300-730 practice questions 11–20

1. Question 11 · 189 in bank

   A DMVPN spoke router tunnel is up and passing traffic, but it cannot establish an EIGRP neighbor relationship with the hub router. Which solution resolves this issue?

   • AEnable EIGRP Split Horizon on the hub tunnel interface.
   • BRemove the EIGRP stub configuration on the spoke tunnel interface.
   • CEnable the EIGRP next hop self feature on the hub tunnel interface.
   • DConfigure the dynamic NHRP multicast map on the hub tunnel interface.

   Show answer

   Answer: D

   Explanation

   "D", is the correct answer here. Configuring the dynamic NHRP multicast map on the hub tunnel interface is a solution that can potentially resolve the issue of a DMVPN spoke router being unable to establish an EIGRP neighbor relationship with the hub router. In DMVPN (Dynamic Multipoint VPN) environments, when using protocols like EIGRP over the tunnel, it's essential to ensure proper handling of multicast traffic, which is used for routing protocol neighbor discovery. The dynamic NHRP multicast map helps in this context by dynamically mapping multicast groups to the NBMA (Non-Broadcast Multiple Access) addresses of the spokes. To configure the dynamic NHRP multicast map on the hub tunnel interface, you can use a command like: interface Tunnel0 ip nhrp map multicast dynamic This command tells the hub router to dynamically map multicast groups for NHRP, enabling proper handling of EIGRP multicast traffic between spokes and the hub. Therefore, configuring the dynamic NHRP multicast map on the hub tunnel interface is a valid solution to address the issue of EIGRP neighbor relationship establishment in a DMVPN setup.

   Source: Adapted from community discussion — kylesam2017

   References

   • Cisco documentation

   Next question

2. Question 12 · 189 in bank

   Which command identifies a Cisco AnyConnect profile that was uploaded to the flash of an IOS router?

   • Asvc import profile SSL_profile flash:simos-profile.xml
   • Banyconnect profile SSL_profile flash:simos-profile.xml
   • Ccrypto vpn anyconnect profile SSL_profile flash:simos-profile.xml
   • Dwebvpn import profile SSL_profile flash:simos-profile.xml

   Show answer

   Answer: C

   Explanation

   Reference: https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200533-AnyConnect-Configure-Basic-SSLVPN-for-I.html

   References

   • Cisco documentation

   Next question

3. Question 13 · 189 in bank

   Refer to the exhibit.

   

   An IPsec Cisco AnyConnect client is failing to connect and generates these debugs every time a connection to an IOS headend is attempted. Which action resolves this issue?

   • ACorrect the DH group setting.
   • BCorrect the PFS setting.
   • CCorrect the integrity setting.
   • DCorrect the encryption setting.

   Show answer

   Answer: A

   Next question

4. Question 14 · 189 in bank

   Select 2

   Refer to the exhibit.

   

   An engineer must allow Cisco AnyConnect users to access the outside interface using protocol UDP 500/4500. In addition, these clients must be able to establish an SSL connection to update Cisco AnyConnect software over the same connection. Which two actions must be taken to achieve this goal? (Choose two.)

   • AIPsec (IKEv2) Allow Access must be checked on the outside interface.
   • BSSL Enable DTLS must be checked on the outside interface.
   • CBypass interface access lists for inbound VPN sessions must be unchecked.
   • DIPsec (IKEv2) Enable Client Services must be checked on the outside interface.
   • ESSL Allow Access must be checked on the outside interface.

   Show answer

   Answer: AD

   Next question

5. Question 15 · 189 in bank

   Refer to the exhibit.

   

   Based on the configuration output, what is the VPN technology?

   • Asite-to-site
   • BDMVPN
   • CL2VPN
   • Dmulticast VPN

   Show answer

   Answer: B

   Explanation

   The correct answer is B. Look on pg. 139 of Table 5-2 on Official Cert Guide CCNP Security Virtual Private Networks SVPN 300-730. Why am I paying for this site if it doesn't have the correct answers?

