Cisco CCNP Security 300-730 Questions & Answers

• Question 91:

  Which feature allows a DMVPN Phase 3 spoke to switch to an alternate hub when the primary hub is unreachable?

  A. multicast PIM

  B. backup NHS

  C. per-tunnel jitter probes

  D. NHRP shortcut

  Correct Answer: B

• Question 92:

  An engineer is using DMVPN to provide secure connectivity between a data center and remote sites. Which two routing protocols should be used between the routers? (Choose two.)

  A. IS-IS

  B. BGP

  C. RIPv2

  D. OSPF

  E. EIGRP

  Correct Answer: BE

• Question 93:

  A user is trying to log in to a Cisco ASA using the clientless SSLVPN feature and receives the error message "clientless (browser) SSLVPN access is not allowed". Which step should the Cisco ASA administrator take to resolve this issue?

  A. Enable the clientless VPN protocol on the group policy.

  B. Validate that the correct license is in use on the ASA for WebVPN.

  C. Increase the number of simultaneous logins allowed on the group policy.

  D. Verify that a user account exists in the local AAA database for the user.

  Correct Answer: B

• Question 94:

  Refer to the exhibit.

  

  A Cisco ASA is configured as a client to a router running as a FlexVPN server. The router is configured with a virtual template to terminate FlexVPN clients. Traffic between networks 192.168.0.0/24 and 172.16.20.0/24 does not work as expected. Based on the show crypto ikev2 sa output collected from the Cisco ASA in the exhibit, what is the solution to this issue?

  A. Modify the crypto ACL on the router to permit network 192.168.0.0/24 to network 172.16.20.0/24.

  B. Modify the crypto ACL on the ASA to permit network 192.168.0.0/24 to network 172.16.20.0/24.

  C. Modify the crypto ACL on the ASA to permit network 172.16.20.0/24 to network 192.168.0.0/24.

  D. Modify the crypto ACL on the router to permit network 172.16.20.0/24 to network 192.168.0.0/24.

  Correct Answer: B

• Question 95:

  Refer to the exhibit.

  

  An engineer is building an IKEv1 tunnel to a peer Cisco ASA, but the tunnel is failing. Based on the configuration in the exhibit, which action must be taken to allow the VPN tunnel to come up?

  A. Add a route for the 10.7.7.0/24 network to egress the outside interface.

  B. Enable IKEv1 on the outside interface.

  C. Change the IKEv1 policy number to be at least 256.

  D. Change the transform set mode to transport.

  Correct Answer: B

• Question 96:

  An engineer has successfully established a Phase 1 and Phase 2 tunnel between two sites. Site A has internal subnet 192.168.0.0/24 and Site B has internal subnet 10.0.0.0/24. The engineer notices that no packets are decrypted at Site B. Pings to 192.168.0.1 from internal Site B devices make it to the Site B router, and the Site A router has incrementing encrypt and decrypt counters. What must be done to ensure bidirectional communication between both sites?

  A. Modify the routing at Site B so that traffic is sent to Site A.

  B. Configure the correct DH group on both devices.

  C. Allow protocol ESP or AH on the firewall in front of the Site B router.

  D. Enable PFS on the headend device.

  Correct Answer: C

• Question 97:

  Which DMVPN feature allows spokes to be deployed with dynamically assigned public IP addresses?

  A. 2547oDMVPN

  B. NHRP

  C. OSPF

  D. NAT Traversal

  Correct Answer: B

• Question 98:

  Refer to the exhibit.

  

  An engineer has configured a spoke to connect to a FlexVPN hub. The tunnel is up, but pings fail when the engineer attempts to reach host 192.168.200.10 behind the spoke, and traffic is sourced from host 192.168.100.3, which is behind the FlexVPN server. Based on packet captures, the engineer discovers that host 192.168.200.10 receives the icmp echo and sends an icmp reply that makes it to the inside interface of the spoke. Based on the output in the exhibit captured on the spoke by the engineer, which action resolves this issue?

  A. Add the aaa authorization group cert list default default command to the spoke ikev2 profile.

  B. Add the route set remote ipv4 192.168.200.0 255.255.255.0 command to the hub authorization policy.

  C. Add the aaa authorization group cert list default default command to the hub ikev2 profile.

  D. Add the route set remote ipv4 192.168.100.0 255.255.255.0 command to the spoke authorization policy.

  Correct Answer: D

• Question 99:

  A network engineer is setting up Cisco AnyConnect 4.9 on a Cisco ASA running ASA software 9.1. Cisco AnyConnect must connect to the Cisco ASA before the user logs on so that login scripts can work successfully. In addition, the VPN must connect without user intervention. Which two key steps accomplish this task? (Choose two.)

  A. Create a Network Access Manager profile with a client policy set to connect before user logon.

  B. Create a Cisco AnyConnect VPN profile with Start Before Logon set to true.

  C. Issue an identity certificate to the trusted root CA folder in the machine store.

  D. Create a Cisco AnyConnect VPN profile with Always On set to true.

  E. Create a Cisco Anyconnect VPN Management Tunnel profile.

  Correct Answer: BC

• Question 100:

  A network engineer has almost finished setting up a clientless VPN that allows remote users to access internal HTTP servers. Users must enter their username and password twice: once on the clientless VPN web portal and again to log in to internal HTTP servers. The Cisco ASA and the HTTP servers use the same Active Directory server to authenticate users. Which next step must be taken to allow users to enter their password only once?

  A. Use LDAPS and add password management to the clientless tunnel group.

  B. Configure auto-sign-on using NTLM authentication.

  C. Set up the Cisco ASA to authenticate users via a SAML 2.0 IDP.

  D. Create smart tunnels for the HTTP servers.

  Correct Answer: B