300-730 practice questions 181–189

1. Question 181 · 189 in bank

   Select 2

   In order to enable FlexVPN to use a AAA attribute list, which two tasks must be performed? (Choose two.)

   • ADefine the RADIUS server.
   • BVerify that clients are using the correct authorization policy.
   • CDefine the AAA server.
   • DAssign the list to an authorization policy.
   • ESet the maximum segment size.

   Show answer

   Answer: BD

   Explanation

   Extended Hub Configuration for Client1 Define a AAA attribute list. aaa attribute list Client1 attribute type interface-config "ip mtu 1300" protocol ip attribute type interface-config "service-policy output TEST" protocol ip Note: Remember that the entity assigned via attributes must exist locally. In this case, policy-map was previously configured. policy-map TEST class class-default shape average 60000 Assign AAA attribute list to an authorization policy. crypto ikev2 authorization policy Client1 pool FlexSpokes aaa attribute list Client1 route set interface

   Source: Adapted from community discussion — pfrank

   References

   • Cisco documentation

   Next question

2. Question 182 · 189 in bank

   Select 2

   An engineer must configure remote desktop connectivity for offsite admins via clientless SSL VPN, configured on a Cisco ASA to Windows Vista workstations. Which two configurations provide the requested access? (Choose two.)

   • ATelnet bookmark via the Telnet plugin
   • BRDP2 bookmark via the RDP2 plugin
   • CVNC bookmark via the VNC plugin
   • DCitrix bookmark via the ICA plugin
   • ESSH bookmark via the SSH plugin

   Show answer

   Answer: BC

   References

   • Cisco documentation

   Next question

3. Question 183 · 189 in bank

   A network engineer must design a clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was found that one website is not being rewritten correctly by the ASA. What is a potential solution for this issue while still allowing it to be a clientless VPN setup?

   • ASet up a smart tunnel with the IP address of the web server.
   • BSet up a NAT rule that translates the ASA public address to the web server private address on port 80.
   • CSet up Cisco AnyConnect with a split tunnel that has the IP address of the web server.
   • DSet up a WebACL to permit the IP address of the web server.

   Show answer

   Answer: A

   Explanation

   Answer correct is A A smart tunnel is a connection between a TCP-based application and a private site, using a clientless (browser-based) SSL VPN session with the security appliance as the pathway and the security appliance as a proxy server. https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/111007-smart-tunnel-asa-00.html

   Source: Adapted from community discussion — JKPippers

   References

   • Cisco documentation

   Next question

4. Question 184 · 189 in bank

   Select 2

   Which two types of SSO functionality are available on the Cisco ASA without any external SSO servers? (Choose two.)

   • ASAML
   • BNTLM
   • CKerberos
   • DOAuth 2.0
   • EHTTP Basic

   Show answer

   Answer: BE

   References

   • Cisco documentation
   • Cisco documentation

   Next question

5. Question 185 · 189 in bank

   

   Refer to the exhibit. Which type of VPN implementation is displayed?

   • AIKEv1 cluster
   • BIKEv2 backup gateway
   • CIKEv2 load balancer
   • DIKEv2 reconnect

   Show answer

   Answer: C

   References

   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 186 · 189 in bank

   A DMVPN spoke is configured with IKEv1 to secure the tunnel. Despite having a configuration similar to other working spokes, the tunnel is not coming up. Packet captures on the spoke show packets leaving the spoke router, but not making it to the hub router. Which solution resolves this issue?

   • AConfigure the spoke and hub to use the same IKE version.
   • BEnsure that devices between the hub and spoke are not blocking ESP traffic.
   • CEnsure that devices between the hub and spoke are not blocking GRE traffic.
   • DEnable the tunnel interface with the no shutdown command.

   Show answer

   Answer: B

   Explanation

   To resolve the issue with the DMVPN tunnel not coming up, the solution would be to ensure that devices between the hub and spoke are not blocking the GRE (Generic Routing Encapsulation) traffic. DMVPN uses GRE encapsulation to create the overlay network, and ESP (Encapsulating Security Payload) is used to secure the GRE-encapsulated packets. However, in this scenario, the packets are leaving the spoke router, but not reaching the hub router, indicating a possible blockage of GRE traffic. By ensuring that devices between the hub and spoke are not blocking GRE traffic, you allow the encapsulated packets to traverse the network and reach the intended destination. This can involve checking the configuration of any firewalls, routers, or other network devices along the path to ensure they are configured to allow GRE traffic. While it is also important to ensure that ESP traffic is not blocked to maintain secure communication, in this specific case, the issue lies with the GRE encapsulation itself. Once the GRE traffic is allowed, the DMVPN tunnel should be able to establish successfully.

   Source: Adapted from community discussion — kylesam2017

   References

   • Cisco documentation

   Next question

7. Question 187 · 189 in bank

   

   Refer to the exhibit. A network engineer is troubleshooting a new DMVPN configuration. The network connectivity between the hub and spoke is working as it should, but users cannot access VPN resources. Which action resolves the issue?

   • AReview ISAKMP packets on devices between the VPN devices.
   • BUnblock IP protocol 50 on devices between the VPN devices.
   • CEnsure that the IPsec profile is configured on the tunnel interface.
   • DEnsure that the NHS is configured on the tunnel interface.

   Show answer

   Answer: C

   Next question

8. Question 188 · 189 in bank

   What is the default rekey timer for security association pair in the case of IPsec for Cisco ASA?

   • A8 hours
   • B12 hours
   • C18 hours
   • D24 hours

   Show answer

   Answer: D

   Next question

9. Question 189 · 189 in bank

   

   Refer to the exhibit. An engineer recently applied several configuration changes to a Cisco Adaptive Security Appliance; however, users report that a web app requiring Java plug-ins has stopped working through the Clientless SSL VPN. What must be the cause of this issue?

   • AThe svk ask none command is blocking the required java plug-ins for the app.
   • BThe port-forward auto command is preventing the ASA from recognizing the Java plug-ins, causing the plug-in to be blocked.
   • CThe http-only-cookie command prevents the Java plug-ins from accessing the session cookie, causing the app to fail.
   • DThe enable outside command is misconfigured and blocking external web traffic.

   Show answer

   Answer: C

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-730 practice, question 181. 189 questions available.