Cisco Certified Specialist – Network Security Firepower (300-710) SNCF Exam Guide

Securing Networks with Cisco Firewalls v1.1 (300-710)

Exam Overview: The Securing Networks with Cisco Firewalls v1.1 (SNCF 300-710) is a 90-minute exam linked to the CCNP Security Certification. It assesses a candidate’s expertise in Cisco Secure Firewall (formerly Cisco Firepower) and Cisco Secure Firewall Management Center (formerly Cisco Firepower Management Center), covering policy configurations, integrations, deployments, management, and troubleshooting.

The following topics serve as a general guide for the exam content, but other relevant topics may also appear. These guidelines are subject to change at any time without notice to ensure they accurately reflect the exam’s scope and clarity.

1.0 Deployment

1.1 Implement Secure Firewall modes

• 1.1.a Routed mode: Operates as a layer 3 device, routing traffic between networks.
• 1.1.b Transparent mode: Functions as a layer 2 bridge, passing traffic between network segments without routing.

1.2 Implement NGIPS modes

• 1.2.a Passive: Monitors traffic without interfering, ideal for detection and analysis.
• 1.2.b Inline: Sits directly in the traffic path, able to block or allow traffic based on rules.

1.3 Implement high availability options

• 1.3.a Port channels: Combines multiple interfaces into a single logical link for redundancy and increased throughput.
• 1.3.b Failover: Provides backup by switching to a standby unit if the primary fails.
• 1.3.c Equal-Cost Multipath (ECMP) routing: Balances traffic across multiple equal-cost paths for redundancy and load distribution.
• 1.3.d Static route tracking: Monitors static routes and adjusts routing based on network changes.
• 1.3.e Clustering: Groups multiple devices for load balancing and redundancy, acting as a single logical unit.

1.4 Describe virtual appliance on-premises and cloud deployment

• Discusses deploying firewall solutions in virtual environments, both on-premises and in cloud platforms, for flexibility and scalability.

2.0 Configuration

2.1 Configure system settings in Secure Firewall Management Center

• Involves setting global parameters for firewall operation and management.

2.2 Configure policies in Secure Firewall Management Center

• 2.2.a Access control: Defines rules for allowing or blocking network traffic.
• 2.2.b Intrusion: Sets parameters for detecting and preventing intrusions.
• 2.2.c Malware & File: Manages detection and prevention of malware and suspicious files.
• 2.2.d DNS: Configures policies for monitoring and controlling DNS traffic.
• 2.2.e Identity: Utilizes user identities in policy enforcement.
• 2.2.f Decryption: Manages encrypted traffic for inspection.
• 2.2.g Prefilter: Applies initial filtering to reduce load on deeper inspection layers.

2.3 Configure these features using Secure Firewall Management Center

• 2.3.a Network discovery: Identifies and maps network devices and services.
• 2.3.b Application detectors: Identifies applications running on the network.
• 2.3.c Correlation: Associates events and alerts for comprehensive threat analysis.
• 2.3.d Encrypted visibility engine: Provides insights into encrypted traffic without decryption.

2.4 Configure objects using Secure Firewall Management Center

• 2.4.a Object management: Handles IP addresses, network objects, and service groups.
• 2.4.b Intrusion rules: Manages specific intrusion detection and prevention rules.

2.5 Configure devices using Secure Firewall Management Center

• 2.5.a Device management: Involves adding and managing firewall devices.
• 2.5.b NAT: Configures Network Address Translation for traffic manipulation.
• 2.5.c VPN: Sets up Virtual Private Networks for secure remote access.
• 2.5.d QoS: Manages Quality of Service settings for traffic prioritization.
• 2.5.e Platform settings: Adjusts device-specific settings and preferences.
• 2.5.f Certificates: Manages security certificates for encryption and identity.
• 2.5.g Routing: Configures routing protocols and static routes.

2.6 Describe the use of Snort within Secure Firewall Threat Defense

• Explains how Snort is utilized for network intrusion detection and prevention within the firewall.

3.0 Management and Troubleshooting

3.1 Troubleshoot with Secure Firewall Management Center GUI and device CLI

• Uses graphical and command-line interfaces for diagnosing issues.

3.2 Configure dashboards and reporting in Secure Firewall Management Center

• Involves setting up visual dashboards and generating reports for monitoring and analysis.

3.3 Troubleshoot using:

• 3.3.a packet capture procedures: Captures and analyzes network traffic for troubleshooting.
• 3.3.b Packet Tracer: Simulates packet flow to diagnose routing and policy issues.

3.4 Analyze risk and standard reports

• Reviews reports to assess network security posture and identify risks.

3.5 Describe device management tools

• 3.5.a Cisco Defense Orchestrator: Centralized management tool for security devices.
• 3.5.b Cloud-delivered Firewall Management Center: Manages firewalls from the cloud.
• 3.5.c Secure Firewall Device Manager: Local device management interface.
• 3.5.d Secure Firewall Management Center: Comprehensive management platform for security policies and devices.

4.0 Integration

4.1 Configure Cisco Secure Firewall Malware Defense (formerly AMP for Networks) in Secure Firewall Management Center

• Integrates malware defense capabilities into the firewall for enhanced protection.

4.2 Configure Cisco Secure Endpoint (formerly AMP for Endpoints) integration with Secure Firewall Management Center

• Links endpoint security with the firewall for unified threat detection and response.

4.3 Implement Threat Intelligence Director for third-party security intelligence feeds

• Uses external threat intelligence sources for enhanced security awareness.

4.4 Describe using Cisco SecureX for security investigations

• Utilizes SecureX for orchestrated threat investigation and response across Cisco products.

4.5 Describe Secure Firewall Management Center integration using pxGrid

• Describes integration with other security solutions via the pxGrid platform for information sharing.

4.6 Describe Rapid Threat Containment (RTC) functionality within Secure Firewall Management Center

• Details the ability to quickly contain threats using automated responses within the firewall management system.

4.7 Describe Cisco Security Analytics and Logging

• Discusses tools for analyzing security events and maintaining logs for audit and compliance.