Cisco CCNP Security 300-730 Questions & Answers

• Question 151:

  Refer to the exhibit.

  

  Which type of mismatch is causing the problem with the IPsec VPN tunnel?

  A. crypto access list

  B. Phase 1 policy

  C. transform set

  D. preshared key

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html#ike

• Question 152:

  Refer to the exhibit.

  

  The IKEv2 site-to-site VPN tunnel between two routers is down. Based on the debug output, which type of mismatch is the problem?

  A. preshared key

  B. peer identity

  C. transform set

  D. ikev2 proposal

  Correct Answer: B

• Question 153:

  Refer to the exhibit.

  

  The customer can establish a Cisco AnyConnect connection without using an XML profile. When the host "ikev2" is selected in the AnyConnect drop down, the connection fails. What is the cause of this issue?

  A. The HostName is incorrect.

  B. The IP address is incorrect.

  C. Primary protocol should be SSL.

  D. UserGroup must match connection profile.

  Correct Answer: D

  Reference: https://community.cisco.com/t5/security-documents/anyconnect-xml-settings/ta-p/3157891

• Question 154:

  Refer to the exhibit.

  

  A site-to-site tunnel between two sites is not coming up. Based on the debugs, what is the cause of this issue?

  A. An authentication failure occurs on the remote peer.

  B. A certificate fragmentation issue occurs between both sides.

  C. UDP 4500 traffic from the peer does not reach the router.

  D. An authentication failure occurs on the router.

  Correct Answer: C

• Question 155:

  Refer to the exhibit.

  

  Based on the debug output, which type of mismatch is preventing the VPN from coming up?

  A. interesting traffic

  B. lifetime

  C. preshared key

  D. PFS

  Correct Answer: A

  TS unacceptable:

  The IPsec SA setup has failed due to a mismatch in the policy rule definition between the gateways for the tunnel configuration.

  Check the local and remote network configuration on both gateways.

• Question 156:

  An engineer is troubleshooting a new DMVPN setup on a Cisco IOS router. After the show crypto isakmp sa command is issued, a response is returned of "MM_NO_STATE." Why does this failure occur?

  A. The ISAKMP policy priority values are invalid.

  B. ESP traffic is being dropped.

  C. The Phase 1 policy does not match on both devices.

  D. Tunnel protection is not applied to the DMVPN tunnel.

  Correct Answer: C

• Question 157:

  In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form. Which troubleshooting step solves the issue?

  A. Verify the spoke configuration to check if the NHRP redirect is enabled.

  B. Verify that the spoke receives redirect messages and sends resolution requests.

  C. Verify the hub configuration to check if the NHRP shortcut is enabled.

  D. Verify that the tunnel interface is contained within a VRF.

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-summ-maps.pdf

• Question 158:

  Which command is used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?

  A. show crypto ikev2 sa

  B. show crypto isakmp sa

  C. show crypto gkm

  D. show crypto identity

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/support/docs/security/flexvpn/116413-configure-flexvpn-00.pdf

• Question 159:

  Refer to the exhibit.

  

  Which VPN technology is allowed for users connecting to the Employee tunnel group?

  A. SSL AnyConnect

  B. IKEv2 AnyConnect

  C. crypto map

  D. clientless

  Correct Answer: D

  Since there is no vpn-tunnel-protocol defnied under the Employee tunnel-group this setting will be inherited from the DfltGrpPolicy And only ss-clientless is allowed in DfltGrpPolicy.

• Question 160:

  Refer to the exhibit.

  

  An engineer is troubleshooting a new GRE over IPsec tunnel. The tunnel is established but the engineer cannot ping from spoke 1 to spoke 2. Which type of traffic is being blocked?

  A. ESP packets from spoke2 to spoke1

  B. ISAKMP packets from spoke2 to spoke1

  C. ESP packets from spoke1 to spoke2

  D. ISAKMP packets from spoke1 to spoke2

  Correct Answer: A