Implementing Secure Solutions with Virtual Private Networks

Question 1

Refer to the exhibit. A network security administrator receives this error message after configuring a site-to-site IPsec VPN between two sites What is the solution to this problem?

A. Crypto map must be applied to correct interface.

B. Transport set must match between sites.

C. ISAKMP policy must match between sites.

D. IPsec policy must match between sites.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

An engineer notices that while an employee is connected remotely, all traffic is being routed to the corporate network. Which split-tunnel policy allows a remote client to use their local provider for Internet access when working from home?

A. excludespecified

B. excludeall

C. tunnelall

D. tunnelspecified

Correct Answer: D

Question 3

Refer to the exhibit. The DMVPN tunnel is dropping randomly and no tunnel protection is configured.

Which spoke configuration mitigates tunnel drops?

A.

B.

C.

D.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

Which two statements are true when designing a SSL VPN solution using Cisco AnyConnect?
(Choose two.)

A. A SSL group pre-shared key must be configured on the server.

B. The VPN IP address pool can overlap with the rest of the LAN networks.

C. DTLS can be enabled for better performance.

D. Server side certificate is optional if using AAA for client authentication.

E. The VPN server must have a self-signed certificate.

Correct Answer: B,C

Question 5

Which parameter in IPsec VPN tunnel configurations is optional?

A. encryption

B. hash

C. lifetime

D. Perfect Forward Secrecy

Correct Answer: D

Question 6

An administrator is setting up Cisco AnyConnect on a Cisco ASA with the requirement that AnyConnect automatically establishes a VPN when a company-owned laptop is connected to the internet outside of the corporate network. Which configuration meets these requirements?

A. SBL with machine certificate authentication

B. TND with user certificate authentication

C. SBL with user certificate authentication

D. TND with machine certificate authentication

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

Refer to the exhibit. A company has been using SAML to authenticate their clientless SSLVPN users. After about a year of uptime in production, users begin to experience issues authenticating. Based on the collected debugs, which action resolves the issue?

A. Increase the SAML Request Timeout value on the ASA.

B. Replace the expired IdP signing certificate with a valid one.

C. Verify that the IdP is using the SAML-attribute NameID.

D. Ensure that the ASA and IdP are synchronized to a NTP server.

Correct Answer: D

Question 8

A network administrator is troubleshooting a FlexVPN tunnel. The hub router is unable to ping the spoke router's tunnel interface IP address of 192.168.1.2, even though the tunnel is showing up.
The output of the debug ip packet CLI command on the hub router shows the following entry.
IP: tableid=0123456789 s=192.168.1.1 (local), d=192.168.1.2 (loopback2), routed via FIB.
What must be configured to fix this issue?

A. A matching IKEv2 pre-shared key on the hub and spoke routers in the crypto keyring configuration.

B. A route map must be configured on hub router to set the next hop for 192.168.1.2 to the dynamic VTI.

C. An outbound ACL on the dynamic VTI of the hub router that allows ICMP traffic to 192.168.1.2.

D. An IKEv2 authorization policy must be configured on the spoke router to advertise the interface route.

Correct Answer: D

Question 9

An administrator is designing a VPN with a partner's non-Cisco VPN solution. The partner's VPN device will negotiate an IKEv2 tunnel that will only encrypt subnets 192.168.0.0/24 going to
10.0.0.0/24. Which technology must be used to meet these requirements?

A. VTI

B. GETVPN

C. DMVPN

D. crypto map

Correct Answer: D

Question 10

Cisco AnyConnect Secure Mobility Client has been configured to use IKEv2 for one group of users and SSL for another group. When the administrator configures a new AnyConnect release on the Cisco ASA, the IKEv2 users cannot download it automatically when they connect. What might be the problem?

A. Client services are not enabled.

B. The XML profile is not configured correctly for the affected users.

C. Client software updates are not supported with IKEv2.

D. The new client image does not use the same major release as the current one.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 11

Which technology works with IPsec stateful failover?

A. HSRP

B. VRRP

C. GRE

D. GLBR

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 12

Which is used by GETVPN, FlexVPN and DMVPN?

A. NHRP

B. ESP

C. GRE

D. MPLS

Correct Answer: B

Question 13

Refer to the exhibit. A new IPsec VPN tunnel has been configured and the security associations do not establish. After the show crypto isakmp command is run, the output is displayed. What must be reconfigured to resolve the issue?

A. keep-alive values

B. peer address

C. pre-shared key

D. transform sets

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Cisco Implementing Secure Solutions with Virtual Private Networks - 300-730 Exam Practice Test

Latest Update

Useful Links

Contact Us