300-730 practice questions 101–110

1. Question 101 · 189 in bank

   A second set of traffic selectors is negotiated between two peers using IKEv2. Which IKEv2 packet will contain details of the exchange?

   • AIKEv2 IKE_SA_INIT
   • BIKEv2 INFORMATIONAL
   • CIKEv2 CREATE_CHILD_SA
   • DIKEv2 IKE_AUTH

   Show answer

   Answer: C

   Explanation

   per ChatGPT (I know, use at your own risk...): The second set of traffic selectors negotiated between two peers using IKEv2 will be included in the CREATE_CHILD_SA exchange. This exchange is used to establish a new child SA within an existing IKE SA. The CREATE_CHILD_SA exchange is initiated by the initiator, and the responder replies with a CREATE_CHILD_SA response. The CREATE_CHILD_SA exchange contains the following payloads: Initiator's nonce SA proposal Traffic selector proposal Key exchange data IDi (Initiator's Identification) IDr (Responder's Identification) Authentication data The SA proposal and traffic selector proposal payloads will contain the details of the second set of traffic selectors negotiated between the peers. These proposals will include the specific traffic selectors for the new child SA, such as IP addresses and port numbers.

   Source: Adapted from community discussion — netizen937

   References

   • Cisco documentation

   Next question

2. Question 102 · 189 in bank

   

   Refer to the exhibit. Based on the exhibit, why are users unable to access CCNP Webserver bookmark?

   • AThe URL is being blocked by a WebACL.
   • BThe ASA cannot resolve the URL.
   • CThe bookmark has been disabled.
   • DThe user cannot access the URL.

   Show answer

   Answer: B

   Explanation

   B is correct. WebVPN Clients Cannot Hit Bookmarks and is Grayed Out Problem If these bookmarks were configured for users to sign in to the clientless VPN, but on the home screen under "Web Applications" they show up as grayed out, how can I enable these HTTP links so that the users are able to click them and go into the particular URL? Solution You should first make sure that the ASA can resolve the websites through DNS. Try to ping the websites by name. If the ASA cannot resolve the name, the link is grayed out. If the DNS servers are internal to your network, configure the DNS domain-lookup private interface. https://www.cisco.com/c/en/us/support/docs/security-vpn/webvpn-ssl-vpn/119417-config-asa-00.html#anc15

   Source: Adapted from community discussion — PopLife

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

3. Question 103 · 189 in bank

   Which state indicates that BFD is missing on a peer when troubleshooting DMVPN?

   • ADOWN(D)
   • BNONE(N)
   • CUP(U)
   • DINVALID(I)

   Show answer

   Answer: B

   References

   • Cisco documentation
   • Cisco documentation

   Next question

4. Question 104 · 189 in bank

   Select 2

   Which two statements about the Cisco ASA Clientless SSL VPN solution are true? (Choose two.)

   • AWhen a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the client uses the local DNS to perform FQDN resolution.
   • BThe rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default.
   • CA Cisco ASA can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions.
   • DWhen a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the ASA uses its configured DNS servers to perform FQDN resolution.
   • EClientless SSLVPN provides Layer 3 connectivity into the secured network.

   Show answer

   Answer: CD

   References

   • Cisco documentation

   Next question

5. Question 105 · 189 in bank

   Which interface type must be used in an IKEv2 deployment that needs to route non-IP traffic?

   • Avirtual tunnel interface
   • Bdynamic virtual tunnel interface
   • CGRE interface
   • Dbridge virtual interface

   Show answer

   Answer: A

   Next question

6. Question 106 · 189 in bank

   Select 2

   Which two Secure Client Advantage and Premier models are available for Cisco Secure Client Remote Access VPN? (Choose two.)

   • ASecure Client Plus
   • BSecure Client Premium
   • CSecure Client Shared
   • DSecure Client Apex
   • ESecure Client Essentials

   Show answer

   Answer: AD

   Next question

7. Question 107 · 189 in bank

   Select 2

   Which two tunnel negotiation IKEV2 debug commands are used in Cisco ASA? (Choose two.)

   • Adebug crypto ca
   • Bdebug crypto ikev2 platform
   • Cdebug crypto ikev2
   • Ddebug crypto ikev2 error
   • Edebug crypto ikev2 protocol

   Show answer

   Answer: BE

   References

   • Cisco documentation

   Next question

8. Question 108 · 189 in bank

   Which feature allows the ASA to handle nonstandard applications and web resources so that they display correctly over a clientless SSL VPN connection?

   • Asingle sign-on
   • BSmart Tunnel
   • CWebType ACL
   • Dplug-ins

   Show answer

   Answer: B

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/vpn_clientless_ssl.html#29951

   Next question

9. Question 109 · 189 in bank

   Select 2

   An engineer must force a new IKEv2 security association to be built when using FlexVPN. Which two commands must the engineer apply to meet the requirement? (Choose two.)

   • Aclear flexvpn sessions
   • Bclear ipsec sa
   • Cclear isakmp crypto sa
   • Dshut the tunnel interface
   • Eno shut the tunnel interface

   Show answer

   Answer: DE

   References

   • Cisco documentation

   Next question

10. Question 110 · 189 in bank

    DRAG DROP - Drag and drop the actions from the left into the sequence on the right to configure Clientless SSL VPN on a Cisco ASA.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    References

    • Cisco documentation

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-730 practice, question 101. 189 questions available.