   Source: Adapted from community discussion — pfrank

   References

   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 16 · 189 in bank

   A user at a company HQ is having trouble accessing a network share at a branch site that is connected with a L2L IPsec VPN. While troubleshooting, a network security engineer runs a packet tracer on the Cisco ASA to simulate the user traffic and discovers that the encryption counter is increasing but the decryption counter is not. What must be configured to correct this issue?

   • AAdjust the routing on the remote peer device to direct traffic back over the tunnel.
   • BAdjust the preshared key on the remote peer to allow traffic to flow over the tunnel.
   • CAdjust the transform set to allow bidirectional traffic.
   • DAdjust the peer IP address on the remote peer to direct traffic back to the ASA.

   Show answer

   Answer: A

   Next question

7. Question 17 · 189 in bank

   A user is experiencing delays on audio calls over a Cisco AnyConnect VPN. Which implementation step resolves this issue?

   • AChange to 3DES Encryption.
   • BShorten the encryption key lifetime.
   • CInstall the Cisco AnyConnect 2.3 client for the user to download.
   • DEnable DTLS.

   Show answer

   Answer: D

   Next question

8. Question 18 · 189 in bank

   Users cannot log in to a Cisco ASA using clientless SSLVPN. Troubleshooting reveals the error message "WebVPN session terminated: Client type not supported". Which step does the administrator take to resolve this issue?

   • AEnable the Cisco AnyConnect premium license on the Cisco ASA.
   • BHave the user upgrade to a supported browser.
   • CIncrease the simultaneous logins on the group policy.
   • DEnable the clientless VPN protocol on the group policy.

   Show answer

   Answer: D

   Explanation

   To resolve the issue of users unable to log in to a Cisco ASA using clientless SSLVPN and encountering the error message "WebVPN session terminated: Client type not supported," the administrator should enable the clientless VPN protocol on the group policy. The "Client type not supported" error message typically indicates that the clientless SSLVPN feature on the Cisco ASA is not enabled or the configured group policy does not allow clientless VPN connections. By enabling the clientless VPN protocol on the group policy, you allow users to connect using the clientless SSLVPN method. Enabling the Cisco AnyConnect premium license on the Cisco ASA is not directly related to resolving this particular issue. The premium license is needed if you want to use the Cisco AnyConnect VPN client software instead of the clientless SSLVPN method. In summary, to address the login issue and overcome the "Client type not supported" error message, the administrator should focus on enabling the clientless VPN protocol on the group policy. This will allow users to establish a clientless SSLVPN connection to the Cisco ASA successfully.

   Source: Adapted from community discussion — kylesam2017

   References

   • Cisco documentation

   Next question

9. Question 19 · 189 in bank

   An administrator is setting up a VPN on an ASA for users who need to access an internal RDP server. Due to security restrictions, the Microsoft RDP client is blocked from running on client workstations via Group Policy. Which VPN feature should be implemented by the administrator to allow these users to have access to the RDP server?

   • Aclientless proxy
   • Bsmart tunneling
   • Cclientless plug-in
   • Dclientless rewriter

   Show answer

   Answer: C

   Explanation

   C is the correct answer. CCNP Security SVPN 300-730 pg. 301, Configuring Client/Server Plug-ins. Client/server plug-ins allow administrators to extend the applications supported by a client-less SSL VPN to include applications such as RDP, VNC, Telnet, and SSH.

   Source: Adapted from community discussion — pfrank

   References

   • cisco.com documentation

   Next question

10. Question 20 · 189 in bank

    An administrator is planning a VPN configuration that will encrypt traffic between multiple servers that will be passing unicast and multicast traffic. This configuration must be able to be implemented without the need to modify routing within the network. Which VPN technology must be used for this task?

    • AFlexVPN
    • BVTI
    • CGETVPN
    • DDMVPN

    Show answer

    Answer: C

    Explanation

    C makes sense: The VPN technology that must be used for this task is GETVPN (Group Encrypted Transport VPN). GETVPN is designed to encrypt both unicast and multicast traffic while preserving the original source and destination IP addresses, and it does not require any changes to the existing routing infrastructure. Additionally, GETVPN provides a scalable and efficient solution for encrypting traffic within a network, making it a good choice for this scenario.

    Source: Adapted from community discussion — Net4dd

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-730 practice, question 11. 189 questions available.