300-730 practice questions 171–180

1. Question 171 · 189 in bank

   An administrator is setting up AnyConnect for the first time for a few users. Currently, the router does not have access to a RADIUS server. Which AnyConnect protocol must be used to allow users to authenticate?

   • AEAP-GTC
   • BEAP-MSCHAPv2
   • CEAP-MD5
   • DEAP-AnyConnect

   Show answer

   Answer: D

   Explanation

   Answer D is correct AnyConnect-EAP, also known as aggregate authentication, allows a Flex Server to authenticate the AnyConnect client via the Cisco proprietary AnyConnect-EAP method https://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2-Remote-Access.html

   Source: Adapted from community discussion — JKPippers

   References

   • Cisco documentation

   Next question

2. Question 172 · 189 in bank

   

   Refer to the exhibit. DMVPN spoke-to-spoke traffic works, but it passes through the hub, and never sends direct spoke-to-spoke traffic. Based on the tunnel interface configuration shown, what must be configured on the hub to solve the issue?

   • AEnable NHRP redirect.
   • BEnable split horizon.
   • CEnable IP redirects.
   • DEnable NHRP shortcut.

   Show answer

   Answer: A

   Explanation

   Ip nhrp shortcut is configured on the spoke, ip nhrp redirect is configured on the hub. Therefore the answer should be 'A'.

   Source: Adapted from community discussion — LEVELD

   Next question

3. Question 173 · 189 in bank

   Select 2

   

   Refer to the exhibit. Which two conclusions should be drawn from the DMVPN phase 2 configuration? (Choose two.)

   • ANext-hop-self is required.
   • BEIGRP neighbor adjacency will fail.
   • CEIGRP is used as the dynamic routing protocol.
   • DEIGRP route redistribution is not allowed.
   • ESpoke-to-spoke communication is allowed.

   Show answer

   Answer: CE

   Explanation

   The premise is that we are looking at a DMVPN phase 2 configuration. That means that spoke-to-spoke traffic should be allowed. Remember that phase 2 requires the "no ip next-hop-self" command with EIGRP

   Source: Adapted from community discussion — Veliion

   Next question

4. Question 174 · 189 in bank

   

   Refer to the exhibit. The VPN tunnel between the FlexVPN spoke and FlexVPN hub 192.168.0.12 is failing. What should be done to correct this issue?

   • AAdd the address 192.168.0.12 255.255.255.255 command to the keyring configuration.
   • BAdd the match fvrf any command to the IKEv2 policy.
   • CAdd the aaa authorization group psk list Flex_AAA Flex_Auth command to the IKEv2 profile configuration.
   • DAdd the tunnel mode gre ip command to the tunnel configuration.

   Show answer

   Answer: C

   References

   • Cisco documentation

   Next question

5. Question 175 · 189 in bank

   Which remote access VPN technology requires transform sets to be explicitly defined?

   • AClientless SSLVPN
   • BIPSec
   • CCisco Anyconnect
   • DFlexVPN

   Show answer

   Answer: B

   Next question

6. Question 176 · 189 in bank

   

   Refer to the exhibit. An IKEv2 site-to-site tunnel between an ASA and a remote peer is not building successfully. What will fix the problem based on the debug output?

   • AEnsure crypto IPsec policy matches on both VPN devices.
   • BInstall the correct certificate to validate the peer.
   • CCorrect crypto access list on both VPN devices.
   • DSpecify the peer IP address in the tunnel group name.

   Show answer

   Answer: C

   Explanation

   the error message says, "There was no IPSEC POLICY found for received TS" TS = Traffic selector (IP), so this means nothing to do with the IP but rather IPSec policy

   Source: Adapted from community discussion — shadow2020

   Next question

7. Question 177 · 189 in bank

   Select 2

   Which two parameters help to map a VPN session to a tunnel group without using the tunnel-group list? (Choose two.)

   • Agroup-alias
   • Bcertificate map
   • Coptimal gateway selection
   • Dgroup-url
   • EAnyConnect client version

   Show answer

   Answer: BD

   Explanation

   BD A. group-alias --> This is a tunnel-group list on the logon page but the question asked not to use the tunnel-group list. B. certificate map --> Can assign the user to a tunnel-group without the tunnel-group list. C. optimal gateway selection --> Completely different feature. D. group-url --> Can assign the user to a tunnel-group without the tunnel-group list. E. AnyConnect client version --> Can be used in certain decisions in DAP but i don't think it can assign a tunnel group based on client version.

   Source: Adapted from community discussion — spambox730

   References

   • Cisco documentation

   Next question

8. Question 178 · 189 in bank

   

   Refer to the exhibit. A network engineer is reconfiguring clientless SSLVPN during a maintenance window, and after testing the new configuration, is unable to establish the connection. What must be done to remediate this problem?

   • AEnable client services on the outside interface.
   • BEnable clientless protocol under the group policy.
   • CEnable DTLS under the group policy.
   • DEnable auto sign-on for the user's IP address.

   Show answer

   Answer: B

   Next question

9. Question 179 · 189 in bank

   Select 2

   What are two purposes of the key server in Cisco IOS GETVPN? (Choose two.)

   • Ato download encryption keys
   • Bto maintain encryption policies
   • Cto distribute routing information
   • Dto encrypt data traffic
   • Eto authenticate group members

   Show answer

   Answer: BE

   Explanation

   The Key Server is responsible for authenticating GMs. The KS manages security policies that determine which traffic should be encrypted.

   Source: Adapted from community discussion — Khs01

   References

   • Cisco documentation

   Next question

10. Question 180 · 189 in bank

    An engineer notices that while an employee is connected remotely, all traffic is being routed to the corporate network. Which split-tunnel policy allows a remote client to use their local provider for Internet access when working from home?

    • Atunnelall
    • Bexcludeall
    • Ctunnelspecified
    • Dexcludespecified

    Show answer

    Answer: D

    Explanation

    Correct answer is C, here is why: Now, specify the split tunnel mode. You can choose from the following three options: excludespecified (exclude only networks specified by split-tunnel-network-list) tunnelall (tunnel everything) tunnelspecified (tunnel only networks specified by split-tunnel-network-list) you're going to all all non RFC-1918 in ACL if you choose Answer D, the correct answer is C tunnel only whats included in ACL, the rest will go over ISP not tunnel. remember work smart!

    Source: Adapted from community discussion — ms997

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-730 practice, question 171. 189 questions available.