300-730 practice questions 1–10

1. Question 1 · 189 in bank

   DRAG DROP - Drag and drop the correct commands from the right onto the blanks within the code on the left to implement a design that allow for dynamic spoke-to-spoke communication. Not all commands are used. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/xe-16/sec-conn-dmvpn-xe-16-book/sec-conn-dmvpn-summ- maps.html

   References

   • Cisco documentation

   

   Next question

2. Question 2 · 189 in bank

   Which method dynamically installs the network routes for remote tunnel endpoints?

   • Apolicy-based routing
   • BCEF
   • Creverse route injection
   • Droute filtering

   Show answer

   Answer: C

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnav/configuration/12-4t/sec-vpn-availability-12-4t-book/sec-rev-rte-inject.html

   Source: Adapted from community discussion — Net4dd

   Next question

3. Question 3 · 189 in bank

   Refer to the exhibit.

   

   A TCP based application that should be accessible over the VPN tunnel is not working. Pings to the appropriate IP address are failing. Based on the output, what is a fix for this issue?

   • AAdd a route on the remote peer for 209.165.201.0/27.
   • BAdd a route on the local peer for 10.1.1.0/24.
   • CAdd a permit for TCP traffic going to 10.1.1.0/24.
   • DAdd a permit for TCP traffic going to 209.165.201.0/27.

   Show answer

   Answer: A

   Explanation

   If nothing is received from remote end (=decaps: 0) then it needs to be fixed on that end. Most of the cases it is either routing or NAT.

   Source: Adapted from community discussion — spambox730

   Next question

4. Question 4 · 189 in bank

   A network engineer must expand a company's Cisco AnyConnect solution. Currently, a Cisco ASA is set up in North America and another will be installed in Europe with a different IP address. Users should connect to the ASA that has the lowest Round Trip Time from their network location as measured by the AnyConnect client. Which solution must be implemented to meet this requirement?

   • AVPN Load Balancing
   • BIP SLA
   • CDNS Load Balancing
   • DOptimal Gateway Selection

   Show answer

   Answer: D

   Next question

5. Question 5 · 189 in bank

   Which clientless SSLVPN supported feature works when the http-only-cookie command is enabled?

   • ACitrix load balancer
   • Bport reflector
   • CJava rewriter - C. Java plug-ins
   • Dscript browser

   Show answer

   Answer: D

   References

   • Cisco documentation

   Next question

6. Question 6 · 189 in bank

   

   Refer to the exhibit. An engineer is diagnosing an issue that occurred after a router at a branch site was assigned a new address. Based on the debugs, what must be done to resolve this issue?

   • AAdd the remote peer’s IP address to the server's IKEv2 keyring.
   • BEnsure that the correct preshared keys are set on both sides.
   • CEnsure that the UDP 500 packets between devices are not dropped.
   • DAdd the remote peer’s identity to the server’s IKEv2 profile.

   Show answer

   Answer: D

   Explanation

   D is correct. I tested it in the lab: crypto ikev2 profile Remote-Profile ! Profile incomplete (no match identity or match certificate statement)

   Source: Adapted from community discussion — Net4dd

   Next question

7. Question 7 · 189 in bank

   Select 2

   A network engineer is setting up a clientless SSLVPN on a Cisco ASA. Remote users must be able to access an internal webserver via the URL example.com. Which two steps accomplish this task? (Choose two.)

   • AConfigure a bookmark for the webserver.
   • BConfigure routing so that the user's computer can reach the webserver.
   • CConfigure a DNS server that can resolve the webserver URL.
   • DConfigure a browser plugin on the Cisco ASA.
   • EConfigure routing so that the Cisco ASA can reach the webserver.

   Show answer

   Answer: CE

   Explanation

   The answer is "A and C". To enable remote users to access an internal web server via the URL example.com using clientless SSL VPN on a Cisco ASA, the correct steps are: Configure a bookmark for the web server: This step involves creating a bookmark entry for the internal web server (example.com) on the Cisco ASA. The bookmark provides a convenient link for users to access the specified web resource. Configure a DNS server that can resolve the web server URL: For clientless SSL VPN to work, the ASA needs to be able to resolve the internal web server's URL (example.com) to its corresponding IP address. Ensure that the ASA has access to a DNS server that can resolve the DNS queries for the specified URL. So, the correct steps are to configure a bookmark for the web server and configure a DNS server that can resolve the web server URL. This ensures that users can access the internal web server via the specified URL, and the DNS resolution is in place to translate the URL to the corresponding IP address.

   Source: Adapted from community discussion — kylesam2017

   References

   • Cisco documentation

   Next question

8. Question 8 · 189 in bank

   A network engineer has set up a FlexVPN server to terminate multiple FlexVPN clients. The VPN tunnels are established without issue. However, when a Change of Authorization is issued by the RADIUS server, the FlexVPN server does not update the authorization of connected FlexVPN clients. Which action resolves this issue?

   • AAdd the aaa server radius dynamic-author command on the FlexVPN clients.
   • BFix the RADIUS key mismatch between the RADIUS server and FlexVPN server.
   • CAdd the aaa server radius dynamic-author command on the FlexVPN server.
   • DFix the RADIUS key mismatch between the RADIUS server and FlexVPN clients.

   Show answer

   Answer: C

   References

   • Cisco documentation

   Next question

9. Question 9 · 189 in bank

   A company needs to ensure only corporate issued laptops and devices are allowed to connect with the Cisco AnyConnect client. The solution should be applicable to multiple operating systems, including Windows, MacOS, and Linux, and should allow for remote remediation if a corporate issued device is stolen. Which solution should be used to accomplish these goals?

   • AUse a DAP registry check on the system to determine the relationship with the corporate domain.
   • BUse a DAP file check on the system to determine the relationship with the corporate domain.
   • CInstall and authenticate user certificates on the corporate devices.
   • DInstall and authenticate machine certificates on the corporate devices

   Show answer

   Answer: D

   Explanation

   DAP will not revoke access to a stolen or lost PC. It only verifies that the system meets specific security requirements such as antivirus being installed. A machine certificate, however, can be revoked on the CA server that the VPN head end will validate against.

   Source: Adapted from community discussion — netizen937

   Next question

10. Question 10 · 189 in bank

    Select 2

    When a FlexVPN is configured, which two components must be configured for IKEv2? (Choose two.)

    • Amethod
    • Bprofile
    • Cproposal
    • Dpreference
    • Epersistence

    Show answer

    Answer: BC

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-730 practice, question 1. 189 questions available.