300-730 practice questions 51–60

1. Question 51 · 189 in bank

   A router is being configured for IKEv2 AnyConnect using AnyConnect-EAP. How would the administrator separate profiles for administrators and employees so that authorization differs when they connect?

   • ADefine group aliases on the headend and have the user pick the appropriate alias when they connect
   • BDefine group-urls on the headend and create two XML profiles to match the administrator and user group urls
   • CCreate a certificate map and match on the appropriate certificate fields
   • DDefine key-ids on the headend and create two XML profiles to match the administrator and user key-ids.

   Show answer

   Answer: D

   Explanation

   Step 7. Create an IKEv2 profile for AnyConnect-EAP method of client authentication. crypto ikev2 profile AnyConnect-EAP match identity remote key-id *$AnyConnectClient$* authentication local rsa-sig authentication remote anyconnect-eap aggregate pki trustpoint IKEv2-TP aaa authentication anyconnect-eap a-eap-authen-local aaa authorization group anyconnect-eap list a-eap-author-grp ikev2-auth-policy aaa authorization user anyconnect-eap cached virtual-template 100 anyconnect profile acvpn https://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2-Remote-Access.html#toc-hId-936641904

   Source: Adapted from community discussion — pfrank

   References

   • Cisco documentation

   Next question

2. Question 52 · 189 in bank

   A company is setting up a dynamic crypto map on the Cisco ASA at the headquarters to accept connections from the branch offices. There will be no IP subnet overlap between the branch offices, but the engineer does not know which encryption domains will be requested by the branch offices. Additionally, the company security policy states that routing protocol traffic should not leave the HQ network. Which solution should be used to route traffic back to the branches from the Cisco ASA with minimal administrative effort?

   • AConfigure Reverse Route Injection on the dynamic crypto map.
   • BConfigure a default route with the tunneled keyword on all branch routers.
   • CConfigure static routes for remote subnets.
   • DConfigure snapshot routing with EIGRP to send out of band routing updates.

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

3. Question 53 · 189 in bank

   A network engineer is implementing a FlexVPN tunnel between two Cisco IOS routers. The FlexVPN tunnels will terminate on encrypted traffic on an interface configured with an IP MTU of 1500, and the company has a security policy to drop fragmented traffic coming into or leaving the network. The tunnel will be used to transfer TFTP data between users and internal servers. When the TFTP traffic is not traversing a VPN, it can have a maximum IP packet size of 1500. Assuming the encrypted payload will add 90 bytes, which configuration allows TFTP traffic to traverse the FlexVPN tunnel without being dropped?

   • ASet the tunnel IP MTU to 1500.
   • BSet the tunnel tcp adjust-mss to 1460.
   • CSet the tunnel IP MTU to 1400.
   • DSet the tunnel tcp adjust-mss to 1360.

   Show answer

   Answer: C

   Next question

4. Question 54 · 189 in bank

   Select 2

   What are two differences between ECC and RSA? (Choose two.)

   • AKey generation in ECC is slower and more CPU intensive than RSA.
   • BECC can have the same security as RSA but with a shorter key size.
   • CECC cannot have the same security as RSA, even with an increased key size.
   • DKey generation in ECC is faster and less CPU intensive than RSA.
   • EECC lags in performance when compared with RSA.

   Show answer

   Answer: BD

   Next question

5. Question 55 · 189 in bank

   Which configuration construct must be used in a FlexVPN tunnel?

   • AEAP configuration
   • Bmultipoint GRE tunnel interface
   • CIKEv1 policy
   • DIKEv2 profile

   Show answer

   Answer: D

   Explanation

   FlexVPN only supports the Internet Key Exchange version 2 (IKEv2) protocol. IKEv2 is the default protocol used in FlexVPN, and it is used for authentication and key exchange between the FlexVPN client and server

   Source: Adapted from community discussion — Net4dd

   Next question

6. Question 56 · 189 in bank

   Refer to the exhibit.

   

   Which component must be configured on routers for a GETVPN deployment work properly?

