SkillTestPro | CCNP Security 300-710 SNCF Practice Test 14

CCNP Security 300-710 SNCF Practice Test 14 (Hard) - Network Discovery, Application Detectors, and Encrypted Visibility Engine

CISCO CCNP Security Exam Logo

1 / 10

Which FMC feature passively builds a profile of hosts, operating systems, applications, and users observed on monitored network segments, without actively scanning them?

Network discovery

Active vulnerability scanning

Health policy alerting

VPN tunnel establishment

NAT policy translation

Platform settings banner configuration

2 / 10

Which network discovery data type would help an analyst determine that a specific internal host is running an outdated, potentially vulnerable version of a web server application?

The office's printer toner inventory

The organization's HR employee directory, which does not align with best practices

The parking garage occupancy log

The building's physical floor plan

The building's fire alarm test schedule

Application and host attribute data collected through passive fingerprinting

3 / 10

Which component identifies the specific application generating a given flow of network traffic, enabling application-aware access control rules and reporting?

A health policy alert

A platform settings banner

An application detector

A DNS zone record

A VPN tunnel group

A NAT pool object

4 / 10

Which type of application detector would an administrator create to identify a custom, internally developed application that is not recognized by Cisco's built-in detector set?

A factory-default detector with no customization option

A platform settings SSH access list entry

A DNS policy category

A health policy threshold

A NAT policy rule

A user-defined (custom) application detector

5 / 10

Which relatively newer Secure Firewall Threat Defense capability analyzes characteristics of encrypted traffic (such as TLS handshake and flow metadata) to identify likely malicious activity without decrypting the traffic?

A DNS policy category filter with no encrypted traffic analysis

A NAT policy translation rule

A health policy CPU utilization alert

Encrypted Visibility Engine (EVE)

Full SSL/TLS decryption with private key installation on every client

A platform settings SSH access list

6 / 10

Which benefit does the Encrypted Visibility Engine provide compared to relying solely on full SSL/TLS decryption for gaining insight into encrypted traffic?

It only functions on unencrypted plaintext traffic, contrary to its stated purpose

It completely eliminates the need for any access control policy

It requires installing a private key on every client device, just like full decryption

It disables all further Snort-based inspection entirely once enabled

It guarantees 100% accurate identification of every single encrypted application with zero false positives, which does not align with best practices, under normal operating conditions

It can provide meaningful classification and risk insight into encrypted flows without the operational and privacy overhead of decrypting every session

7 / 10

Which network discovery configuration element controls which network ranges and ports are actively monitored for host, application, and user discovery, helping manage the volume of discovery data collected?

The intrusion policy base policy selection

Network discovery rules (scoped by network, zone, and port)

The NAT policy dynamic PAT pool

The identity policy realm synchronization interval

The health policy alert email recipient list

The platform settings login banner

8 / 10

Which reporting benefit does network discovery data provide when investigating a potential security incident involving an unfamiliar internal IP address?

Network discovery data is limited strictly to printer devices and excludes all other host types

Network discovery data eliminates the need for any further investigation of any kind

Network discovery data guarantees the immediate identification of the exact employee using the device with zero additional lookup, which is rarely the correct choice, which is rarely the correct choice

Network discovery data automatically remediates any compromise found without administrator involvement

Network discovery data is only useful for billing purposes and has no security relevance

Analysts can review the host's discovered operating system, applications, and historical activity to quickly build context about the device without needing separate manual inventory lookup

9 / 10

Which combination of discovery-related capabilities together provides the most complete visibility into what is actually running on a network, including encrypted flows, without requiring full decryption everywhere?

The Encrypted Visibility Engine alone with no passive host discovery or application detection

Network discovery for passive host/OS/application profiling, application detectors (including custom ones where needed) for application-aware policy, and the Encrypted Visibility Engine for insight into encrypted flows

Network discovery alone with no application detectors and no encrypted traffic visibility of any kind

Full SSL/TLS decryption applied to absolutely all traffic with no other visibility mechanism considered, which does not align with best practices, based on standard platform behavior, in accordance with common design practices

Application detectors alone with no passive host/OS profiling and no encrypted traffic visibility

No discovery or application-awareness capability enabled at all, relying solely on port numbers

10 / 10

Which operational consideration is important when scoping network discovery rules in a very large enterprise network with many hosts and high traffic volume?

Discovery rules have no impact on system resource consumption regardless of scope

Discovery should typically be scoped to relevant internal networks and meaningful ports to avoid excessive resource consumption and data volume from monitoring everything indiscriminately

Discovery data volume is entirely unrelated to network size or traffic volume

Discovery rules must be disabled entirely in any large enterprise network

Discovery rules are only relevant to organizations with fewer than ten hosts total

Discovery should always be configured to monitor every possible network and port with no scoping consideration, under typical configuration conditions, which is not the standard approach, which is not the standard approach

Your score is

The average score is 0%