300-730 practice questions 21–30

1. Question 21 · 189 in bank

   Refer to the exhibit.

   

   VPN tunnels between a spoke and two DMVPN hubs are not coming up. The network administrator has verified that the encryption, hashing, and DH group proposals for Phase 1 and Phase 2 match on both ends. What is the solution to this issue?

   • AEnsure bidirectional UDP 500/4500 traffic.
   • BIncrease the isakmp phase 1 lifetime.
   • CAdd NAT statements for VPN traffic.
   • DEnable shared tunnel protection.

   Show answer

   Answer: A

   Explanation

   To resolve the issue of VPN tunnels between a spoke and two DMVPN hubs not coming up, the network administrator should ensure bidirectional UDP 500/4500 traffic. UDP ports 500 and 4500 are used for Internet Key Exchange (IKE) and IPsec traffic, respectively. To establish and maintain VPN tunnels, it is crucial to allow bidirectional traffic on these ports between the spoke and the hubs. By default, UDP port 500 is used for IKE Phase 1 negotiations, and UDP port 4500 is used for IKE Phase 2 negotiations in the case of NAT traversal. It is important to ensure that network devices, firewalls, and any intermediate network devices allow traffic on these ports. In some scenarios, network administrators may encounter issues due to network devices blocking or restricting UDP 500 or 4500 traffic. By ensuring that bidirectional UDP 500/4500 traffic is allowed, the VPN tunnels between the spoke and the two DMVPN hubs should come up successfully.

   Source: Adapted from community discussion — kylesam2017

   Next question

2. Question 22 · 189 in bank

   Select 2

   A network engineer is configuring a server. The router will terminate encrypted VPN connections on g0/0, which is in the VRF "Internet". The clear-text traffic that must be encrypted before being sent out traverses g0/1, which is in the VRF "Internal". Which two VRF-specific configurations allow VPN traffic to traverse the VRF-aware interfaces? (Choose two.)

   • AUnder the IKEv2 profile, add the ivrf Internal command.
   • BUnder the virtual-template interface, add the ip vrf forwarding Internet command.
   • CUnder the IKEv2 profile, add the match fvrf Internal command.
   • DUnder the IKEv2 profile, add the match fvrf Internet command.
   • EUnder the virtual-template interface, add the tunnel vrf Internet command.

   Show answer

   Answer: DE

   Explanation

   "D and E", are the correct answer selections here. Where the router is terminating encrypted VPN connections on g0/0 in the "Internet" VRF, and clear-text traffic is traversing g0/1 in the "Internal" VRF, the correct VRF-specific configurations to allow VPN traffic to traverse VRF-aware interfaces are: Under the virtual-template interface, add the tunnel vrf Internet command. Under the IKEv2 profile, add the match fvrf Internet command. So, the correct combination is: 1) Under the virtual-template interface, add the tunnel vrf Internet command. 2) Under the IKEv2 profile, add the match fvrf Internet command. This ensures that VPN traffic from the "Internal" VRF, encapsulated by the virtual-template interface, correctly traverses the "Internet" VRF on the g0/0 interface, meeting the requirements of the described scenario.

   Source: Adapted from community discussion — kylesam2017

   References

   • Cisco documentation

   Next question

3. Question 23 · 189 in bank

   

   Refer to the exhibit. Which value must be configured in the User Group field when the Cisco AnyConnect Profile is created to connect to an ASA headend with IPsec as the primary protocol?

   • Aaddress-pool
   • Bgroup-alias
   • Cgroup-policy
   • Dtunnel-group

   Show answer

   Answer: D

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect41/administration/guide/b_AnyConnect_Administrator_Guide_4-1/ configure-vpn.html

   Source: Adapted from community discussion — nospampls

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

4. Question 24 · 189 in bank

   What is a characteristic of GETVPN?

   • AAn ACL that defines interesting traffic must be configured and applied to the crypto map.
   • BQuick mode is used to create an IPsec SA.
   • CThe remote peer for the IPsec session is configured as part of the crypto map.
   • DAll peers have one IPsec SPI for inbound and outbound communication.

   Show answer

   Answer: D

   Explanation

   D. All peers have one IPsec SPI (Security Parameter Index) for inbound and outbound communication. In GETVPN, all group members share a common security association (SA) database and the same keys for encryption and decryption. This approach avoids the need for per-peer IPsec SAs and simplifies the configuration and management of the VPN. Instead of using multiple SAs, GETVPN uses a single SA with a unique Group Domain of Interpretation (GDOI) group key that is distributed to all group members.

   Source: Adapted from community discussion — Net4dd

   Next question

5. Question 25 · 189 in bank

   Refer to the exhibit.

   

   Users cannot connect via AnyConnect SSLVPN. Which action resolves this issue?

   • AConfigure the ASA to act as a DHCP server.
   • BConfigure the HTTP server to listen on port 443.
   • CAdd an IPsec preshared key to the group policy.
   • DAdd ssl-client to the allowed list of VPN protocols.

