السؤال #1

Which type of VPN technology is being used when the ssl trust-point command is configured?

A. GETVPN

B. IPsec site-to-site VPN

C. SSL Remote Access VPN

D. DMVPN

عرض الإجابة

اجابة صحيحة: C

السؤال #2

Which configuration construct must be used in a FlexVPN tunnel?

A. EAP configuration

B. multipoint GRE tunnel interface

C. IKEv1 policy

D. IKEv2 profile

عرض الإجابة

اجابة صحيحة: D

السؤال #3

Which command is used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?

A. show crypto ikev2 sa

B. show crypto isakmp sa

C. show crypto gkm

D. show crypto identity

عرض الإجابة

اجابة صحيحة: A

السؤال #4

Which command is used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?

A. show crypto ikev2 sa

B. show crypto isakmp sa

C. show crypto gkm

D. show crypto identity

عرض الإجابة

اجابة صحيحة: A

السؤال #5

Which command is used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?

A. show crypto ikev2 sa

B. show crypto isakmp sa

C. show crypto gkm

D. show crypto identity

عرض الإجابة

اجابة صحيحة: A

السؤال #6

Which command is used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?

A. show crypto ikev2 sa

B. show crypto isakmp sa

C. show crypto gkm

D. show crypto identity

عرض الإجابة

اجابة صحيحة: A

السؤال #7

Which statement about GETVPN is true?

A. The configuration that defines which traffic to encrypt originates from the key server

B. TEK rekeys can be load - balanced between two key servers operating in COOP

C. The pseudotime that is used for replay checking is synchronized via NTP

D. Group members must acknowledge all KEK and TEK rekeys, regardless of configuration

عرض الإجابة

اجابة صحيحة: A

السؤال #8

Refer to the exhibit. Client 1 cannot communicate with client 2. Both clients are using Cisco AnyConnect and have established a successful SSL VPN connection to the hub ASA. Which command on the ASA is missing?

A. ns-server value 10

B. ame-security-traffic permit intra-interface

C. ame-security-traffic permit inter-interface

D. ns-server value 10

عرض الإجابة

اجابة صحيحة: B

السؤال #9

A network engineer must design a clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was found that one website is not being rewritten correctly by the AS

A. What is a potential solution for this issue while still allowing it to be a clientless VPN setup?

B. Set up a smart tunnel with the IP address of the web server

C. Set up a NAT rule that translates the ASA public address to the web server private address on port 80

D. Set up Cisco AnyConnect with a split tunnel that has the IP address of the web server

E. Set up a WebACL to permit the IP address of the web server

F. Reveal Answer

عرض الإجابة

اجابة صحيحة: B

السؤال #10

Refer to the exhibit. The IKEv2 site-to-site VPN tunnel between two routers is down. Based on the debug output, which type of mismatch is the problem?

A. reshared key

B. eer identity

C. ransform set

D. kev2 proposal

عرض الإجابة

اجابة صحيحة: B

السؤال #11

Which remote access VPN technology requires the use of the IPsec-proposal configuration option?

A. clientless SSLVPN

B. SSLVPN Full Tunnel

C. IKEv2-based VPN

D. IKEv1-based VPN

عرض الإجابة

اجابة صحيحة: C

السؤال #12

Refer to the exhibit. An engineer is troubleshooting a new GRE over IPsec tunnel. The tunnel is established, but the engineer cannot ping from spoke 1 to spoke 2. Which type of traffic is being blocked?

A. ESP packets from spoke2 to spoke1

B. ISAKMP packets from spoke2 to spoke1

C. ESP packets from spoke1 to spoke2

D. ISAKMP packets from spoke1 to spoke2

عرض الإجابة

اجابة صحيحة: A

السؤال #13

Refer to the exhibit. A site-to-site tunnel between two sites is not coming up.Based on the debugs, what is the cause of this issue?

A. certificate fragmentation issue occurs between both sides

B. n authentication failure occurs on the remote peer

C. DP 4500 traffic from the peer does not reach the router

D. n authentication failure occurs on the router

عرض الإجابة

اجابة صحيحة: C

السؤال #14

Refer to the exhibit. Which two tunnel types produce the show crypto ipsec sa output seen in the exhibit? (Choose two.)

A. crypto map

B. DMVPN

C. GRE

D. FlexVPN

E. VTI

عرض الإجابة

اجابة صحيحة: BE

السؤال #15

Which requirement is needed to use local authentication for Cisco AnyConnect Secure Mobility Clients that connect to a FlexVPN server?

