Which statement about GETVPN is true?

The configuration that defines which traffic to encrypt originates from the key server.

TEK rekeys can be load-balanced between two key servers operating in COOP.

The pseudotime that is used for replay checking is synchronized via NTP.

Group members must acknowledge all KEK and TEK rekeys, regardless of configuration.

Which two changes must be made in order to migrate from DMVPN Phase 2 to Phase 3 when EIGRP is configured? (Choose two.)

Enable EIGRP next-hop-self on the hub.

Add NHRP redirects on the spoke.

Disable EIGRP next-hop-self on the hub.

Enable EIGRP next-hop-self on the hub.

Refer to the exhibit. A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which action brings up the VPN tunnel?

Increase the maximum in-negotiation SA limit on the local Cisco ASA.

Reduce the maximum SA limit on the local Cisco ASA.

Increase the maximum in-negotiation SA limit on the local Cisco ASA.

Remove the maximum SA limit on the remote Cisco ASA.

Correct the crypto access list on both Cisco ASA devices.

Which command identifies a Cisco AnyConnect profile that was uploaded to the flash of an IOS router?

crypto vpn anyconnect profile SSL_profile flash:simos-profile.xml

svc import profile SSL_profile flash:simos-profile.xml

anyconnect profile SSL_profile flash:simos-profile.xml

crypto vpn anyconnect profile SSL_profile flash:simos-profile.xml

webvpn import profile SSL_profile flash:simos-profile.xml

Refer to the exhibit. What is configured as a result of this command set?

FlexVPN server for an IPv6 dVTI session

FlexVPN client profile for IPv6

FlexVPN server to authorize groups by using an IPv6 external AAA

FlexVPN server for an IPv6 dVTI session

FlexVPN server to authenticate IPv6 peers by using EAP

Which configuration construct must be used in a FlexVPN tunnel?

multipoint GRE tunnel interface

Which two features provide headend resiliency for Cisco AnyConnect clients? (Choose two.)

AnyConnect Network Access Manager

Cisco AnyConnect Secure Mobility Client has been configured to use IKEv2 for one group of users and SSL for another group. When the administrator configures a new AnyConnect release on the Cisco ASA, the IKEv2 users cannot download it automatically when they connect. What might be the problem?

Client services are not enabled.

The XML profile is not configured correctly for the affected users.

The new client image does not use the same major release as the current one.

Client services are not enabled.

Client software updates are not supported with IKEv2.

Under which section must a bookmark or URL list be configured on a Cisco ASA to be available for clientless SSLVPN users?

tunnel-group (general-attributes)

tunnel-group (webvpn-attributes)

Refer to the exhibit. Based on the exhibit, why are users unable to access CCNP Webserver bookmark?

The ASA cannot resolve the URL.

The URL is being blocked by a WebACL.

The ASA cannot resolve the URL.

The bookmark has been disabled.

The user cannot access the URL.

Which two statements about the Cisco ASA Clientless SSL VPN solution are true? (Choose two.)

A Cisco ASA can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions.

When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resourcesthrough the URL bar, the ASA uses its configured DNS servers to perform FQDN resolution.

When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resourcesthrough the URL bar, the client uses the local DNS to perform FQDN resolution.

The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default.

A Cisco ASA can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions.

When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resourcesthrough the URL bar, the ASA uses its configured DNS servers to perform FQDN resolution.

Clientless SSLVPN provides Layer 3 connectivity into the secured network.

Refer to the exhibit. Which two commands under the tunnel-group webvpn-attributes result in a Cisco AnyConnect user receiving the AnyConnect prompt in the exhibit? (Choose two.)

group-url https://172.16.31.10/General enable

Which requirement is needed to use local authentication for Cisco AnyConnect Secure Mobility Clients that connect to a FlexVPN server?

use of certificates instead of username and password

Refer to the exhibit. An engineer is troubleshooting a new GRE over IPsec tunnel. The tunnel is established but the engineer cannot ping from spoke 1 to spoke 2. Which type of traffic is being blocked?

ESP packets from spoke2 to spoke1

ISAKMP packets from spoke2 to spoke1

ESP packets from spoke1 to spoke2

ISAKMP packets from spoke1 to spoke2

In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form. Which troubleshooting step solves the issue?

Verify that the spoke receives redirect messages and sends resolution requests.

Verify the spoke configuration to check if the NHRP redirect is enabled.

Verify that the spoke receives redirect messages and sends resolution requests.

Verify the hub configuration to check if the NHRP shortcut is enabled.

Verify that the tunnel interface is contained within a VRF.

An engineer is troubleshooting a new DMVPN setup on a Cisco IOS router. After the show crypto isakmp sa command is issued, a response is returned of "MM_NO_STATE." Why does this failure occur?

The Phase 1 policy does not match on both devices.

The ISAKMP policy priority values are invalid.

The Phase 1 policy does not match on both devices.

Tunnel protection is not applied to the DMVPN tunnel.

Refer to the exhibit. The customer can establish a Cisco AnyConnect connection without using an XML profile. When the host "ikev2" is selected in the AnyConnect drop down, the connection fails. What is the cause of this issue?

UserGroup must match connection profile.

Primary protocol should be SSL.

UserGroup must match connection profile.

Refer to the exhibit. A site-to-site tunnel between two sites is not coming up. Based on the debugs, what is the cause of this issue?

UDP 4500 traffic from the peer does not reach the router.

An authentication failure occurs on the remote peer.

A certificate fragmentation issue occurs between both sides.

UDP 4500 traffic from the peer does not reach the router.

An authentication failure occurs on the router.

Refer to the exhibit. What is a result of this configuration?

Spoke 1 fails the authentication because the authentication methods are incorrect.

Spoke 2 passes the authentication to the hub and successfully proceeds to phase 2.

Spoke 2 fails the authentication because the remote authentication method is incorrect.

Spoke 1 passes the authentication to the hub and successfully proceeds to phase 2.

Refer to the exhibit. Client 1 cannot communicate with client 2. Both clients are using Cisco AnyConnect and have established a successful SSL VPN connection to the hub AS

Which command on the ASA is missing?

same-security-traffic permit intra-interface

same-security-traffic permit inter-interface

Cisco 300-730 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

A second set of traffic selectors is negotiated between two peers using IKEv2. Which IKEv2 packet will contain details of the exchange?

IKEv2 IKE_SA_INIT

IKEv2 INFORMATIONAL

IKEv2 CREATE_CHILD_SA

IKEv2 IKE_AUTH

Comment (0)

Cisco 300-730 Practice Test 1

Question

Cisco 300-730 Practice Tests

Practice Tests