   • APE3: Key Server – Customer 2 CEs: Group Members
   • BCustomer 1 CE1: Key Server – R1 and Customer 1 CE2: Group Members
   • CR1: Key Server – Customer 1 CEs: Group Members
   • DPE3: Key Server – all CEs: Group Members

   Show answer

   Answer: A

   Next question

7. Question 57 · 189 in bank

   A network administrator deployed IKEv2 Cisco AnyConnect on a Cisco ASA. The current configuration tunnels all traffic through the VPN. Users report poor performance with cloud-based applications, but no issues have been reported about connections to on-premises servers. Packet analysis on Cisco Webex traffic shows very few duplicate ACKs, high RTT, and no IP fragments. Which action improves Webex performance for VPN users?

   • AConfigure QoS on the outside interface of the ASA.
   • BConfigure Cisco AnyConnect to use DTLS.
   • CConfigure a dynamic split tunnel exclusion.
   • DReduce the Cisco AnyConnect tunnel MTU.

   Show answer

   Answer: B

   References

   • Cisco documentation

   Next question

8. Question 58 · 189 in bank

   A network administrator is troubleshooting a FlexVPN tunnel. The hub router is unable to ping the spoke router's tunnel interface IP address of 192.168.1.2, even though the tunnel is showing up. The output of the debug ip packet CLI command on the hub router shows the following entry. IP: tableid=0123456789 s=192.168.1.1 (local), d=192.168.1.2 (loopback2), routed via FIB. What must be configured to fix this issue?

   • AA matching IKEv2 pre-shared key on the hub and spoke routers in the crypto keyring configuration.
   • BAn outbound ACL on the dynamic VTI of the hub router that allows ICMP traffic to 192.168.1.2.
   • CAn IKEv2 authorization policy must be configured on the spoke router to advertise the interface route.
   • DA route map must be configured on hub router to set the next hop for 192.168.1.2 to the dynamic VTI.

   Show answer

   Answer: D

   Explanation

   hub cant reach spoke interface even if it shows to be up because spoke isnt definately advertising its network via IKEv2 authorization policy....i choose C

   Source: Adapted from community discussion — gondohwe

   Next question

9. Question 59 · 189 in bank

   An engineer is implementing the FlexVPN solution on a Cisco IOS router. The router must only terminate VPN requests and must not initiate them. Additionally, the interface must support VPNs from other routers and Cisco AnyConnect connections. Which interface type must be configured to meet these requirements?

   • Apoint-to-point GRE tunnel interface
   • Bmultipoint GRE tunnel interface
   • Cstatic virtual tunnel interface
   • Dvirtual template interface

   Show answer

   Answer: D

   Explanation

   The correct interface type to meet these requirements is the virtual template interface. This interface allows for the creation of multiple virtual access interfaces, which can be used for various types of remote access VPN connections, including site-to-site and AnyConnect VPNs. The virtual template interface can be configured to terminate VPN requests from other routers and allow for dynamic creation of VPN sessions, while also supporting AnyConnect VPN connections.

   Source: Adapted from community discussion — Alpha25

   Next question

10. Question 60 · 189 in bank

    An administrator is setting up Cisco AnyConnect on a Cisco ASA with the requirement that AnyConnect automatically establishes a VPN when a company-owned laptop is connected to the internet outside of the corporate network. Which configuration meets these requirements?

    • ASBL with user certificate authentication
    • BTND with machine certificate authentication
    • CSBL with machine certificate authentication
    • DTND with user certificate authentication

    Show answer

    Answer: B

    Explanation

    Trusted Network Detection (TND) gives you the ability to have AnyConnect automatically disconnect a VPN connection when the user is inside the corporate network (the trusted network) and start the VPN connection when the user is outside the corporate network (the untrusted network). https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect41/administration/guide/b_AnyConnect_Administrator_Guide_4-1/configure-vpn.html#id_100236

    Source: Adapted from community discussion — Toni_Su91

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-730 practice, question 51. 189 questions available.