300-730 practice questions 81–90

1. Question 81 · 189 in bank

   Select 2

   A Cisco IOS router is reconfigured to connect to an additional DMVPN hub that is a part of a different DMVPN phase 3 cloud. After this change was made, users begin to experience problems accessing corporate resources over both tunnels. Before the additional tunnel was created, users could access resources over the first tunnel without any issues. Both tunnels terminate on the same interface of the router and use the same IPsec proposals. Which two actions resolve the issue without affecting spoke-to-spoke traffic in either DMVPN cloud? (Choose two.)

   • AEnable dead peer detection for both tunnels.
   • BUse the same shared IPsec profile for both tunnels.
   • CConfigure the same NHRP network IDs for both tunnels.
   • DSpecify the tunnel destination in each tunnel.
   • EAssign a unique tunnel key to each tunnel.

   Show answer

   Answer: BD

   Explanation

   "D and E" are the correct answer selections here: To resolve the issue without affecting spoke-to-spoke traffic in either DMVPN cloud when connecting to an additional DMVPN hub that is part of a different DMVPN phase 3 cloud, the recommended action is: Specify the tunnel destination in each tunnel and assign a unique tunnel key to each tunnel. This approach ensures that each DMVPN tunnel has a unique tunnel destination and a unique tunnel key, preventing conflicts between the two DMVPN clouds. It allows the router to distinguish between the two tunnels and correctly route traffic to the respective hubs. Using the same shared IPsec profile for both tunnels and specifying the tunnel destination in each tunnel might not be sufficient to prevent conflicts in this scenario. Assigning unique tunnel keys is crucial to maintaining the separation of the tunnels. Therefore, the correct option is to specify the tunnel destination in each tunnel and to assign a unique tunnel key to each tunnel.

   Source: Adapted from community discussion — kylesam2017

   References

   • Cisco documentation

   Next question

2. Question 82 · 189 in bank

   

   Refer to the exhibit. Which action must be taken on the IPsec tunnel configuration to resolve the issue?

   • AThe access lists on each peer must mirror each other.
   • BThe transform set on each peer must match.
   • CThe access lists on each peer must be identical.
   • DThe transform set on each peer must be compatible.

   Show answer

   Answer: A

   Explanation

   Proxy identities not supported means the access-lists that you are using for the interesting traffic doesn't actually match or if they do, I suspect your https://community.cisco.com/t5/other-security-subjects/proxy-identities-not-supported/td-p/97264

   Source: Adapted from community discussion — Egidijus

   References

   • cisco.com documentation

   Next question

3. Question 83 · 189 in bank

   

   Refer to the exhibit. The network security engineer identified that the hub router cannot send traffic to the spoke router. Based on the provided output, which action resolves the issue?

   • APermit UDP ports 500 and 4500 between the hub and spoke.
   • BCorrect the next hop server IP address on the spoke router.
   • CEnsure the preshared key on the hub-and-spoke router matches.
   • DAdjust the ip nhrp network-id command on the hub router.

   Show answer

   Answer: B

   Explanation

   Only B is left. A. Permit UDP ports 500 and 4500 between the hub and spoke. (Wrong Answer. We have an IPSEC SA. B. Correct the next hop server IP address on the spoke router. C. Ensure the preshared key on the hub-and-spoke router matches. (Wrong answer, we have an IPSEC SA) D. Adjust the ip nhrp network-id command on the hub router. (Wrong answer, NETWORK-ID are locally significant.)

   Source: Adapted from community discussion — ed81044

   Next question

4. Question 84 · 189 in bank

   An administrator is deciding which authentication protocol should be implemented for their upcoming Cisco AnyConnect deployment. A list of the security requirements from upper management are: the ability to force AnyConnect users to use complex passwords such as C1$c0451035084!, warn users a few days before their password expires, and allow users to change their password during a remote access session. Which authentication protocol must be used to meet these requirements?

   • ALDAPS
   • BRADIUS
   • CKerberos
   • DTACACS+

   Show answer

   Answer: A

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

5. Question 85 · 189 in bank

   An engineer is implementing a failover solution for a FlexVPN client site where ESP traffic to the primary FlexVPN server is blocked intermittently after tunnel establishment. This issue causes users at the branch site to lose access to the corporate network. The solution must quickly establish a tunnel and send traffic to the secondary FlexVPN server only during a failover event. Which action must the engineer take to implement this solution?