A. use of certificates instead of username and password

B. EAP-AnyConnect

C. EAP query-identity

D. AnyConnect profile

عرض الإجابة

اجابة صحيحة: D

السؤال #16

What are two functions of ECDH and ECDSA? (Choose two.)

A. onrepudiation

B. evocation

C. igital signature

D. ey exchange

E. ncryption

عرض الإجابة

اجابة صحيحة: CD

السؤال #17

Refer to the exhibit. A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which actionbrings up the VPN tunnel?

A. Reduce the maximum SA limit on the local Cisco ASA

B. Increase the maximum in-negotiation SA limit on the local Cisco ASA

C. Remove the maximum SA limit on the remote Cisco ASA

D. Correct the crypto access list on both Cisco ASA devices

عرض الإجابة

اجابة صحيحة: B

السؤال #18

Refer to the exhibit. An engineer is troubleshooting a new GRE over IPsec tunnel. The tunnel is established, but the engineer cannot ping from spoke 1 to spoke 2. Which type of traffic is being blocked?

A. ESP packets from spoke2 to spoke1

B. ISAKMP packets from spoke2 to spoke1

C. ESP packets from spoke1 to spoke2

D. ISAKMP packets from spoke1 to spoke2

عرض الإجابة

اجابة صحيحة: A

السؤال #19

Refer to the exhibit. Which VPN technology is allowed for users connecting to the Employee tunnel group?

A. SSL AnyConnect

B. IKEv2 AnyConnect

C. crypto map

D. clientless

عرض الإجابة

اجابة صحيحة: D

السؤال #20

Cisco AnyConnect Secure Mobility Client has been configured to use IKEv2 for one group of users andSSL for another group. When the administrator configures a new AnyConnect release on the CiscoASA, the IKEv2 users cannot download it automatically when they connect. What might be theproblem?

A. he XML profile is not configured correctly for the affected users

B. he new client image does not use the same major release as the current one

C. lient services are not enabled

D. lient software updates are not supported with IKEv2

عرض الإجابة

اجابة صحيحة: C

السؤال #21

An administrator is setting up AnyConnect for the first time for a few users. Currently, the router does not have access to a RADIUS server. Which AnyConnect protocol must be used to allow users to authenticate?

A. AP-GTC

B. AP-MSCHAPv2

C. AP-AnyConnect

D. AP-MD5

عرض الإجابة

اجابة صحيحة: C

السؤال #22

Which command is used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?

A. show crypto ikev2 sa

B. show crypto isakmp sa

C. show crypto gkm

D. show crypto identity

عرض الإجابة

اجابة صحيحة: A

السؤال #23

Which requirement is needed to use local authentication for Cisco AnyConnect Secure Mobility Clients that connect to a FlexVPN server?

A. use of certificates instead of username and password

B. EAP-AnyConnect

C. EAP query-identity

D. AnyConnect profile

عرض الإجابة

اجابة صحيحة: D

السؤال #24

An engineer is requesting an SSL certificate for a VPN load-balancing cluster in which two Cisco ASAs provide clientless SSLVPN access. The FQDN that users will enter to access the clientless VPN is asa.example.com, and users will be redirected to either asa1.example.com or asa2.example.com. The cluster FQDN and individual Cisco ASAs FQDNs resolve to IP addresses 192.168.0.1, 192.168.0.2, and 192.168.0.3 respectively. The issued certificate must be able to be used to validate the identity of either ASA in the cluster without returning any certificate validation errors. Which fields must be included in the certificate to meet these requirements?

A. CN=*

B. CN=192

C. CN=asa

D. CN=192

عرض الإجابة

اجابة صحيحة: C

السؤال #25

Refer to the exhibit. An engineer is troubleshooting a new GRE over IPsec tunnel. The tunnel is established, but the engineer cannot ping from spoke 1 to spoke 2. Which type of traffic is being blocked?

A. ESP packets from spoke2 to spoke1

B. ISAKMP packets from spoke2 to spoke1

C. ESP packets from spoke1 to spoke2

D. ISAKMP packets from spoke1 to spoke2

عرض الإجابة

اجابة صحيحة: A

السؤال #26

Which statement about GETVPN is true?

