300-710 Exam Dumps - Securing Networks with Cisco Firepower (300-710 SNCF)

Reason: the command "capture-traffic" is used for SNORT Engine Captures. To capture a LINA Engine Capture, you use the "capture" command. Since the Lina Engine represents the actual physical interface of the device, "capture" is the only reasonable choice Reference: https://www.cisco.com/c/en/us/support/ docs/security/firepower-ngfw/212474-working-with-firepower-threat-defense-f.html#anc10

The command is

firepower# capture DMZ interface dmz trace detail match ip host 192.168.76.14 host 192.168.76.100

firepower# capture INSIDE interface inside trace detail match ip host 192.168.76.14 host 192.168.75.14

To capture packets that are dropped by Cisco Secure Firewall Threat Defense (FTD) and troubleshoot the issue of traffic from the inside network to a webserver not getting through, the administrator should use the command to capture packets dropped by the accelerated security path (ASP) engine. The correct command is:

capture CAP type asp-drop all headers-only

This command captures all packets dropped by the ASP engine, which includes packets that are being blocked by access control policies, NAT issues, or other security checks.

Steps:

Access the FTD CLI.

Run the command capture CAP type asp-drop all headers-only to capture dropped packets.

Analyze the captured data to identify the cause of the drops.

This command provides detailed information on why packets are being dropped, helping the administrator resolve the issue.

References: Cisco Secure Firewall Threat Defense Configuration Guide, Chapter on Packet Capture and ASP Drop Captures​​​​.