   Show answer

   Answer: D

   Next question

6. Question 26 · 189 in bank

   An administrator must guarantee that remote access users are able to reach printers on their local LAN after a VPN session is established to the headquarters. All other traffic should be sent over the tunnel. Which split-tunnel policy reduces the configuration on the ASA headend?

   • Ainclude specified
   • Bexclude specified
   • Ctunnel specified
   • Ddynamic exclude

   Show answer

   Answer: B

   Explanation

   To guarantee that remote access users can reach printers on their local LAN while sending all other traffic over the VPN tunnel, the split-tunnel policy that reduces configuration on the ASA headend is "exclude specified." The "exclude specified" split-tunnel policy allows you to define specific traffic or subnets that should not be sent over the VPN tunnel. In this case, you would specify the printers' IP addresses or the subnet they belong to in the split-tunnel configuration. By using the "exclude specified" split-tunnel policy, you only need to define the IP addresses or subnets that should bypass the VPN tunnel. All other traffic will automatically be sent over the VPN tunnel, simplifying the configuration on the ASA headend. This approach allows remote access users to access printers on their local LAN directly, without routing that traffic through the VPN tunnel, while still ensuring that all other traffic is securely transmitted over the tunnel

   Source: Adapted from community discussion — kylesam2017

   Next question

7. Question 27 · 189 in bank

   Refer to the exhibit.

   

   Given the output of the show ip route command, which remote access VPN technology is in use?

   • AReverse Route Injection
   • BFlexVPN
   • CDynamic Crypto Map
   • DDMVPN

   Show answer

   Answer: B

   References

   • Cisco documentation

   Next question

8. Question 28 · 189 in bank

   Select 2

   A network engineer is installing Cisco AnyConnect on company laptops so that users can access corporate resources remotely. The VPN concentrator is a Cisco router running IOS-XE 16.9.1 code and configured as a FlexVPN server that uses local authentication and *$Cisc431089017$* as the key-id for the IKEv2 profile. Which two steps must be taken on the computer to allow a successful AnyConnect connection to the router? (Choose two.)

   • AIn the Cisco AnyConnect XML profile, set the IPsec Authentication method to EAP-AnyConnect.
   • BIn the Cisco AnyConnect XML profile, add the hostname and host address to the server list.
   • CIn the Cisco AnyConnect XML profile, set the user group field to DefaultAnyConnectClientGroup.
   • DIn the Cisco AnyConnect Local Policy, set the BypassDownloader option in the local to true.
   • EIn the Cisco AnyConnect Local Policy, add the router IP address to the Update Policy.

   Show answer

   Answer: BE

   Explanation

   To allow a successful AnyConnect connection to the router configured as a FlexVPN server, the following steps need to be taken on the computer: B. In the Cisco AnyConnect XML profile, add the hostname and host address to the server list. E. In the Cisco AnyConnect Local Policy, add the router IP address to the Update Policy. Explanation: B. In the Cisco AnyConnect XML profile, adding the hostname and host address to the server list ensures that the AnyConnect client knows the address of the VPN concentrator (router) to connect to. E. In the Cisco AnyConnect Local Policy, adding the router IP address to the Update Policy allows the client to connect to the router for updates and configuration. The other options mentioned in the question are not relevant to the specific configuration and do not contribute to a successful AnyConnect connection.

   Source: Adapted from community discussion — Anonymous983475

   Next question

9. Question 29 · 189 in bank

   Select 2

   A network engineer is setting up Cisco AnyConnect 4.9 on a Cisco ASA running ASA software 9.1. Cisco AnyConnect must connect to the Cisco ASA before the user logs on so that login scripts can work successfully. In addition, the VPN must connect without user intervention. Which two key steps accomplish this task? (Choose two.)

   • ACreate a Network Access Manager profile with a client policy set to connect before user logon.
   • BCreate a Cisco AnyConnect VPN profile with Start Before Logon set to true.
   • CIssue an identity certificate to the trusted root CA folder in the machine store.
   • DCreate a Cisco AnyConnect VPN profile with Always On set to true.
   • ECreate a Cisco Anyconnect VPN Management Tunnel profile.

   Show answer

   Answer: BC

   References

   • Cisco documentation

   Next question

10. Question 30 · 189 in bank

    A network engineer has almost finished setting up a clientless VPN that allows remote users to access internal HTTP servers. Users must enter their username and password twice: once on the clientless VPN web portal and again to log in to internal HTTP servers. The Cisco ASA and the HTTP servers use the same Active Directory server to authenticate users. Which next step must be taken to allow users to enter their password only once?

    • AUse LDAPS and add password management to the clientless tunnel group.
    • BConfigure auto-sign-on using NTLM authentication.
    • CSet up the Cisco ASA to authenticate users via a SAML 2.0 IDP.
    • DCreate smart tunnels for the HTTP servers.

    Show answer

    Answer: B

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-730 practice, question 21. 189 questions available.