A. The configuration that defines which traffic to encrypt originates from the key server

B. TEK rekeys can be load-balanced between two key servers operating in COOP

C. The pseudotime that is used for replay checking is synchronized via NTP

D. Group members must acknowledge all KEK and TEK rekeys, regardless of configuration

عرض الإجابة

اجابة صحيحة: A

السؤال #27

An organization wants to implement a site-to-site VPN solution that must be able to support 350 sites with direct communications between all sites, fully encrypt the packet header and payload, and support propagation of routing information over IPsec. Which solution meets these requirements?

A. IPsec full mesh

B. DMVPN

C. GETVPN

D. FlexVPN

E. Reveal Answer

عرض الإجابة

اجابة صحيحة: D

السؤال #28

Which two changes must be made in order to migrate from DMVPN Phase 2 to Phase 3 when EIGRP is configured? (Choose two.)

A. Add NHRP shortcuts on the hub

B. Add NHRP redirects on the spoke

C. Disable EIGRP next-hop-self on the hub

D. Enable EIGRP next-hop-self on the hub

E. Add NHRP redirects on the hub

عرض الإجابة

اجابة صحيحة: CE

السؤال #29

Refer to the exhibit. An engineer is troubleshooting a new GRE over IPsec tunnel. The tunnel is established, but the engineer cannot ping from spoke 1 to spoke 2. Which type of traffic is being blocked?

A. ESP packets from spoke2 to spoke1

B. ISAKMP packets from spoke2 to spoke1

C. ESP packets from spoke1 to spoke2

D. ISAKMP packets from spoke1 to spoke2

عرض الإجابة

اجابة صحيحة: A

السؤال #30

Which configuration construct must be used in a FlexVPN tunnel?

A. AP configuration

B. ultipoint GRE tunnel interface

C. KEv1 policy

D. KEv2 profile

عرض الإجابة

اجابة صحيحة: D

السؤال #31

A Cisco AnyConnect client establishes a SSL VPN connection with an ASA at the corporate office. An engineer must ensure that the client computer meets the enterprise security policy. Which feature can update the client to meet an enterprise security policy?

A. Endpoint Assessment

B. Cisco Secure Desktop

C. Basic Host Scan

D. Advanced Endpoint Assessment

عرض الإجابة

اجابة صحيحة: D

السؤال #32

Which IKE identity does an IOS/IOS-XE headend expect to receive if an IPsec Cisco AnyConnect client uses default settings?

A. *$SecureMobilityClient$*

B. *$AnyConnectClient$*

C. *$RemoteAccessVpnClient$*

D. *$DfltlkeldentityS*

عرض الإجابة

اجابة صحيحة: B

السؤال #33

In order to enable FlexVPN to use a AAA attribute list, which two tasks must be performed? (Choose two.)

A. Define the RADIUS server

B. Verify that clients are using the correct authorization policy

C. Define the AAA server

D. Assign the list to an authorization policy

E. Set the maximum segment size

عرض الإجابة

اجابة صحيحة: BD

السؤال #34

A second set of traffic selectors is negotiated between two peers using IKEv2. Which IKEv2 packet will contain details of the exchange?

A. IKEv2 IKE_SA_INIT

B. IKEv2 INFORMATIONAL

C. IKEv2 CREATE_CHILD_SA

D. IKEv2 IKE_AUTH

عرض الإجابة

اجابة صحيحة: B

السؤال #35

A Cisco ASA is configured in active/standby mode. What is needed to ensure that Cisco AnyConnect users can connect after a failover event?

A. AAnyConnect images must be uploaded to both failover ASA devices

B. BThe vpnsession-db must be cleared manually

C. CConfigure a backup server in the XML profile

D. DAnyConnect client must point to the standby IP address

عرض الإجابة

اجابة صحيحة: A

السؤال #36

Refer to the exhibit. Which VPN technology is allowed for users connecting to the Employee tunnel group?

A. SSL AnyConnect

B. IKEv2 AnyConnect

C. crypto map

D. clientless

عرض الإجابة

اجابة صحيحة: D

السؤال #37

Refer to the exhibit. Which VPN technology is allowed for users connecting to the Employee tunnel group?

A. SSL AnyConnect

B. IKEv2 AnyConnect

C. crypto map

D. clientless

عرض الإجابة

اجابة صحيحة: D

السؤال #38

On a FlexVPN hub - and - spoke topology where spoke - to - spoke tunnels are not allowed, which command is needed for the hub to be able to terminate FlexVPN tunnels?

A. interface virtual - access

B. ip nhrp redirect

C. interface tunnel

D. interface virtual - template

عرض الإجابة

اجابة صحيحة: D

السؤال #39

Which statement about GETVPN is true?

