Refer to the exhibit. An engineer is building an IKEv1 tunnel to a peer Cisco ASA, but the tunnel is failing. Based on the configuration in the exhibit, which action must be taken to allow the VPN tunnel to come up?

Enable IKEv1 on the outside interface.

Add a route for the 10.7.7.0/24 network to egress the outside interface.

Enable IKEv1 on the outside interface.

Change the IKEv1 policy number to be at least 256.

Change the transform set mode to transport.

An engineer has successfully established a Phase 1 and Phase 2 tunnel between two sites. Site A has internal subnet 192.168.0.0/24 and Site B has internal subnet 10.0.0.0/24. The engineer notices that no packets are decrypted at Site B.Pings to 192.168.0.1 from internal Site B devices make it to the Site B router, and the Site A router has incrementing encrypt and decrypt counters. What must be done to ensure bidirectional communication between both sites?

Allow protocol ESP or AH on the firewall in front of the Site B router.

Modify the routing at Site B so that traffic is sent to Site A.

Configure the correct DH group on both devices.

Allow protocol ESP or AH on the firewall in front of the Site B router.

Enable PFS on the headend device.

Refer to the exhibit. A Cisco ASA is configured as a client to a router running as a FlexVPN server. The router is configured with a virtual template to terminate FlexVPN clients. Traffic between networks 192.168.0.0/24 and 172.16.20.0/24 does not work as expected. Based on the show crypto ikev2 sa output collected from the Cisco ASA in the exhibit, what is the solution to this issue?

Modify the crypto ACL on the ASA to permit network 192.168.0.0/24 to network 172.16.20.0/24.

Modify the crypto ACL on the router to permit network 192.168.0.0/24 to network 172.16.20.0/24.

Modify the crypto ACL on the ASA to permit network 192.168.0.0/24 to network 172.16.20.0/24.

Modify the crypto ACL on the ASA to permit network 172.16.20.0/24 to network 192.168.0.0/24.

Modify the crypto ACL on the router to permit network 172.16.20.0/24 to network 192.168.0.0/24.

A user is trying to log in to a Cisco ASA using the clientless SSLVPN feature and receives the error message "clientless (browser) SSLVPN access is not allowed". Which step should the Cisco ASA administrator take to resolve this issue?

Validate that the correct license is in use on the ASA for WebVPN.

Enable the clientless VPN protocol on the group policy.

Validate that the correct license is in use on the ASA for WebVPN.

Increase the number of simultaneous logins allowed on the group policy.

Verify that a user account exists in the local AAA database for the user.

Over the weekend, an administrator upgraded the Cisco ASA image on the firewalls and noticed that users cannot connect to the headquarters site using Cisco AnyConnect. What is the solution for this issue?

Upgrade the Cisco AnyConnect client version to be compatible with the Cisco ASA software image.

Upgrade the Cisco AnyConnect Network Access module to be compatible with the Cisco ASA software image.

Upgrade the Cisco AnyConnect client driver to be compatible with the Cisco ASA software image.

Upgrade the Cisco AnyConnect Start Before Logon module to be compatible with the Cisco ASA software image.

Refer to the exhibit. The network administrator must allow the Cisco AnyConnect Secure Mobility Client to securely access the corporate resources via IKEv2 and print locally. Traffic that is destined for the Internet must still be tunneled to the Cisco AS

Split exclude policy with a deny for 192.168.0.3/32.

Which configuration does the administrator use to accomplish this goal?

Split exclude policy with a deny for 192.168.0.3/32.

Split exclude policy with a permit for 0.0.0.0/32.

Split include policy with a permit for 192.168.0.0/24.

An organization wants to distribute remote access VPN load across 12 VPN headend locations supporting 25,000 simultaneous users. Which load balancing method meets this requirement?

AnyConnect native load balancing

equal cost, multipath load balancing

What are two advantages of using GETVPN to traverse over the network between corporate offices?(Choose two.)

It is a highly scalable any to any mesh topology.

It has unique session keys for improved security.

It is a highly scalable any to any mesh topology.

It supports a hub-and-spoke topology.

Why must a network engineer avoid usage of the default X.509 certificate when implementing clientless SSLVPN on an ASA?

The certificate is regenerated at each reboot.

The certificate must be managed by the local CA.

The certificate is regenerated at each reboot.

The default X.509 certificate is not supported for SSLVPN.

The certificate is too weak to provide adequate security.

