Question 31 · 189 in bank
What must be configured in a FlexVPN deployment to allow for direct communication between spokes connected to different hubs?
Show answer
Answer: D
300-730ProfessionalCiscoAll questions freePage 4 of 19
300-730 practice questions 31–40
Implementing Secure Solutions with Virtual Private Networks (SVPN)189 questions across 19 pages are complete and free, with no account or card.
Official study references
189 questions in this bank
Free access · progress saved on this device
Question 32 · 189 in bank
Refer to the exhibit.
An engineer has configured a spoke to connect to a FlexVPN hub. The tunnel is up, but pings fail when the engineer attempts to reach host 192.168.200.10 behind the spoke, and traffic is sourced from host 192.168.100.3, which is behind the FlexVPN server. Based on packet captures, the engineer discovers that host 192.168.200.10 receives the icmp echo and sends an icmp reply that makes it to the inside interface of the spoke. Based on the output in the exhibit captured on the spoke by the engineer, which action resolves this issue?
Show answer
Answer: B
Explanation
The correct action to resolve the issue is likely to "Add the route set remote ipv4 192.168.100.0 255.255.255.0" command to the spoke authorization policy. Here's the reasoning: 1) The source host that initiates the traffic is 192.168.100.3, which is behind the FlexVPN server (the spoke). 2) The captured ICMP echo replies from host 192.168.200.10 are making it to the inside interface of the spoke. 3) If the traffic from 192.168.200.10 is reaching the spoke but not making it back to the source (192.168.100.3), it suggests a routing issue on the spoke. By adding the route set remote command for the network 192.168.100.0/24 to the spoke's authorization policy, you inform the spoke about the network behind the FlexVPN server. This ensures that the spoke knows how to route the response traffic back to the source host, resolving the issue.
Source: Adapted from community discussion — kylesam2017
Question 33 · 189 in bank
Which DMVPN feature allows spokes to be deployed with dynamically assigned public IP addresses?
Show answer
Answer: B
Question 34 · 189 in bank
Refer to the exhibit. What is configured as a result of this command set?
Show answer
Answer: C
Explanation
Correct answer is C. The configuration snippet is an identical match to the server configuration when you look it up. Not the client.
Source: Adapted from community discussion — cisco_guy
Question 35 · 189 in bank
Refer to the exhibit.
An engineer is building an IKEv1 tunnel to a peer Cisco ASA, but the tunnel is failing. Based on the configuration in the exhibit, which action must be taken to allow the VPN tunnel to come up?
Show answer
Answer: B
References
Question 36 · 189 in bank
An engineer has successfully established a Phase 1 and Phase 2 tunnel between two sites. Site A has internal subnet 192.168.0.0/24 and Site B has internal subnet 10.0.0.0/24. The engineer notices that no packets are decrypted at Site B. Pings to 192.168.0.1 from internal Site B devices make it to the Site B router, and the Site A router has incrementing encrypt and decrypt counters. What must be done to ensure bidirectional communication between both sites?
Show answer
Answer: C
Explanation
If the Phase 1 and Phase 2 tunnels have been successfully established between Site A and Site B, and pings from internal devices at Site B reach the Site B router but are not decrypted, the issue might be related to the firewall in front of the Site B router. In this case, to ensure bidirectional communication between the two sites, you need to allow the encapsulating security payload (ESP) protocol through the firewall. Therefore, the correct action would be to "Allow protocol ESP on the firewall in front of the Site B router." ESP (Encapsulating Security Payload) is a protocol used in IPsec to provide encryption, integrity, and authentication of packets. If ESP traffic is blocked by the firewall, it can prevent the successful decryption of packets arriving at Site B. AH (Authentication Header) is another IPsec protocol, but it does not provide encryption and is less commonly used. In a typical IPsec configuration, ESP is used for encryption and authentication, so allowing ESP is usually the correct step to ensure the bidirectional communication is successful.
Source: Adapted from community discussion — kylesam2017
Question 37 · 189 in bank
Refer to the exhibit.
A Cisco ASA is configured as a client to a router running as a FlexVPN server. The router is configured with a virtual template to terminate FlexVPN clients. Traffic between networks 192.168.0.0/24 and 172.16.20.0/24 does not work as expected. Based on the show crypto ikev2 sa output collected from the Cisco ASA in the exhibit, what is the solution to this issue?
Show answer
Answer: B
Explanation
the show crypto ukev2 sa output from the ASA, the local selector is 192.168.0.0/24 the remote selector is 172.16.2.0/24 ( which is wrong , should be .20.0/24) . so , the ACL in the ASA should be to permit 192.168.0.0/24 to 172.16.20.0/24
Source: Adapted from community discussion — mazinhoo
Question 38 · 189 in bank
A user is trying to log in to a Cisco ASA using the clientless SSLVPN feature and receives the error message "clientless (browser) SSLVPN access is not allowed". Which step should the Cisco ASA administrator take to resolve this issue?
Show answer
Answer: B
Explanation
I think the correct answer is B, for answer A we get different error message "WebVPN session terminated: Client type not supported". There are 2 types of SSL VPN license: 1) AnyConnect Essential license - only supports AnyConnect client connections 2) AnyConnect Premium license (user base license) - supports all flavours of SSL VPN, including: clientless SSL VPN, AnyConnect client VPN, and all the advanced features of SSL VPN.
Source: Adapted from community discussion — mazinhoo
Question 39 · 189 in bank
Which feature allows a DMVPN Phase 3 spoke to switch to an alternate hub when the primary hub is unreachable?
Show answer
Answer: B
Explanation
The DMVPN-Tunnel Health Monitoring and Recovery (Backup NHS) feature allows you to control the number of connections to the Dynamic Multipoint Virtual Private Network (DMVPN) hub and allows you to switch to alternate hubs in case of a connection failure to the primary hubs. https://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-2mt/sec-conn-dmvpn-backup-nhs.html#:~:text=The%20DMVPN%2DTunnel%20Health%20Monitoring%20and%20Recovery%20(Backup%20NHS),failure%20to%20the%20primary%20hubs.
Source: Adapted from community discussion — mazinhoo
References
Question 40 · 189 in bank
Select 2An engineer is using DMVPN to provide secure connectivity between a data center and remote sites. Which two routing protocols should be used between the routers? (Choose two.)
Show answer
Answer: BE
Explanation
what question is this ? in theory DMVPN can use BGP , RIPv2 , OSPF , EIGRP... EIGRP is cisco's product so let's say we should choose it and BGP is also a good choice
Source: Adapted from community discussion — mihaid
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
300-730 practice, question 31. 189 questions available.
About this question bank
Version 1.0.0. How we source questions