Cisco CCNP Security 300-730 Questions & Answers

• Question 51:

  A network engineer must design a remote access solution to allow contractors to access internal servers. These contractors do not have permissions to install applications on their computers. Which VPN solution should be used in this design?

  A. IKEv2 AnyConnect

  B. Clientless

  C. Port forwarding

  D. SSL AnyConnect

  Correct Answer: B

• Question 52:

  An engineer has integrated a new DMVPN to link remote offices across the internet using Cisco IOS routers. When connecting to remote sites, pings and voice data appear to flow properly, and all tunnel stats show that they are up. However, when trying to connect to a remote server using RDP, the connection fails. Which action resolves this issue?

  A. Adjust the MTU size within the routers.

  B. Add RDP port to the extended ACL.

  C. Replace certificate on the RDP server.

  D. Change DMVPN timeout values.

  Correct Answer: A

• Question 53:

  Where must an engineer configure a preshared key for a site-to-site VPN tunnel configured on a Cisco ASA?

  A. isakmp policy

  B. group policy

  C. crypto map

  D. tunnel group

  Correct Answer: D

• Question 54:

  A network engineer has been tasked with configuring SSL VPN to provide remote users with access to the corporate network. Traffic destined to the enterprise IP range should go through the tunnel, and all other traffic should go directly to the Internet. Which feature should be configured to achieve this?

  A. U-turning

  B. hairpinning

  C. split-tunnel

  D. dual-homing

  Correct Answer: C

• Question 55:

  An engineer is configuring clientless SSL VPN. The finance department has a database server that only they should access, but the sales department can currently access it. The finance and the sales departments are configured as separate group-policies. What must be added to the configuration to make sure the users in the sales department cannot access the finance department server?

  A. tunnel group lock

  B. smart tunnel

  C. port forwarding

  D. webtype ACL

  Correct Answer: A

  Reference https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/acl-webtype.pdf

• Question 56:

  An organization wants to implement a site-to-site VPN solution that must be able to support 350 sites with direct communications between all sites, fully encrypt the packet header and payload, and support propagation of routing information over IPsec. Which solution meets these requirements?

  A. IPsec full mesh

  B. DMVPN

  C. GETVPN

  D. FlexVPN

  Correct Answer: D

• Question 57:

  Refer to the exhibit.

  

  Which type of VPN tunnel is configured?

  A. Multipoint GRE

  B. DMVPN

  C. FlexVPN

  D. GRE over IPsec

  Correct Answer: D

• Question 58:

  Which configuration allows a Cisco ASA to receive an IPsec connection from a peer with an unknown IP address?

  A. dynamic crypto map

  B. dynamic tunnel group

  C. dynamic AAA attributes

  D. dynamic access policy

  Correct Answer: A

• Question 59:

  Which command must be configured on the tunnel interface of a FlexVPN spoke to receive a dynamic IP address from the hub?

  A. ip address negotiated

  B. ip unnumbered

  C. ip address dhcp

  D. ip address pool

  Correct Answer: B

• Question 60:

  Two Cisco ASAs are set up in a VPN load-balancing configuration in an environment where there are thousands of unique Cisco AnyConnect connections per day. Which scalable IP address assignment method must be implemented on both ASAs to achieve minimal overlap when assigning IP addresses from the same subnet to AnyConnect clients?

  A. DHCP

  B. local

  C. RADIUS framed IP address

  D. RADIUS address pools

  Correct Answer: A