A router is being configured for IKEv2 AnyConnect using AnyConnect-EAP. How would the administrator separate profiles for administrators and employees so that authorization differs when they connect?

Define group-urls on the headend and create two XML profiles to match the administrator and user group urls

Define group aliases on the headend and have the user pick the appropriate alias when they connect

Define group-urls on the headend and create two XML profiles to match the administrator and user group urls

Create a certificate map and match on the appropriate certificate fields

Upgrade the Cisco AnyConnect Start Before Logon module to be compatible with the Cisco ASA software image.

A company is setting up a dynamic crypto map on the Cisco ASA at the headquarters to accept connections from the branch offices. There will be no IP subnet overlap between the branch offices, but the engineer does not know which encryption domains will be requested by the branch offices.Additionally, the company security policy states that routing protocol traffic should not leave the HQ network. Which solution should be used to route traffic back to the branches from the Cisco ASA with minimal administrative effort?

Configure Reverse Route Injection on the dynamic crypto map.

Configure a default route with the tunneled keyword on all branch routers.

Configure static routes for remote subnets.

Configure snapshot routing with EIGRP to send out of band routing updates.

A network engineer is implementing a FlexVPN tunnel between two Cisco IOS routers. The FlexVPN tunnels will terminate on encrypted traffic on an interface configured with an IP MTU of 1500, and the company has a security policy to drop fragmented traffic coming into or leaving the network. The tunnel will be used to transfer TFTP data between users and internal servers. When the TFTP traffic is not traversing a VPN, it can have a maximum IP packet size of 1500.Assuming the encrypted payload will add 90 bytes, which configuration allows TFTP traffic to traverse the FlexVPN tunnel without being dropped?

Set the tunnel tcp adjust-mss to 1360.

Set the tunnel tcp adjust-mss to 1460.

Set the tunnel tcp adjust-mss to 1360.

What are two differences between ECC and RSA? (Choose two.)

ECC can have the same security as RSA but with a shorter key size.

Key generation in ECC is faster and less CPU intensive than RSA.

Key generation in ECC is slower and more CPU intensive than RSA.

ECC can have the same security as RSA but with a shorter key size.

ECC cannot have the same security as RSA, even with an increased key size.

Key generation in ECC is faster and less CPU intensive than RSA.

ECC lags in performance when compared with RSA.

Refer to the exhibit. Which component must be configured on routers for a GETVPN deployment work properly?

PE3: Key Server – Customer 2 CEs: Group Members

Customer 1 CE1: Key Server – R1 and Customer 1 CE2: Group Members

R1: Key Server – Customer 1 CEs: Group Members

PE3: Key Server – all CEs: Group Members

Refer to the exhibit. An engineer is diagnosing an issue that occurred after a router at a branch site was assigned a new address. Based on the debugs, what must be done to resolve this issue?

Add the remote peer’s identity to the server’s IKEv2 profile.

Add the remote peer’s IP address to the server's IKEv2 keyring.

Ensure that the correct preshared keys are set on both sides.

Ensure that the UDP 500 packets between devices are not dropped.

Add the remote peer’s identity to the server’s IKEv2 profile.

The corporate network security policy requires that all internet and network traffic must be tunneled to the corporate office. Remote workers have been provided with printers to use locally at home while they are remotely connected to the corporate network. Which two steps must be executed to allow printing to the local printers? (Choose two.)

Check the Allow Local LAN access checkbox in the Cisco AnyConnect client.

Configure the split-tunnel-policy on the Cisco ASA to excludespecified.

Configure the split-tunnel-policy on the Cisco ASA to tunnelall.

Check the Allow Local LAN access checkbox in the Cisco AnyConnect client.

Add a persistent static route in the client OS for the local LAN network.

Configure the split-tunnel-policy on the Cisco ASA to excludespecified.

Configure the split-tunnel-policy on the Cisco ASA to tunnelspecified.

A TCP based application that should be accessible over the VPN tunnel is not working. Pings to the appropriate IP address are failing. Based on the output, what is a fix for this issue?

Add a route on the remote peer for 209.165.201.0/27.

Add a route on the local peer for 10.1.1.0/24.

Add a permit for TCP traffic going to 10.1.1.0/24.

Add a permit for TCP traffic going to 209.165.201.0/27.

When troubleshooting FlexVPN spoke-to-spoke tunnels, what should be verified first?

NHRP redirect is enabled on the hub.

The spokes have sent a resolution request.

NHRP cache entries exist on the spoke.

NHO routes exist on the spokes.

