Cisco CCNP Security 300-730 Questions & Answers

• Question 31:

  Refer to the exhibit.

  

  A user is connecting from behind a PC with a private IP Address. Their ISP provider is blocking TCP port 443. Which AnyConnect XML configuration will allow the user to establish a connection with the ASA?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: D

• Question 32:

  Which VPN technology must be used to ensure that routers are able to dynamically form connections with each other rather than sending traffic through a hub and be able to advertise routes without the use of a dynamic routing protocol?

  A. FlexVPN

  B. DMVPN Phase 3

  C. DMVPN Phase 2

  D. GETVPN

  Correct Answer: A

• Question 33:

  An administrator is setting up AnyConnect for the first time for a few users. Currently, the router does not have access to a RADIUS server. Which AnyConnect protocol must be used to allow users to authenticate?

  A. EAP-GTC

  B. EAP-MSCHAPv2

  C. EAP-MD5

  D. EAP-AnyConnect

  Correct Answer: D

• Question 34:

  Refer to the exhibit.

  

  DMVPN spoke-to-spoke traffic works, but it passes through the hub, and never sends direct spoke-to-spoke traffic. Based on the tunnel interface configuration shown, what must be configured on the hub to solve the issue?

  A. Enable NHRP redirect.

  B. Enable split horizon.

  C. Enable IP redirects.

  D. Enable NHRP shortcut.

  Correct Answer: A

• Question 35:

  A company's remote locations connect to the data centers via MPLS. A new request requires that unicast and multicast traffic that exits in the remote locations be encrypted. Which non-tunneled technology should be used to satisfy this requirement?

  A. SSL

  B. FlexVPN

  C. DMVPN

  D. GETVPN

  Correct Answer: D

• Question 36:

  While troubleshooting, an engineer finds that the show crypto isakmp sa command indicates that the last state of the tunnel is MM_KEY_EXCH. What is the next step that should be taken to resolve this issue?

  A. Verify that the ISAKMP proposals match.

  B. Ensure that UDP 500 is not being blocked between the devices.

  C. Correct the peer's IP address on the crypto map.

  D. Confirm that the pre-shared keys match on both devices.

  Correct Answer: C

• Question 37:

  Refer to the exhibit.

  

  Which type of VPN is being configured, based on the partial configuration snippet?

  A. GET VPN with COOP key server

  B. GET VPN with dual group member

  C. FlexVPN load balancer

  D. FlexVPN backup gateway

  Correct Answer: A

• Question 38:

  An administrator is designing a VPN with a partner's non-Cisco VPN solution. The partner's VPN device will negotiate an IKEv2 tunnel that will only encrypt subnets 192.168.0.0/24 going to 10.0.0.0/24. Which technology must be used to meet these requirements?

  A. VTI

  B. crypto map

  C. GETVPN

  D. DMVPN

  Correct Answer: B

• Question 39:

  After a user configures a connection profile with a bookmark list and tests the clientless SSLVPN connection, all of the bookmarks are grayed out. What must be done to correct this behavior?

  A. Apply the bookmark to the correct group policy.

  B. Specify the correct port for the web server under the bookmark.

  C. Configure a DNS server on the Cisco ASA and verify it has a record for the web server.

  D. Verify HTTP/HTTPS connectivity between the Cisco ASA and the web server.

  Correct Answer: C

• Question 40:

  Refer to the exhibit.

  

  Upon setting up a tunnel between two sites, users are complaining that connections to applications over the VPN are not working consistently. The output of show crypto ipsec sa was collected on one of the VPN devices. Based on this output, what should be done to fix this issue?

  A. Lower the tunnel MTU.

  B. Enable perfect forward secrecy.

  C. Specify the application networks in the remote identity.

  D. Make an adjustment to IPSec replay window.

  Correct Answer: D