between trusted internal servers) to bypass further Snort inspection for performance reasons
Explanation: Trust is appropriately used for known, low-risk, high-volume internal traffic to reduce inspection overhead, unlike trusting arbitrary unknown external inbound traffic, traffic already flagged malicious, traffic from a known-compromised source, blanket unconditional trust, or trusting traffic simply because logging happens to be off.

Correct Answer: Organizing rules into logical categories, applying the most specific rules near the top, attaching appropriate intrusion/file policies to allow rules, enabling connection logging on meaningful rules, and setting a sensible default action
Explanation: Effective policy design combines logical organization, correct rule ordering (specific-to-general), appropriate deep inspection, meaningful logging, and a deliberate default action, unlike an unorganized rule list with no logging or default action review, placing broad rules before specific ones (which would shadow them), disabling all logging, skipping deep inspection entirely, or leaving the default action unreviewed.