   • ACreate one tunnel with peer statements to each server and use Dead Peer Detection to track the status or the primary server.
   • BCreate two tunnels for each FlexVPN server and use the tunnel keepalive command to track the status of each FlexVPN server.
   • CCreate one tunnel with peer statements to each server and use object tracking to track the status of the primary server.
   • DCreate two tunnels for each FlexVPN server and use a dynamic routing protocol to track the status or each FlexVPN server.

   Show answer

   Answer: C

   References

   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 86 · 189 in bank

   Cisco AnyConnect Secure Mobility Client has been configured to use IKEv2 for one group of users and SSL for another group. When the administrator configures a new AnyConnect release on the Cisco ASA, the IKEv2 users cannot download it automatically when they connect. What might be the problem?

   • AThe XML profile is not configured correctly for the affected users.
   • BThe new client image does not use the same major release as the current one.
   • CClient services are not enabled.
   • DClient software updates are not supported with IKEv2.

   Show answer

   Answer: C

   Explanation

   "D" seems to be the correct answer here. The problem that might prevent IKEv2 users from automatically downloading a new AnyConnect release when they connect to the Cisco ASA is that client software updates are not supported with IKEv2. Client software updates are a feature that allows the Cisco ASA to push new AnyConnect software releases to the connected clients automatically. However, this feature is only supported for SSL VPN connections and not for IKEv2 VPN connections. As per the given scenario, where IKEv2 is being used for one group of users and SSL for another group, the IKEv2 users will not have the capability to automatically download a new AnyConnect release when they connect. This is because client software updates are specifically designed for SSL VPN connections and are not supported with IKEv2. Therefore, the problem lies in the fact that client software updates are not supported with IKEv2, rather than the client services not being enabled.

   Source: Adapted from community discussion — kylesam2017

   References

   • cisco.com documentation
   • cisco.com documentation

   Next question

7. Question 87 · 189 in bank

   

   Refer to the exhibit. A company has been using SAML to authenticate their clientless SSLVPN users. After about a year of uptime in production, users begin to experience issues authenticating. Based on the collected debugs, which action resolves the issue?

   • AIncrease the SAML Request Timeout value on the ASA.
   • BVerify that the IdP is using the SAML-attribute NameID.
   • CEnsure that the ASA and IdP are synchronized to a NTP server.
   • DReplace the expired IdP signing certificate with a valid one.

   Show answer

   Answer: D

   Next question

8. Question 88 · 189 in bank

   

   Refer to the exhibit. Based on this ASDM output, which remote access technologies are allowed on the ASA?

   • ASSLAnyConnect VPN
   • BIKEv2 and SSL AnyConnect VPN
   • CSSL clientless VPN
   • DIKEv2 AnyConnect VPN

   Show answer

   Answer: D

   Next question

9. Question 89 · 189 in bank

   Which Diffie Hellman group should be used when ECDH is required in a VPN configuration?

   • A24
   • B19
   • C16
   • D15

   Show answer

   Answer: B

   Explanation

   "B" is correct. Explanation: In the context of VPN configurations, especially when using ECDH (Elliptic Curve Diffie-Hellman), the specific Diffie-Hellman (DH) group numbers may vary depending on the implementation or device. However, in common VPN standards like IKEv2 (Internet Key Exchange version 2), the Diffie-Hellman group numbers for ECDH are standardized. For ECDH, the Diffie-Hellman group number is typically represented as "Group 19" or "Group 256." The number 19 corresponds to the elliptic curve group called ECP-256, which uses a 256-bit key. Therefore, the correct choice for ECDH in a VPN configuration is often referred to as Group 19 or Group 256. Both representations can be used interchangeably. Always refer to your specific VPN device documentation or configuration settings to ensure compatibility and accurate representation of the Diffie-Hellman group when implementing ECDH in your VPN setup.

   Source: Adapted from community discussion — kylesam2017

   References

   • Cisco documentation
   • cisco.com documentation

   Next question

10. Question 90 · 189 in bank

    On an ASA with multiple connection profiles for different departments, what is the best design to ensure that AnyConnect users are assigned the correct connection profile based on their department and do not have the ability to choose a different connection profile?

    • Agroup URL
    • Bgroup alias
    • Cdynamic access policy
    • Dcertificate mapping

    Show answer

    Answer: D

    Explanation

    D is the correct option so user is not able to choose the connection profile. A is not the correct answer since client is able to enter any group-URL and connect to different profiles

    Source: Adapted from community discussion — mlv_2023

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-730 practice, question 81. 189 questions available.