Cisco CCNP Security 300-730 Questions & Answers

• Question 141:

  Refer to the exhibit.

  

  All internal clients behind the ASA are port address translated to the public outside interface that has an IP address of 3.3.3.3. Client 1 and client 2 have established successful SSL VPN connections to the ASA. What must be implemented so that "3.3.3.3" is returned from a browser search on the IP address?

  A. Same-security-traffic permit inter-interface under Group Policy

  B. Exclude Network List Below under Group Policy

  C. Tunnel All Networks under Group Policy

  D. Tunnel Network List Below under Group Policy

  Correct Answer: C

  The browser's ip is the ASA's public ip 3.3.3.3. This means the traffic is initiated from ASA. So the vpn client should tunnel all traffic to ASA.

• Question 142:

  Which VPN solution uses TBAR?

  A. GETVPN

  B. VTI

  C. DMVPN

  D. Cisco AnyConnect

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_getvpn/configuration/xe-3s/sec-get-vpn-xe-3s-book/sec-get-vpn.html

• Question 143:

  What are two functions of ECDH and ECDSA? (Choose two.)

  A. nonrepudiation

  B. revocation

  C. digital signature

  D. key exchange

  E. encryption

  Correct Answer: CD

  Reference: https://tools.cisco.com/security/center/resources/next_generation_cryptography

• Question 144:

  What uses an Elliptic Curve key exchange algorithm?

  A. ECDSA

  B. ECDHE

  C. AES-GCM

  D. SHA

  Correct Answer: B

  Reference: https://blog.cloudflare.com/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/

• Question 145:

  Which two remote access VPN solutions support SSL? (Choose two.)

  A. FlexVPN

  B. clientless

  C. EZVPN

  D. L2TP

  E. Cisco AnyConnect

  Correct Answer: BE

• Question 146:

  Which technology works with IPsec stateful failover?

  A. GLBR

  B. HSRP

  C. GRE

  D. VRRP

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/td/docs/ios/12_2/12_2y/12_2yx11/feature/guide/ft_vpnha.html#wp1122512

• Question 147:

  Refer to the exhibit.

  

  

  An SSL client is connecting to an ASA headend. The session fails with the message "Connection attempt has timed out. Please verify Internet connectivity." Based on how the packet is processed, which phase is causing the failure?

  A. phase 9: rpf-check

  B. phase 5: NAT

  C. phase 4: ACCESS-LIST

  D. phase 3: UN-NAT

  Correct Answer: D

• Question 148:

  Which redundancy protocol must be implemented for IPsec stateless failover to work?

  A. SSO

  B. GLBP

  C. HSRP

  D. VRRP

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/17826-ipsec-feat.html

• Question 149:

  Refer to the exhibit.

  

  What is a result of this configuration?

  A. Spoke 1 fails the authentication because the authentication methods are incorrect.

  B. Spoke 2 passes the authentication to the hub and successfully proceeds to phase 2.

  C. Spoke 2 fails the authentication because the remote authentication method is incorrect.

  D. Spoke 1 passes the authentication to the hub and successfully proceeds to phase 2.

  Correct Answer: A

• Question 150:

  Refer to the exhibit.

  

  Client 1 cannot communicate with client 2. Both clients are using Cisco AnyConnect and have established a successful SSL VPN connection to the hub ASA. Which command on the ASA is missing?

  A. dns-server value 10.1.1.2

  B. same-security-traffic permit intra-interface

  C. same-security-traffic permit inter-interface

  D. dns-server value 10.1.1.3

  Correct Answer: B