Refer to the exhibit. Which two conclusions should be drawn from the DMVPN phase 2 configuration? (Choose two.)

EIGRP is used as the dynamic routing protocol.

Spoke-to-spoke communication is allowed.

EIGRP neighbor adjacency will fail.

EIGRP is used as the dynamic routing protocol.

EIGRP route redistribution is not allowed.

Spoke-to-spoke communication is allowed.

Refer to the exhibit. The VPN tunnel between the FlexVPN spoke and FlexVPN hub 192.168.0.12 is failing. What should be done to correct this issue?

Add the aaa authorization group psk list Flex_AAA Flex_Auth command to the IKEv2 profile configuration.

Add the address 192.168.0.12 255.255.255.255 command to the keyring configuration.

Add the match fvrf any command to the IKEv2 policy.

Add the aaa authorization group psk list Flex_AAA Flex_Auth command to the IKEv2 profile configuration.

Add the tunnel mode gre ip command to the tunnel configuration.

Refer to the exhibit. An IKEv2 site-to-site tunnel between an ASA and a remote peer is not building successfully. What will fix the problem based on the debug output?

Correct crypto access list on both VPN devices.

Ensure crypto IPsec policy matches on both VPN devices.

Install the correct certificate to validate the peer.

Correct crypto access list on both VPN devices.

Specify the peer IP address in the tunnel group name.

Refer to the exhibit. A network engineer is reconfiguring clientless SSLVPN during a maintenance window, and after testing the new configuration, is unable to establish the connection. What must be done to remediate this problem?

Enable clientless protocol under the group policy.

Enable client services on the outside interface.

Enable clientless protocol under the group policy.

Enable DTLS under the group policy.

Enable auto sign-on for the user’s IP address.

What are two purposes of the key server in Cisco IOS GETVPN? (Choose two.)

to maintain encryption policies

to distribute routing information

In order to enable FlexVPN to use a AAA attribute list, which two tasks must be performed? (Choose two.)

Verify that clients are using the correct authorization policy.

Assign the list to an authorization policy.

Verify that clients are using the correct authorization policy.

Assign the list to an authorization policy.

An engineer must configure remote desktop connectivity for offsite admins via clientless SSL VPN, configured on a Cisco ASA to Windows Vista workstations. Which two configurations provide the requested access? (Choose two.)

RDP2 bookmark via the RDP2 plugin

VNC bookmark via the VNC plugin

Telnet bookmark via the Telnet plugin

RDP2 bookmark via the RDP2 plugin

VNC bookmark via the VNC plugin

Citrix bookmark via the ICA plugin

SSH bookmark via the SSH plugin

A network engineer must design a clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was found that one website is not being rewritten correctly by the AS

Set up a smart tunnel with the IP address of the web server.

What is a potential solution for this issue while still allowing it to be a clientless VPN setup?

Set up a smart tunnel with the IP address of the web server.

Set up a NAT rule that translates the ASA public address to the web server private address on port 80.

Set up Cisco AnyConnect with a split tunnel that has the IP address of the web server.

Set up a WebACL to permit the IP address of the web server.

A network engineer is setting up a clientless SSLVPN on a Cisco AS

Remote users must be able to access an internal webserver via the URL example.com. Which two steps accomplish this task? (Choose two.)

Configure routing so that the user's computer can reach the webserver.

Remote users must be able to access an internal webserver via the URL example.com. Which two steps accomplish this task? (Choose two.)

Configure a bookmark for the webserver.

Configure routing so that the user's computer can reach the webserver.

Configure a DNS server that can resolve the webserver URL.

Configure a browser plugin on the Cisco ASA.

Configure routing so that the Cisco ASA can reach the webserver.

A network engineer has set up a FlexVPN server to terminate multiple FlexVPN clients. The VPN tunnels are established without issue. However, when a Change of Authorization is issued by the RADIUS server, the FlexVPN server does not update the authorization of connected FlexVPN clients.Which action resolves this issue?

Add the aaa server radius dynamic-author command on the FlexVPN server.

Add the aaa server radius dynamic-author command on the FlexVPN clients.

Fix the RADIUS key mismatch between the RADIUS server and FlexVPN server.

Add the aaa server radius dynamic-author command on the FlexVPN server.

Fix the RADIUS key mismatch between the RADIUS server and FlexVPN clients.

A company needs to ensure only corporate issued laptops and devices are allowed to connect with the Cisco AnyConnect client. The solution should be applicable to multiple operating systems, including Windows, MacOS, and Linux, and should allow for remote remediation if a corporate issued device is stolen. Which solution should be used to accomplish these goals?

