300-730 practice questions 61–70

1. Question 61 · 189 in bank

   Select 2

   Which two protocols does DMVPN leverage to build dynamic VPNs to multiple destinations? (Choose two.)

   • AIKEv2
   • BNHRP
   • CmGRE
   • DmBGP
   • EGDOI

   Show answer

   Answer: BC

   Explanation

   Dynamic Multipoint Virtual Private Network (DMVPN) leverages two protocols to build dynamic VPNs to multiple destinations: mGRE (Multipoint Generic Routing Encapsulation): mGRE is used to create a multipoint tunnel between multiple remote sites. It provides the ability to send multicast and broadcast traffic between sites without the need for a separate tunnel for each destination. NHRP (Next Hop Resolution Protocol): NHRP is used for the dynamic discovery of the next-hop tunnel endpoint (NBMA address) in a multipoint GRE (mGRE) environment. It helps in mapping dynamic spoke addresses to the hub's public IP address, allowing for efficient spoke-to-spoke communication without requiring a full mesh of tunnels. Therefore, the correct answer is mGRE and NHRP.

   Source: Adapted from community discussion — kylesam2017

   References

   • Cisco documentation

   Next question

2. Question 62 · 189 in bank

   An engineer is requesting an SSL certificate for a VPN load-balancing cluster in which two Cisco ASAs provide clientless SSLVPN access. The FQDN that users will enter to access the clientless VPN is asa.example.com, and users will be redirected to either asa1.example.com or asa2.example.com. The cluster FQDN and individual Cisco ASAs FQDNs resolve to IP addresses 192.168.0.1, 192.168.0.2, and 192.168.0.3 respectively. The issued certificate must be able to be used to validate the identity of either ASA in the cluster without returning any certificate validation errors. Which fields must be included in the certificate to meet these requirements?

   • ACN=*.example.com, SAN=asa.example.com
   • BCN=192.168.0.1, SAN=asa1.example.com, asa2.example.com
   • CCN=asa.example.com, SAN=asa.example.com, asa1.example.com, asa2.example.com
   • DCN=192.168.0.1, SAN=192.168.0.1, 192.168.0.2, 192.168.0.3

   Show answer

   Answer: C

   Explanation

   To meet the requirements of validating the identity of either ASA in the cluster without returning any certificate validation errors, the certificate must include the Common Name (CN) for the specific FQDN used by users and Subject Alternative Names (SAN) for all possible FQDNs. Therefore, the correct fields for the certificate would be: CN=asa.example.com, SAN=asa.example.com, asa1.example.com, asa2.example.com This ensures that the certificate is valid for the specific FQDN (asa.example.com) and also includes Subject Alternative Names for the individual FQDNs of both ASAs (asa1.example.com and asa2.example.com). This way, users connecting to the VPN load-balancing cluster using any of these FQDNs will not encounter certificate validation errors. The wildcard option (CN=*.example.com) may not cover all required FQDNs in this specific scenario.

   Source: Adapted from community discussion — kylesam2017

   Next question

3. Question 63 · 189 in bank

   DRAG DROP - Drag and drop the GETVPN components from the left onto the descriptions on the right.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   IPSec: Secures the data traffic,.. IKEv2: Adds statics routes,.. NHRP: Resolves the remote,.. MPLS: Enables tag switching for data,.. MPBGP: Distributes overlay,..

   Source: Adapted from community discussion — Net4dd

   References

   • Cisco documentation
   • Cisco documentation

   

   Next question

4. Question 64 · 189 in bank

   An engineer has integrated a new DMVPN to link remote offices across the internet using Cisco IOS routers. When connecting to remote sites, pings and voice data appear to flow properly, and all tunnel stats show that they are up. However, when trying to connect to a remote server using RDP, the connection fails. Which action resolves this issue?

   • AAdjust the MTU size within the routers.
   • BAdd RDP port to the extended ACL.
   • CReplace certificate on the RDP server.
   • DChange DMVPN timeout values.

   Show answer

   Answer: A

   Next question

5. Question 65 · 189 in bank

   Select 2

   Over which two transport mediums is FlexVPN deployed? (Choose two.)

   • A5G
   • BVPLS
   • Cinternet
   • DMPLS
   • EDWDM

   Show answer

   Answer: CD

   References

   • Cisco documentation

   Next question

6. Question 66 · 189 in bank

   A Cisco AnyConnect client establishes a SSL VPN connection with an ASA at the corporate office. An engineer must ensure that the client computer meets the enterprise security policy. Which feature can update the client to meet an enterprise security policy?

   • AEndpoint Assessment
   • BCisco Secure Desktop
   • CBasic Host Scan
   • DAdvanced Endpoint Assessment

   Show answer

   Answer: D

   Explanation

   Correct answer is A. The Advanced Endpoint Assessment focuses on AV and remediation. Endpoint Assessment focus on the security policy checks of the local system, which examines or assesses the system.

