Cisco CCNP Security 300-730 Questions & Answers

• Question 111:

  Refer to the exhibit.

  

  Based on the configuration output, what is the VPN technology?

  A. site-to-site

  B. DMVPN

  C. L2VPN

  D. multicast VPN

  Correct Answer: C

• Question 112:

  A user at a company HQ is having trouble accessing a network share at a branch site that is connected with a L2L IPsec VPN. While troubleshooting, a network security engineer runs a packet tracer on the Cisco ASA to simulate the user

  traffic and discovers that the encryption counter is increasing but the decryption counter is not. What must be configured to correct this issue?

  A. Adjust the routing on the remote peer device to direct traffic back over the tunnel.

  B. Adjust the preshared key on the remote peer to allow traffic to flow over the tunnel.

  C. Adjust the transform set to allow bidirectional traffic.

  D. Adjust the peer IP address on the remote peer to direct traffic back to the ASA.

  Correct Answer: A

• Question 113:

  A user is experiencing delays on audio calls over a Cisco AnyConnect VPN. Which implementation step resolves this issue?

  A. Change to 3DES Encryption.

  B. Shorten the encryption key lifetime.

  C. Install the Cisco AnyConnect 2.3 client for the user to download.

  D. Enable DTLS.

  Correct Answer: D

• Question 114:

  Users cannot log in to a Cisco ASA using clientless SSLVPN. Troubleshooting reveals the error message "WebVPN session terminated: Client type not supported". Which step does the administrator take to resolve this issue?

  A. Enable the Cisco AnyConnect premium license on the Cisco ASA.

  B. Have the user upgrade to a supported browser.

  C. Increase the simultaneous logins on the group policy.

  D. Enable the clientless VPN protocol on the group policy.

  Correct Answer: D

• Question 115:

  Refer to the exhibit.

  

  An engineer must allow Cisco AnyConnect users to access the outside interface using protocol UDP 500/4500. In addition, these clients must be able to establish an SSL connection to update Cisco AnyConnect software over the same connection. Which two actions must be taken to achieve this goal? (Choose two.)

  A. IPsec (IKEv2) Allow Access must be checked on the outside interface.

  B. SSL Enable DTLS must be checked on the outside interface.

  C. Bypass interface access lists for inbound VPN sessions must be unchecked.

  D. IPsec (IKEv2) Enable Client Services must be checked on the outside interface.

  E. SSL Allow Access must be checked on the outside interface.

  Correct Answer: AD

• Question 116:

  Refer to the exhibit.

  

  An IPsec Cisco AnyConnect client is failing to connect and generates these debugs every time a connection to an IOS headend is attempted. Which action resolves this issue?

  A. Correct the DH group setting.

  B. Correct the PFS setting.

  C. Correct the integrity setting.

  D. Correct the encryption setting.

  Correct Answer: A

• Question 117:

  A network engineer has set up a FlexVPN server to terminate multiple FlexVPN clients. The VPN tunnels are established without issue. However, when a Change of Authorization is issued by the RADIUS server, the FlexVPN server does not update the authorization of connected FlexVPN clients. Which action resolves this issue?

  A. Add the aaa server radius dynamic-author command on the FlexVPN clients.

  B. Fix the RADIUS key mismatch between the RADIUS server and FlexVPN server.

  C. Add the aaa server radius dynamic-author command on the FlexVPN server.

  D. Fix the RADIUS key mismatch between the RADIUS server and FlexVPN clients.

  Correct Answer: C

• Question 118:

  A company needs to ensure only corporate issued laptops and devices are allowed to connect with the Cisco AnyConnect client. The solution should be applicable to multiple operating systems, including Windows, MacOS, and Linux, and should allow for remote remediation if a corporate issued device is stolen. Which solution should be used to accomplish these goals?

  A. Use a DAP registry check on the system to determine the relationship with the corporate domain.

  B. Use a DAP file check on the system to determine the relationship with the corporate domain.

  C. Install and authenticate user certificates on the corporate devices.

  D. Install and authenticate machine certificates on the corporate devices

  Correct Answer: A

• Question 119:

  When a FlexVPN is configured, which two components must be configured for IKEv2? (Choose two.)

  A. method

  B. profile

  C. proposal

  D. preference

  E. persistence

  Correct Answer: BC

• Question 120:

  A DMVPN spoke router tunnel is up and passing traffic, but it cannot establish an EIGRP neighbor relationship with the hub router. Which solution resolves this issue?

  A. Enable EIGRP Split Horizon on the hub tunnel interface.

  B. Remove the EIGRP stub configuration on the spoke tunnel interface.

  C. Enable the EIGRP next hop self feature on the hub tunnel interface.

  D. Configure the dynamic NHRP multicast map on the hub tunnel interface.

  Correct Answer: D