Cisco CCNP Security 300-730 Questions & Answers

• Question 161:

  Which IKE identity does an IOS/IOS-XE headend expect to receive if an IPsec Cisco AnyConnect client uses default settings?

  A. *$SecureMobilityClient$*

  B. *$AnyConnectClient$*

  C. *$RemoteAccessVpnClient$*

  D. *$DfltlkeldentityS*

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2-Remote-Access.html

• Question 162:

  Refer to the exhibit.

  

  Which two commands under the tunnel-group webvpn-attributes result in a Cisco AnyConnect user receiving the AnyConnect prompt in the exhibit? (Choose two.)

  A. group-url https://172.16.31.10/General enable

  B. group-policy General internal

  C. authentication aaa

  D. authentication certificate

  E. group-alias General enable

  Correct Answer: CE

• Question 163:

  Which requirement is needed to use local authentication for Cisco AnyConnect Secure Mobility Clients that connect to a FlexVPN server?

  A. use of certificates instead of username and password

  B. EAP-AnyConnect

  C. EAP query-identity

  D. AnyConnect profile

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2-Remote-Access.html

• Question 164:

  Which two statements about the Cisco ASA Clientless SSL VPN solution are true? (Choose two.)

  A. When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the client uses the local DNS to perform FQDN resolution.

  B. The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default.

  C. A Cisco ASA can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions.

  D. When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the ASA uses its configured DNS servers to perform FQDN resolution.

  E. Clientless SSLVPN provides Layer 3 connectivity into the secured network.

  Correct Answer: CD

• Question 165:

  Which feature allows the ASA to handle nonstandard applications and web resources so that they display correctly over a clientless SSL VPN connection?

  A. single sign-on

  B. Smart Tunnel

  C. WebType ACL

  D. plug-ins

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/vpn_clientless_ssl.html#29951

• Question 166:

  Which command automatically initiates a smart tunnel when a user logs in to the WebVPN portal page?

  A. auto-upgrade

  B. auto-connect

  C. auto-start

  D. auto-run

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/vpn/asa_91_vpn_config/webvpn-configure-policy-group.html

• Question 167:

  Refer to the exhibit.

  

  The customer must launch Cisco AnyConnect in the RDP machine. Which IOS configuration accomplishes this task?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: C

  Reference: https://community.cisco.com/t5/vpn/starting-anyconnect-vpn-through-rdp-session-on-cisco-891/td-p/2128284

• Question 168:

  Cisco AnyConnect Secure Mobility Client has been configured to use IKEv2 for one group of users and SSL for another group.

  When the administrator configures a new AnyConnect release on the Cisco ASA, the IKEv2 users cannot download it automatically when they connect. What might be the problem?

  A. The XML profile is not configured correctly for the affected users.

  B. The new client image does not use the same major release as the current one.

  C. Client services are not enabled.

  D. Client software updates are not supported with IKEv2.

  Correct Answer: C

  On ASDM, under connection profile -> access interfaces -> IPSEC (IKEv2) Access : you can check or uncheck the boxes for "allow access" and "enable client access"

• Question 169:

  Under which section must a bookmark or URL list be configured on a Cisco ASA to be available for clientless SSLVPN users?

  A. tunnel-group (general-attributes)

  B. tunnel-group (webvpn-attributes)

  C. webvpn (group-policy)

  D. webvpn (global configuration)

  Correct Answer: C

  The bookmark is applied under the web vpn subconfiguration mode of the group policy.

• Question 170:

  Refer to the exhibit.

  

  Based on the exhibit, why are users unable to access CCNP Webserver bookmark?

  A. The URL is being blocked by a WebACL.

  B. The ASA cannot resolve the URL.

  C. The bookmark has been disabled.

  D. The user cannot access the URL.

  Correct Answer: B

  B: If no DNS server is configured on the Cisco ASA or DNS resolution fails, the bookmark will be greyed out for the user.