A. he configuration that defines which traffic to encrypt originates from the key server

B. EK rekeys can be load-balanced between two key servers operating in COOP

C. he pseudotime that is used for replay checking is synchronized via NTP

D. roup members must acknowledge all KEK and TEK rekeys, regardless of configuration

عرض الإجابة

اجابة صحيحة: A

السؤال #40

Refer to the exhibit. Which VPN technology is allowed for users connecting to the Employee tunnel group?

A. SSL AnyConnect

B. IKEv2 AnyConnect

C. crypto map

D. clientless

عرض الإجابة

اجابة صحيحة: D

السؤال #41

Refer to the exhibit. The DMVPN tunnel is dropping randomly and no tunnel protection is configured.Which spoke configuration mitigates tunnel drops?

A.

B.

C.

D.

عرض الإجابة

اجابة صحيحة: D

السؤال #42

Which requirement is needed to use local authentication for Cisco AnyConnect Secure Mobility Clients that connect to a FlexVPN server?

A. use of certificates instead of username and password

B. EAP-AnyConnect

C. EAP query-identity

D. AnyConnect profile

عرض الإجابة

اجابة صحيحة: D

السؤال #43

Refer to the exhibit. The network security engineer identified that the hub router cannot send traffic to the spoke router. Based on the provided output, which action resolves the issue?

A. orrect the next hop server IP address on the spoke router

B. nsure the preshared key on the hub-and-spoke router matches

C. ermit UDP ports 500 and 4500 between the hub and spoke

D. djust the ip nhrp network-id command on the hub router

عرض الإجابة

اجابة صحيحة: A

السؤال #44

Refer to the exhibit. An engineer is troubleshooting a new GRE over IPsec tunnel. The tunnel is established, but the engineer cannot ping from spoke 1 to spoke 2. Which type of traffic is being blocked?

A. ESP packets from spoke2 to spoke1

B. ISAKMP packets from spoke2 to spoke1

C. ESP packets from spoke1 to spoke2

D. ISAKMP packets from spoke1 to spoke2

عرض الإجابة

اجابة صحيحة: A

السؤال #45

Refer to the exhibit. Which type of mismatch is causing the problem with the IPsec VPN tunnel?

A. rypto access list

B. hase 1 policy

C. ransform set

D. reshared key

عرض الإجابة

اجابة صحيحة: D

السؤال #46

Which command identifies a Cisco AnyConnect profile that was uploaded to the flash of an IOSrouter?

A. vc import profile SSL_profile flash:simos-profile

B. nyconnect profile SSL_profile flash:simos-profile

C. rypto vpn anyconnect profile SSL_profile flash:simos-profile

D. ebvpn import profile SSL_profile flash:simos-profile

عرض الإجابة

اجابة صحيحة: C

السؤال #47

Which two remote access VPN solutions support SSL? (Choose two.)

A. lexVPN

B. lientless

C. ZVPN

D. 2TP

E. isco AnyConnect

عرض الإجابة

اجابة صحيحة: BE

السؤال #48

Refer to the exhibit. Which VPN technology is allowed for users connecting to the Employee tunnel group?

A. SSL AnyConnect

B. IKEv2 AnyConnect

C. crypto map

D. clientless

عرض الإجابة

اجابة صحيحة: D

السؤال #49

An engineer is troubleshooting a new DMVPN setup on a Cisco IOS router. After the show crypto isakmp sa command is issued, a response is returned of"MM_NO_STATE." Why does this failure occur?

A. he ISAKMP policy priority values are invalid

B. SP traffic is being dropped

C. he Phase 1 policy does not match on both devices

D. unnel protection is not applied to the DMVPN tunnel

عرض الإجابة

اجابة صحيحة: C

السؤال #50

Which requirement is needed to use local authentication for Cisco AnyConnect Secure Mobility Clients that connect to a FlexVPN server?

A. use of certificates instead of username and password

B. EAP-AnyConnect

C. EAP query-identity

D. AnyConnect profile

عرض الإجابة

اجابة صحيحة: D

لا تريد أن تفوت شيئا؟

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع!
احصل الان

View The Updated 300-730 Exam Questions

عرض الإجابات بعد التقديم

لا تريد أن تفوت شيئا؟

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع! احصل الان

View The Updated 300-730 Exam Questions

عرض الإجابات بعد التقديم

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع!
احصل الان