Use a DAP registry check on the system to determine the relationship with the corporate domain.

Use a DAP file check on the system to determine the relationship with the corporate domain.

Install and authenticate user certificates on the corporate devices.

Install and authenticate machine certificates on the corporate devices

A DMVPN spoke router tunnel is up and passing traffic, but it cannot establish an EIGRP neighbor relationship with the hub router. Which solution resolves this issue?

Configure the dynamic NHRP multicast map on the hub tunnel interface.

Enable EIGRP Split Horizon on the hub tunnel interface.

Remove the EIGRP stub configuration on the spoke tunnel interface.

Enable the EIGRP next hop self feature on the hub tunnel interface.

Configure the dynamic NHRP multicast map on the hub tunnel interface.

Refer to the exhibit. An IPsec Cisco AnyConnect client is failing to connect and generates these debugs every time a connection to an IOS headend is attempted. Which action resolves this issue?

Correct the encryption setting.

Refer to the exhibit. An engineer must allow Cisco AnyConnect users to access the outside interface using protocol UDP 500/4500. In addition, these clients must be able to establish an SSL connection to update Cisco AnyConnect software over the same connection. Which two actions must be taken to achieve this goal? (Choose two.)

IPsec (IKEv2) Allow Access must be checked on the outside interface.

IPsec (IKEv2) Enable Client Services must be checked on the outside interface.

IPsec (IKEv2) Allow Access must be checked on the outside interface.

SSL Enable DTLS must be checked on the outside interface.

Bypass interface access lists for inbound VPN sessions must be unchecked.

IPsec (IKEv2) Enable Client Services must be checked on the outside interface.

SSL Allow Access must be checked on the outside interface.

A user at a company HQ is having trouble accessing a network share at a branch site that is connected with a L2L IPsec VPN. While troubleshooting, a network security engineer runs a packet tracer on the Cisco ASA to simulate the user traffic and discovers that the encryption counter is increasing but the decryption counter is not. What must be configured to correct this issue?

Adjust the routing on the remote peer device to direct traffic back over the tunnel.

Adjust the preshared key on the remote peer to allow traffic to flow over the tunnel.

Adjust the transform set to allow bidirectional traffic.

Adjust the peer IP address on the remote peer to direct traffic back to the ASA.

A user is experiencing delays on audio calls over a Cisco AnyConnect VPN. Which implementation step resolves this issue?

Shorten the encryption key lifetime.

Install the Cisco AnyConnect 2.3 client for the user to download.

Users cannot log in to a Cisco ASA using clientless SSLVPN. Troubleshooting reveals the error message "WebVPN session terminated: Client type not supported". Which step does the administrator take to resolve this issue?

Enable the clientless VPN protocol on the group policy.

Enable the Cisco AnyConnect premium license on the Cisco ASA.

Have the user upgrade to a supported browser.

Increase the simultaneous logins on the group policy.

Enable the clientless VPN protocol on the group policy.

Refer to the exhibit. VPN tunnels between a spoke and two DMVPN hubs are not coming up. The network administrator has verified that the encryption, hashing, and DH group proposals for Phase 1 and Phase 2 match on both ends. What is the solution to this issue?

Ensure bidirectional UDP 500/4500 traffic.

Increase the isakmp phase 1 lifetime.

Add NAT statements for VPN traffic.

Enable shared tunnel protection.

A network engineer is configuring a server. The router will terminate encrypted VPN connections on g0/0, which is in the VRF "Internet". The clear-text traffic that must be encrypted before being sent out traverses g0/1, which is in the VRF"Internal". Which two VRF-specific configurations allow VPN traffic to traverse the VRF-aware interfaces? (Choose two.)

Under the IKEv2 profile, add the match fvrf Internet command.

Under the virtual-template interface, add the tunnel vrf Internet command.

Under the IKEv2 profile, add the ivrf Internal command.

Under the virtual-template interface, add the ip vrf forwarding Internet command.

Under the IKEv2 profile, add the match fvrf Internal command.

Under the IKEv2 profile, add the match fvrf Internet command.

Under the virtual-template interface, add the tunnel vrf Internet command.

What is a characteristic of GETVPN?

All peers have one IPsec SPI for inbound and outbound communication.

An ACL that defines interesting traffic must be configured and applied to the crypto map.

Quick mode is used to create an IPsec SA.

The remote peer for the IPsec session is configured as part of the crypto map.