   Source: Adapted from community discussion — cisco_guy

   References

   • Cisco documentation
   • Cisco documentation

   Next question

7. Question 67 · 189 in bank

   Select 2

   The corporate network security policy requires that all internet and network traffic must be tunneled to the corporate office. Remote workers have been provided with printers to use locally at home while they are remotely connected to the corporate network. Which two steps must be executed to allow printing to the local printers? (Choose two.)

   • AConfigure the split-tunnel-policy on the Cisco ASA to tunnelall.
   • BCheck the Allow Local LAN access checkbox in the Cisco AnyConnect client.
   • CAdd a persistent static route in the client OS for the local LAN network.
   • DConfigure the split-tunnel-policy on the Cisco ASA to excludespecified.
   • EConfigure the split-tunnel-policy on the Cisco ASA to tunnelspecified.

   Show answer

   Answer: BD

   References

   • Cisco documentation

   Next question

8. Question 68 · 189 in bank

   Select 2

   A network engineer must configure the Cisco ASA so that Cisco AnyConnect clients establishing an SSL VPN connection create an additional tunnel for real-time traffic that is sensitive to packet delays. If this additional tunnel experiences any issues, it must fall back to a TLS connection. Which two Cisco AnyConnect features must be configured to accomplish this task? (Choose two.)

   • ADTLS
   • BDSCP Preservation
   • CDPD
   • DSSL Rekey
   • EOMTU

   Show answer

   Answer: AC

   Explanation

   Configure Dead Peer Detection Dead Peer Detection (DPD) ensures that the ASA (gateway) or the client can quickly detect a condition where the peer is not responding, and the connection has failed. To enable dead peer detection (DPD) and set the frequency with which either the AnyConnect client or the ASA gateway performs DPD, do the following: Before you begin This feature applies to connectivity between the ASA gateway and the AnyConnect SSL VPN Client only. It does not work with IPsec since DPD is based on the standards implementation that does not allow padding, and CLientless SSL VPN is not supported. If you enable DTLS, enable Dead Peer Detection (DPD) also. DPD enables a failed DTLS connection to fallback to TLS. Otherwise, the connection terminates.

   Source: Adapted from community discussion — red_sparrow_Gr

   References

   • Cisco documentation

   Next question

9. Question 69 · 189 in bank

   When troubleshooting FlexVPN spoke-to-spoke tunnels, what should be verified first?

   • ANHRP redirect is enabled on the hub.
   • BThe spokes have sent a resolution request.
   • CNHRP cache entries exist on the spoke.
   • DNHO routes exist on the spokes.

   Show answer

   Answer: A

   Explanation

   Spoke to spoke tunnel is not created - Traffic must flow from spoke to spoke via the hub to initiate a spoke to spoke tunnel. 1. Verify the hub configuration to check if NHRP redirect is enabled. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-mt/sec-flex-vpn-15-mt-book/sec-flex-spoke.html#reference_BDAD3107D7EB4AC898CA745ED5B3E063

   Source: Adapted from community discussion — pfrank

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

10. Question 70 · 189 in bank

    Users are getting untrusted server warnings when they connect to the URL https://asa.lab from their browsers. This URL resolves to 192.168.10.10, which is the IP address for a Cisco ASA configured for a clientless VPN. The VPN was recently set up and issued a certificate from an internal CA server. Users can connect to the VPN by ignoring the message, however, when users access other webservers that use certificates issued by the same internal CA server, they do not experience this issue. Which action resolves this issue?

    • AImport the CA that signed the certificate into the machine trusted root CA store.
    • BReissue the certificate with asa.lab in the subject alternative name field.
    • CImport the CA that signed the certificate into the user trusted root CA store.
    • DReissue the certificate with 192.168.10.10 in the subject common name field.

    Show answer

    Answer: B

    Explanation

    "B" is the correct answer here. Reissue the certificate with asa.lab in the Subject Alternative Name (SAN) field. Here's the reasoning: Subject Alternative Name (SAN): The SAN field in the certificate is used to specify additional host names for which the certificate is valid. If users are accessing the Cisco ASA via the URL https://asa.lab, the SAN field should include "asa.lab" to match the URL. This ensures that the certificate is valid for the specific host name users are using to access the VPN. Importing CA into Trusted Root CA Store: While importing the CA certificate into the user's trusted root CA store is a valid action in some scenarios, it might not directly address the issue with untrusted server warnings for the specific URL. Importing the CA certificate may be more relevant when users are experiencing issues with the CA chain and the trust of the CA itself. In this case, updating the certificate with the correct Subject Alternative Name (asa.lab) would be the more targeted and appropriate action to resolve the issue related to accessing the VPN URL.

    Source: Adapted from community discussion — kylesam2017

    References

    • Microsoft Learn
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-730 practice, question 61. 189 questions available.