300-730ProfessionalCiscoAll questions freePage 17 of 19
300-730 practice questions 161–170
Implementing Secure Solutions with Virtual Private Networks (SVPN)189 questions across 19 pages are complete and free, with no account or card.
Official study references
189 questions in this bank
Free access · progress saved on this device
Question 162 · 189 in bank
Which Cisco AnyConnect component ensures that devices in a specific internal subnet are only accessible using port 443?
Show answer
Answer: D
References
Question 163 · 189 in bank
Refer to the exhibit. Upon setting up a tunnel between two sites, users are complaining that connections to applications over the VPN are not working consistently. The output of show crypto ipsec sa was collected on one of the VPN devices. Based on this output, what should be done to fix this issue?
Show answer
Answer: D
Explanation
I'd say this question is a bit confusing. There are packets that are falling out of anti-replay window - which might by caused by the MTU - as we can see path MTU is 1500. So I'd go with A however it is also possible to play with anti-replay window: https://www.cisco.com/c/en/us/support/docs/ip/internet-key-exchange-ike/116858-problem-replay-00.html However in general that is not recommended. Especially when fragmentation makes the packets fall out of anti-replay window.
Source: Adapted from community discussion — [Removed]
Question 164 · 189 in bank
After a user configures a connection profile with a bookmark list and tests the clientless SSLVPN connection, all of the bookmarks are grayed out. What must be done to correct this behavior?
Show answer
Answer: C
Explanation
https://www.cisco.com/c/en/us/support/docs/security-vpn/webvpn-ssl-vpn/119417-config-asa-00.html#anc15:~:text=simultaneous%2Dlogins%2020-,WebVPN%20Clients%20Cannot%20Hit%20Bookmarks%20and%20is%20Grayed%20Out,-Problem WebVPN Clients Cannot Hit Bookmarks and is Grayed Out Problem If these bookmarks were configured for users to sign in to the clientless VPN, but on the home screen under "Web Applications" they show up as grayed out, how can I enable these HTTP links so that the users are able to click them and go into the particular URL? Solution You should first make sure that the ASA can resolve the websites through DNS. Try to ping the websites by name. If the ASA cannot resolve the name, the link is grayed out. If the DNS servers are internal to your network, configure the DNS domain-lookup private interface.
Source: Adapted from community discussion — Acnaris
References
Question 165 · 189 in bank
Refer to the exhibit. Which type of VPN is being configured, based on the partial configuration snippet?
Show answer
Answer: A
Question 166 · 189 in bank
Refer to the exhibit. A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which action brings up the VPN tunnel?
Show answer
Answer: B
References
Question 167 · 189 in bank
An administrator is designing a VPN with a partner's non-Cisco VPN solution. The partner's VPN device will negotiate an IKEv2 tunnel that will only encrypt subnets 192.168.0.0/24 going to 10.0.0.0/24. Which technology must be used to meet these requirements?
Show answer
Answer: B
References
Question 168 · 189 in bank
A company's remote locations connect to the data centers via MPLS. A new request requires that unicast and multicast traffic that exits in the remote locations be encrypted. Which non-tunneled technology should be used to satisfy this requirement?
Show answer
Answer: D
Question 169 · 189 in bank
While troubleshooting, an engineer finds that the show crypto isakmp sa command indicates that the last state of the tunnel is MM_KEY_EXCH. What is the next step that should be taken to resolve this issue?
Show answer
Answer: D
Explanation
MM_KEY_EXCH* – Both peers exchange their DH keys and are generating their secret keys. (This state could also mean there is a mis-matched authentication type or PSK, if it does not proceed to the next step)
Source: Adapted from community discussion — Khs01
References
Question 170 · 189 in bank
Which VPN technology must be used to ensure that routers are able to dynamically form connections with each other rather than sending traffic through a hub and be able to advertise routes without the use of a dynamic routing protocol?
Show answer
Answer: D
Explanation
To ensure that routers can dynamically form connections with each other and advertise routes without relying on a dynamic routing protocol, the VPN technology that must be used is DMVPN Phase 3 (Dynamic Multipoint VPN Phase 3). DMVPN Phase 3 allows routers to establish direct spoke-to-spoke connections, eliminating the need to send traffic through a hub. It provides scalability and simplifies the configuration by allowing spoke routers to dynamically establish tunnels with each other as needed. Furthermore, DMVPN Phase 3 supports the use of Next Hop Resolution Protocol (NHRP), which enables route resolution and dynamic route advertisement between the spokes. On the other hand, FlexVPN is a different VPN technology that provides a modular framework for various VPN types, including site-to-site, remote access, and DMVPN. While FlexVPN offers flexibility and advanced features, DMVPN Phase 3 specifically addresses the requirements mentioned in your question.
Source: Adapted from community discussion — kylesam2017
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
300-730 practice, question 161. 189 questions available.
About this question bank
Version 1.0.0. How we source questions