300-730 practice questions 121–130

1. Question 121 · 189 in bank

   

   Refer to the exhibit. The customer can establish a Cisco AnyConnect connection without using an XML profile. When the host "ikev2" is selected in the AnyConnect drop down, the connection fails. What is the cause of this issue?

   • AThe HostName is incorrect.
   • BThe IP address is incorrect.
   • CPrimary protocol should be SSL.
   • DUserGroup must match connection profile.

   Show answer

   Answer: D

   Explanation

   Reference: https://community.cisco.com/t5/security-documents/anyconnect-xml-settings/ta-p/3157891

   Next question

2. Question 122 · 189 in bank

   

   Refer to the exhibit. A site-to-site tunnel between two sites is not coming up. Based on the debugs, what is the cause of this issue?

   • AAn authentication failure occurs on the remote peer.
   • BA certificate fragmentation issue occurs between both sides.
   • CUDP 4500 traffic from the peer does not reach the router.
   • DAn authentication failure occurs on the router.

   Show answer

   Answer: C

   References

   • Cisco documentation

   Next question

3. Question 123 · 189 in bank

   

   Refer to the exhibit. Based on the debug output, which type of mismatch is preventing the VPN from coming up?

   • Ainteresting traffic
   • Blifetime
   • Cpreshared key
   • DPFS

   Show answer

   Answer: A

   Explanation

   The first of the two TS payloads is known as TSi (Traffic Selector- initiator). The second is known as TSr (Traffic Selector-responder). TSi specifies the source address of traffic forwarded from (or the destination address of traffic forwarded to) the initiator of the Child SA pair. https://www.rfc-editor.org/rfc/rfc5996#page-40

   Source: Adapted from community discussion — Net4dd

   References

   • RFC Editor

   Next question

4. Question 124 · 189 in bank

   

   Refer to the exhibit. The IKEv2 site-to-site VPN tunnel between two routers is down. Based on the debug output, which type of mismatch is the problem?

   • Apreshared key
   • Bpeer identity
   • Ctransform set
   • Dikev2 proposal

   Show answer

   Answer: B

   Next question

5. Question 125 · 189 in bank

   

   Refer to the exhibit. Which type of mismatch is causing the problem with the IPsec VPN tunnel?

   • Acrypto access list
   • BPhase 1 policy
   • Ctransform set
   • Dpreshared key

   Show answer

   Answer: D

   Explanation

   Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html#ike

   References

   • Cisco documentation

   Next question

6. Question 126 · 189 in bank

   

   Refer to the exhibit. What is a result of this configuration?

   • ASpoke 1 fails the authentication because the authentication methods are incorrect.
   • BSpoke 2 passes the authentication to the hub and successfully proceeds to phase 2.
   • CSpoke 2 fails the authentication because the remote authentication method is incorrect.
   • DSpoke 1 passes the authentication to the hub and successfully proceeds to phase 2.

   Show answer

   Answer: A

   Next question

7. Question 127 · 189 in bank

   

   Refer to the exhibit. Client 1 cannot communicate with client 2. Both clients are using Cisco AnyConnect and have established a successful SSL VPN connection to the hub ASA. Which command on the ASA is missing?

   • Adns-server value 10.1.1.2
   • Bsame-security-traffic permit intra-interface
   • Csame-security-traffic permit inter-interface
   • Ddns-server value 10.1.1.3

   Show answer

   Answer: B

   Next question

8. Question 128 · 189 in bank

   On a FlexVPN hub-and-spoke topology where spoke-to-spoke tunnels are not allowed, which command is needed for the hub to be able to terminate FlexVPN tunnels?

   • Ainterface virtual-access
   • Bip nhrp redirect
   • Cinterface tunnel
   • Dinterface virtual-template

   Show answer

   Answer: D

   Explanation

   A: has no sense B: spoke to spoke is not allowed and this command is used for spoke to spoke c: makes no sense D: most right answer as this command is needed on the hub for hub and spoke communication.

   Source: Adapted from community discussion — LouisVuitton

   References

   • Cisco documentation

   Next question

9. Question 129 · 189 in bank

   Which redundancy protocol must be implemented for IPsec stateless failover to work?

   • ASSO
   • BGLBP
   • CHSRP
   • DVRRP

   Show answer

   Answer: C

   Explanation

   Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/17826-ipsec-feat.html

   Next question

10. Question 130 · 189 in bank

    Which technology works with IPsec stateful failover?

    • AGLBP
    • BHSRP
    • CGRE
    • DVRRP

    Show answer

    Answer: B

    Explanation

    Reference: https://www.cisco.com/c/en/us/td/docs/ios/12_2/12_2y/12_2yx11/feature/guide/ft_vpnha.html#wp1122512

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-730 practice, question 121. 189 questions available.