300-730 practice questions 141–150

1. Question 141 · 189 in bank

   Which parameter must match on all routers in a DMVPN Phase 3 cloud?

   • AGRE tunnel key
   • BNHRP network ID
   • Ctunnel VRF
   • DEIGRP split-horizon setting

   Show answer

   Answer: A

   Explanation

   I think is A-> "Notes: NHRP network IDs are locally significant and can be different. It makes sense from a deployment and maintenance perspective to use unique network ID numbers using the ip nhrp network-id command) across all routers in a DMVPN network, but it is not necessary that they be the same." https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-dmvpn.html

   Source: Adapted from community discussion — fukumoto0925

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

2. Question 142 · 189 in bank

   Which parameter is initially used to elect the primary key server from a group of key servers?

   • Acode version
   • Bhighest IP address
   • Chighest-priority value
   • Dlowest IP address

   Show answer

   Answer: C

   Explanation

   Reference: https://www.cisco.com/c/en/us/products/collateral/security/group-encrypted-transport-vpn/deployment_guide_c07_554713.html

   References

   • Cisco documentation

   Next question

3. Question 143 · 189 in bank

   Which benefit of FlexVPN is a limitation of DMVPN using IKEv1?

   • AGRE encapsulation allows for forwarding of non-IP traffic.
   • BIKE implementation can install routes in routing table.
   • CNHRP authentication provides enhanced security.
   • DDynamic routing protocols can be configured.

   Show answer

   Answer: B

   References

   • Cisco documentation

   Next question

4. Question 144 · 189 in bank

   What is a requirement for smart tunnels to function properly?

   • AJava or ActiveX must be enabled on the client machine.
   • BApplications must be UDP.
   • CStateful failover must not be configured.
   • DThe user on the client machine must have admin access.

   Show answer

   Answer: A

   Explanation

   Reference: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/111007-smart-tunnel-asa-00.html

   Next question

5. Question 145 · 189 in bank

   Where is split tunneling defined for IKEv2 remote access clients on a Cisco router?

   • AIKEv2 authorization policy
   • BGroup Policy
   • Cvirtual template
   • Dwebvpn context

   Show answer

   Answer: A

   Explanation

   Steap 13 (Optional). By default, all traffic from the client is sent through the tunnel. You can configure split tunnel, which allows only selected traffic to go through the tunnel. ip access-list standard split_tunnel permit 10.0.0.0 0.255.255.255 ! crypto ikev2 authorization policy ikev2-auth-policy route set access-list split_tunnel https://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2-Remote-Access.html#toc-hId-936641904

   Source: Adapted from community discussion — pfrank

   References

   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 146 · 189 in bank

   Which technology is used to send multicast traffic over a site-to-site VPN?

   • AGRE over IPsec on IOS router
   • BGRE over IPsec on FTD
   • CIPsec tunnel on FTD
   • DGRE tunnel on ASA

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

7. Question 147 · 189 in bank

   Which feature of GETVPN is a limitation of DMVPN and FlexVPN?

   • Asequence numbers that enable scalable replay checking
   • Benabled use of ESP or AH
   • Cdesign for use over public or private WAN
   • Dno requirement for an overlay routing protocol

   Show answer

   Answer: D

   Explanation

   Answer D is Correct. one benefit of GET VPN is Simplified network design due to leveraging of native routing infrastructure (no overlay routing protocol needed)

   Source: Adapted from community discussion — marges

   Next question

8. Question 148 · 189 in bank

   Select 2

   

   Refer to the exhibit. Which two tunnel types produce the show crypto ipsec sa output seen in the exhibit? (Choose two.)

   • Acrypto map
   • BDMVPN
   • CGRE
   • DFlexVPN
   • EVTI

   Show answer

   Answer: BE

   Explanation

   i tested every answer in my lab and this is my finding. - only when a tunnel interface is used crypto map tag is Tunnel1-head-0 - only when tunnel mode is ipsec the local and remote ident are 0.0.0.0/0.0.0.0/0/0 - as soon as gre is used local and remote ident are (15.1.1.1/255.255.255.255/47/0) so i would choose D (FlexVPN with sVTI) and E (VTI when configured static)

   Source: Adapted from community discussion — nospampls

   Next question

9. Question 149 · 189 in bank

   

   Refer to the exhibit. Cisco AnyConnect must be set up on a router to allow users to access internal servers 192.168.0.10 and 192.168.0.11. All other traffic should go out of the client's local NIC. Which command accomplishes this configuration?

   • Asvc split include 192.168.0.0 255.255.255.0
   • Bsvc split exclude 192.168.0.0 255.255.255.0
   • Csvc split include acl CCNP
   • Dsvc split exclude acl CCNP

   Show answer

   Answer: C

   Explanation

   While C is correct the ACL is not. ip access-list extended CCNP permit 192.168.0.10 permit 192.168.0.11 It is an extended ACL with standard ACL content. Should be: ip access-list standard CCNP permit 192.168.0.10 permit 192.168.0.11 Also, only Standard ACL are supported.

   Source: Adapted from community discussion — spambox730

   References

   • Cisco documentation

   Next question

10. Question 150 · 189 in bank

    An engineer is configuring clientless SSL VPN. The finance department has a database server that only they should access, but the sales department can currently access it. The finance and the sales departments are configured as separate group-policies. What must be added to the configuration to make sure the users in the sales department cannot access the finance department server?

    • Atunnel group lock
    • Bsmart tunnel
    • Cport forwarding
    • Dwebtype ACL

    Show answer

    Answer: D

    Explanation

    "D". To ensure that users in the sales department cannot access the finance department server in a clientless SSL VPN setup, a webtype ACL (Access Control List) must be added to the configuration. A webtype ACL is used to define specific access controls for clientless SSL VPN users. It allows you to control and restrict the resources that users can access through the SSL VPN portal. By creating a webtype ACL and applying it to the appropriate group-policy associated with the sales department, you can explicitly deny access to the finance department server. This ACL will prevent users in the sales department from reaching the finance department server even though they are configured under separate group-policies. On the other hand, "tunnel group lock" is not directly related to restricting access to specific resources. It is a feature that allows you to lock a user to a specific tunnel group, ensuring that the user always connects to that particular tunnel group. Therefore, the correct approach to prevent users in the sales department from accessing the finance department server in a clientless SSL VPN setup is to use a webtype ACL.

    Source: Adapted from community discussion — kylesam2017

    References

    • Cisco documentation
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-730 practice, question 141. 189 questions available.