All peers have one IPsec SPI for inbound and outbound communication.

Refer to the exhibit. Users cannot connect via AnyConnect SSLVPN. Which action resolves this issue?

Add ssl-client to the allowed list of VPN protocols.

Configure the ASA to act as a DHCP server.

Configure the HTTP server to listen on port 443.

Add an IPsec preshared key to the group policy.

Add ssl-client to the allowed list of VPN protocols.

A network engineer is installing Cisco AnyConnect on company laptops so that users can access corporate resources remotely. The VPN concentrator is a Cisco router running IOS-XE 16.9.1 code and configured as a FlexVPN server that uses local authentication and *$Cisc431089017$* as the key-id for the IKEv2 profile. Which two steps must be taken on the computer to allow a successful AnyConnect connection to the router? (Choose two.)

In the Cisco AnyConnect XML profile, add the hostname and host address to the server list.

In the Cisco AnyConnect Local Policy, add the router IP address to the Update Policy.

In the Cisco AnyConnect XML profile, set the IPsec Authentication method to EAP-AnyConnect.

In the Cisco AnyConnect XML profile, add the hostname and host address to the server list.

In the Cisco AnyConnect XML profile, set the user group field to DefaultAnyConnectClientGroup.

In the Cisco AnyConnect Local Policy, set the BypassDownloader option in the local to true.

In the Cisco AnyConnect Local Policy, add the router IP address to the Update Policy.

A network engineer is setting up Cisco AnyConnect 4.9 on a Cisco ASA running ASA software 9.1.Cisco AnyConnect must connect to the Cisco ASA before the user logs on so that login scripts can work successfully. In addition, the VPN must connect without user intervention. Which two key steps accomplish this task? (Choose two.)

Create a Cisco AnyConnect VPN profile with Start Before Logon set to true.

Issue an identity certificate to the trusted root CA folder in the machine store.

Create a Network Access Manager profile with a client policy set to connect before user logon.

Create a Cisco AnyConnect VPN profile with Start Before Logon set to true.

Issue an identity certificate to the trusted root CA folder in the machine store.

Create a Cisco AnyConnect VPN profile with Always On set to true.

Create a Cisco Anyconnect VPN Management Tunnel profile.

A network engineer has almost finished setting up a clientless VPN that allows remote users to access internal HTTP servers. Users must enter their username and password twice: once on the clientless VPN web portal and again to log in to internal HTTP servers. The Cisco ASA and the HTTP servers use the same Active Directory server to authenticate users. Which next step must be taken to allow users to enter their password only once?

Configure auto-sign-on using NTLM authentication.

Use LDAPS and add password management to the clientless tunnel group.

Configure auto-sign-on using NTLM authentication.

Set up the Cisco ASA to authenticate users via a SAML 2.0 IDP.

Create smart tunnels for the HTTP servers.

What must be configured in a FlexVPN deployment to allow for direct communication between spokes connected to different hubs?

A GRE tunnel must exist between hub routers.

EIGRP must be used as routing protocol.

Hub routers must be on same Layer 2 network.

Load balancing must be disabled.

A GRE tunnel must exist between hub routers.

Refer to the exhibit. An engineer has configured a spoke to connect to a FlexVPN hub. The tunnel is up, but pings fail when the engineer attempts to reach host 192.168.200.10 behind the spoke, and traffic is sourced from host 192.168.100.3, which is behind the FlexVPN server. Based on packet captures, the engineer discovers that host 192.168.200.10 receives the icmp echo and sends an icmp reply that makes it to the inside interface of the spoke. Based on the output in the exhibit captured on the spoke by the engineer, which action resolves this issue?

Add the route set remote ipv4 192.168.100.0 255.255.255.0 command to the spoke authorization policy.

Add the aaa authorization group cert list default default command to the spoke ikev2 profile.

Add the route set remote ipv4 192.168.200.0 255.255.255.0 command to the hub authorization policy.

Add the aaa authorization group cert list default default command to the hub ikev2 profile.

Add the route set remote ipv4 192.168.100.0 255.255.255.0 command to the spoke authorization policy.

Cisco 300-730 Practice Test 3 - Free Online Exam Prep & Questions

Which VPN technology must be used to ensure that routers are able to dynamically form connections with each other rather than sending traffic through a hub and be able to advertise routes without the use of a dynamic routing protocol?

Become a Premium Member for full access

Unlock Premium Member

Cisco 300-730 Practice Test 3

Question

Cisco 300-730 Practice Tests

Practice Tests