Cisco CCNP Security 300-730 Questions & Answers

• Question 101:

  What must be configured in a FlexVPN deployment to allow for direct communication between spokes connected to different hubs?

  A. EIGRP must be used as routing protocol.

  B. Hub routers must be on same Layer 2 network.

  C. Load balancing must be disabled.

  D. A GRE tunnel must exist between hub routers.

  Correct Answer: D

• Question 102:

  A network engineer is installing Cisco AnyConnect on company laptops so that users can access corporate resources remotely. The VPN concentrator is a Cisco router running IOS-XE 16.9.1 code and configured as a FlexVPN server that uses local authentication and *$Cisc431089017$* as the key-id for the IKEv2 profile. Which two steps must be taken on the computer to allow a successful AnyConnect connection to the router? (Choose two.)

  A. In the Cisco AnyConnect XML profile, set the IPsec Authentication method to EAP-AnyConnect.

  B. In the Cisco AnyConnect XML profile, add the hostname and host address to the server list.

  C. In the Cisco AnyConnect XML profile, set the user group field to DefaultAnyConnectClientGroup.

  D. In the Cisco AnyConnect Local Policy, set the BypassDownloader option in the local to true.

  E. In the Cisco AnyConnect Local Policy, add the router IP address to the Update Policy.

  Correct Answer: AD

• Question 103:

  An administrator must guarantee that remote access users are able to reach printers on their local LAN after a VPN session is established to the headquarters. All other traffic should be sent over the tunnel. Which split-tunnel policy reduces the configuration on the ASA headend?

  A. include specified

  B. exclude specified

  C. tunnel specified

  D. dynamic exclude

  Correct Answer: B

• Question 104:

  Refer to the exhibit.

  

  Given the output of the show ip route command, which remote access VPN technology is in use?

  A. Reverse Route Injection

  B. FlexVPN

  C. Dynamic Crypto Map

  D. DMVPN

  Correct Answer: B

• Question 105:

  What is a characteristic of GETVPN?

  A. An ACL that defines interesting traffic must be configured and applied to the crypto map.

  B. Quick mode is used to create an IPsec SA.

  C. The remote peer for the IPsec session is configured as part of the crypto map.

  D. All peers have one IPsec SPI for inbound and outbound communication.

  Correct Answer: D

• Question 106:

  Refer to the exhibit.

  

  Users cannot connect via AnyConnect SSLVPN. Which action resolves this issue?

  A. Configure the ASA to act as a DHCP server.

  B. Configure the HTTP server to listen on port 443.

  C. Add an IPsec preshared key to the group policy.

  D. Add ssl-client to the allowed list of VPN protocols.

  Correct Answer: D

• Question 107:

  An administrator is setting up a VPN on an ASA for users who need to access an internal RDP server. Due to security restrictions, the Microsoft RDP client is blocked from running on client workstations via Group Policy. Which VPN feature should be implemented by the administrator to allow these users to have access to the RDP server?

  A. clientless proxy

  B. smart tunnelcing

  C. clientless plug-in

  D. clientless rewriter

  Correct Answer: C

• Question 108:

  An administrator is planning a VPN configuration that will encrypt traffic between multiple servers that will be passing unicast and multicast traffic. This configuration must be able to be implemented without the need to modify routing within the network. Which VPN technology must be used for this task?

  A. FlexVPN

  B. VTI

  C. GETVPN

  D. DMVPN

  Correct Answer: C

• Question 109:

  Refer to the exhibit.

  

  VPN tunnels between a spoke and two DMVPN hubs are not coming up. The network administrator has verified that the encryption, hashing, and DH group proposals for Phase 1 and Phase 2 match on both ends. What is the solution to this issue?

  A. Ensure bidirectional UDP 500/4500 traffic.

  B. Increase the isakmp phase 1 lifetime.

  C. Add NAT statements for VPN traffic.

  D. Enable shared tunnel protection.

  Correct Answer: A

• Question 110:

  A network engineer is configuring a server. The router will terminate encrypted VPN connections on g0/0, which is in the VRF "Internet". The clear-text traffic that must be encrypted before being sent out traverses g0/1, which is in the VRF "Internal". Which two VRF-specific configurations allow VPN traffic to traverse the VRF-aware interfaces? (Choose two.)

  A. Under the IKEv2 profile, add the ivrf Internal command.

  B. Under the virtual-template interface, add the ip vrf forwarding Internet command.

  C. Under the IKEv2 profile, add the match fvrf Internal command.

  D. Under the IKEv2 profile, add the match fvrf Internet command.

  E. Under the virtual-template interface, add the tunnel vrf Internet command.

  Correct Answer: DE