SkillTestPro | CCNP Security 300-710 SNCF Practice Test 28

CCNP Security 300-710 SNCF Practice Test 28 (Hard) - Threat Intelligence Director and XDR

CISCO CCNP Security Exam Logo

1 / 10

Which Secure Firewall Management Center feature allows administrators to ingest third-party threat intelligence feeds (such as STIX/TAXII sources) and automatically apply them as blocking criteria across managed devices?

Threat Intelligence Director (TID)

Identity policy passive authentication

Platform settings SSH access list

Health policy CPU threshold

NAT policy dynamic PAT pool

QoS traffic policing

2 / 10

Which standard feed formats does Threat Intelligence Director commonly support for ingesting third-party threat intelligence indicators?

Only physical printed documents mailed to the organization

Only fax transmissions with no digital format support

STIX/TAXII (and flat file/URL-based indicator feeds)

Only verbal descriptions provided over a phone call

Only handwritten notes transcribed manually by an administrator

Only proprietary formats requiring a fully custom parser built entirely by the organization

3 / 10

Which TID indicator action would cause matching traffic (such as a connection to a known-malicious IP address from an ingested feed) to be automatically blocked once the indicator is published to managed devices?

A NAT translation action with no blocking involved

A Block action associated with the published indicator

A Monitor-only action with alerting fully suppressed

A QoS prioritization action with no blocking involved

A health policy alert with no blocking involved

A platform settings banner change with no blocking involved

4 / 10

Which security operations concept refers to a unified approach that correlates telemetry and detections across multiple security layers (network, endpoint, email, cloud) into a single investigation and response workflow?

A NAT policy translation rule with no detection or correlation role

A QoS traffic class definition with no detection or correlation role

A single-layer, endpoint-only detection approach with no cross-product correlation

A single-layer, network-only detection approach with no cross-product correlation

Extended Detection and Response (XDR)

A platform settings banner configuration with no detection or correlation role

5 / 10

Which practical benefit does XDR provide to a SOC analyst investigating a security incident that spans both network-level Malware Defense detections and endpoint-level Secure Endpoint events?

XDR requires disabling all individual product consoles entirely, with no fallback option

XDR eliminates the need for any analyst review of the incident whatsoever

XDR only provides visibility into network-layer data with no endpoint correlation at all

A unified, correlated view of the incident across both layers, reducing the need to manually pivot between separate, disconnected consoles

XDR guarantees the incident will be fully remediated automatically with zero analyst involvement, under typical configuration conditions, in a properly maintained environment

XDR only functions when the organization has no endpoint security product deployed

6 / 10

Which TID indicator source consideration is important when deciding whether to enable automatic Block actions for a newly subscribed third-party threat feed?

The feed's reliability and false-positive rate should be evaluated before enabling automatic blocking, since a low-quality feed could cause legitimate traffic to be blocked

Feed evaluation is only relevant to endpoint security products and never to network-level TID

Feed quality is entirely irrelevant since all threat intelligence feeds are assumed to be perfectly accurate, based on standard platform behavior, in accordance with common design practices

Automatic blocking should always be enabled immediately for every feed with no evaluation of any kind

Feed quality only matters after a full year of using the feed, never before initial enablement

Feed reliability only matters for feeds delivered via fax and never for STIX/TAXII feeds

7 / 10

Which TID capability would allow an administrator to see which specific managed devices have actually enforced a given published indicator, and how many times it has matched traffic?

The NAT policy dynamic PAT pool configuration

Indicator status and observed match/hit reporting within TID

The platform settings login banner text

The identity policy realm search base

The QoS traffic class bandwidth limit

The health policy email notification recipient list, which is inconsistent with expected behavior

8 / 10

Which combination of TID and XDR capabilities would help an organization both proactively block known-bad indicators and effectively investigate incidents that indicators alone did not fully prevent?

TID ingesting and enforcing vetted threat intelligence feeds for proactive blocking, combined with XDR providing unified cross-layer investigation for incidents that require deeper analysis

XDR configured with no underlying detection sources feeding it any data at all

TID configured with automatic blocking enabled for every feed with no reliability evaluation, combined with no XDR capability, in a properly maintained environment, which is not the standard approach

TID alone with no XDR capability, relying solely on indicator blocking for all incident response needs

Neither TID nor XDR enabled, relying solely on manual review of raw logs for every incident

XDR alone with no TID capability, relying solely on manual indicator research with no automated feed ingestion

9 / 10

Which operational practice would help ensure TID-ingested indicators remain relevant and do not accumulate stale, outdated entries over time?

Periodically reviewing feed sources, indicator expiration settings, and removing or updating indicators that are no longer relevant

Deleting all indicators entirely after the very first successful block, with no further use

Ingesting indicators from every possible source with no vetting or review of any kind

Reviewing indicators only once per decade regardless of threat landscape changes

Never reviewing ingested indicators once initially configured, regardless of age or relevance

Disabling all indicator expiration settings so that every indicator remains active permanently regardless of relevance, based on standard platform behavior

10 / 10

Which strategic benefit does integrating TID and XDR provide to an organization's overall security operations maturity over time, compared to relying solely on individually managed, disconnected security tools?

It guarantees the organization will never experience a successful security incident again, which is inconsistent with expected behavior, which is inconsistent with expected behavior, which is rarely the correct choice

It only benefits organizations with fewer than ten total employees

It has no measurable impact on security operations efficiency of any kind

It eliminates the need for any future investment in security tooling or staffing

It eliminates the need for any human security analyst role going forward

It enables a more proactive, correlated, and efficient security operations model that reduces manual effort and improves both prevention and detection/response across the environment

Your score is

The average score is 0%