Cisco CCNP Security 300-730 Questions & Answers

• Question 171:

  When deploying a site-to-site VPN, what must be used to minimize IP fragmentation?

  A. IKE version 1

  B. ISAKMP over UDP 500

  C. Dead Peer Detection

  D. Path MTU Discovery

  Correct Answer: D

• Question 172:

  Which two features provide headend resiliency for Cisco AnyConnect clients? (Choose two.)

  A. AnyConnect Auto Reconnect

  B. AnyConnect Network Access Manager

  C. AnyConnect Backup Servers

  D. ASA failover

  E. AnyConnect Always On

  Correct Answer: CD

• Question 173:

  A Cisco AnyConnect client establishes a SSL VPN connection with an ASA at the corporate office. An engineer must ensure that the client computer meets the enterprise security policy. Which feature can update the client to meet an enterprise security policy?

  A. Endpoint Assessment

  B. Cisco Secure Desktop

  C. Basic Host Scan

  D. Advanced Endpoint Assessment

  Correct Answer: D

  the keyword here (Which feature can update the client to meet an enterprise security policy)

• Question 174:

  Which configuration construct must be used in a FlexVPN tunnel?

  A. EAP configuration

  B. multipoint GRE tunnel interface

  C. IKEv1 policy

  D. IKEv2 profile

  Correct Answer: D

• Question 175:

  Which two types of web resources or protocols are enabled by default on the Cisco ASA Clientless SSL VPN portal? (Choose two.)

  A. HTTP

  B. ICA (Citrix)

  C. VNC

  D. RDP

  E. CIFS

  Correct Answer: AE

  "NOTE You will not see an option of RDP, VNC, SSH, and/or Telnet unless the appropriate client/server plug-in has been installed first. " Leaves only HTTP and CIFS as your options.

• Question 176:

  Refer to the exhibit.

  

  What is configured as a result of this command set?

  A. FlexVPN client profile for IPv6

  B. FlexVPN server to authorize groups by using an IPv6 external AAA

  C. FlexVPN server for an IPv6 dVTI session

  D. FlexVPN server to authenticate IPv6 peers by using EAP

  Correct Answer: C

  The configuration snippet is an identical match to the server configuration when you look it up. Not the client.

• Question 177:

  Which command identifies a Cisco AnyConnect profile that was uploaded to the flash of an IOS router?

  A. svc import profile SSL_profile flash:simos-profile.xml

  B. anyconnect profile SSL_profile flash:simos-profile.xml

  C. crypto vpn anyconnect profile SSL_profile flash:simos-profile.xml

  D. webvpn import profile SSL_profile flash:simos-profile.xml

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200533-AnyConnect-Configure-Basic-SSLVPN-for-I.html

• Question 178:

  Refer to the exhibit.

  

  Which value must be configured in the User Group field when the Cisco AnyConnect Profile is created to connect to an ASA headend with IPsec as the primary protocol?

  A. address-pool

  B. group-alias

  C. group-policy

  D. tunnel-group

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect41/administration/guide/b_AnyConnect_Administrator_Guide_4-1/configure-vpn.html

• Question 179:

  Which method dynamically installs the network routes for remote tunnel endpoints?

  A. policy-based routing

  B. CEF

  C. reverse route injection

  D. route filtering

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnav/configuration/12-4t/sec-vpn-availability-12-4t-book/sec-rev-rte-inject.html

• Question 180:

  Refer to the exhibit.

  

  A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which action brings up the VPN tunnel?

  A. Reduce the maximum SA limit on the local Cisco ASA.

  B. Increase the maximum in-negotiation SA limit on the local Cisco ASA.

  C. Remove the maximum SA limit on the remote Cisco ASA.

  D. Correct the crypto access list on both Cisco ASA devices.

  Correct Answer: B