An engineer is building an IKEv1 tunnel to a peer Cisco ASA, but the tunnel is failing. Based on the configuration in the exhibit, which action must be taken to allow the VPN tunnel to come up?

Enable IKEv1 on the outside interface.

Add a route for the 10.7.7.0/24 network to egress the outside interface.

Enable IKEv1 on the outside interface.

Change the IKEv1 policy number to be at least 256.

Change the transform set mode to transport.

Refer to the exhibit. An engineer has configured two new VPN tunnels to 172.18.1.1 and 172.19.1.1. However, communication between 10.1.0.10 and 10.1.11.10 does not function. Which action should be taken to resolve this issue?

Adjust the network objects to match the appropriate subnets.

Remove and reapply the crypto map to the interface.

Insert routes for the 10.1.9.0/24 and 10.1.10.0/24 subnets.

Modify the transform set to use transport mode.

Adjust the network objects to match the appropriate subnets.

Refer to the exhibit.

Trust the issuing CA for the ASA identity certificate on the user's PC.

Enroll and import an SSL certificate with the CN value example.cisco.com on the ASA.

Trust the issuing CA for the ASA identity certificate on the user's PC.

Enroll and import an SSL certificate with the CN value example.cisco.com on the ASA.

Add the CN example.cisco.com to the AnyConnect XML certificate matching section.

Enable certificate authentication under the connection profile.

Add example.cisco.com to the server name list within the AnyConnect Local Policy.

A DMVPN spoke is configured with IKEv1 to secure the tunnel. Despite having a configuration similar to other working spokes, the tunnel is not coming up. Packet captures on the spoke show packets leaving the spoke router, but not making it to the hub router. Which solution resolves this issue?

Ensure that devices between the hub and spoke are not blocking ESP traffic.

Configure the spoke and hub to use the same IKE version.

Ensure that devices between the hub and spoke are not blocking ESP traffic.

Ensure that devices between the hub and spoke are not blocking GRE traffic.

Enable the tunnel interface with the no shutdown command.

Users are getting untrusted server warnings when they connect to the URL https://asa.lab from their browsers. This URL resolves to 192.168.10.10, which is the IP address for a Cisco ASA configured for a clientless VPN. The VPN was recently set up and issued a certificate from an internal CA server. Users can connect to the VPN by ignoring the message, however, when users access other webservers that use certificates issued by the same internal CA server, they do not experience this issue. Which action resolves this issue?

Reissue the certificate with asa.lab in the subject alternative name field.

Import the CA that signed the certificate into the machine trusted root CA store.

Reissue the certificate with asa.lab in the subject alternative name field.

Import the CA that signed the certificate into the user trusted root CA store.

Reissue the certificate with 192.168.10.10 in the subject common name field.

A network administrator is troubleshooting a FlexVPN tunnel. The hub router is unable to ping the spoke router's tunnel interface IP address of 192.168.1.2, even though the tunnel is showing up. The output of the debug ip packet CLI command on the hub router shows the following entry.IP: tableid=0123456789 s=192.168.1.1 (local), d=192.168.1.2 (loopback2), routed via FIB.What must be configured to fix this issue?

An IKEv2 authorization policy must be configured on the spoke router to advertise the interface route.

A matching IKEv2 pre-shared key on the hub and spoke routers in the crypto keyring configuration.

An outbound ACL on the dynamic VTI of the hub router that allows ICMP traffic to 192.168.1.2.

An IKEv2 authorization policy must be configured on the spoke router to advertise the interface route.

A route map must be configured on hub router to set the next hop for 192.168.1.2 to the dynamic VTI.

Refer to the exhibit. A network administrator is setting up a phone VPN on a Cisco AS

Configure the Cisco ASA to present an RSA certificate to the phone for authentication.

The phone cannot connect and the error is presented in a debug on the Cisco ASA. Which action fixes this issue?

Enable web-deploy of the posture module so that the module can be downloaded from the Cisco ASA to an IP phone.

Configure the Cisco ASA to present an RSA certificate to the phone for authentication.

Disable Cisco Secure Desktop under the connection profile VPNPhone.

Install the posture module on the Cisco ASA.

Cisco 300-730 Practice Test 4 - Free Online Exam Prep & Questions

Which DMVPN feature allows spokes to be deployed with dynamically assigned public IP addresses?

Become a Premium Member for full access

Unlock Premium Member

Cisco 300-730 Practice Test 4

Question

Cisco 300-730 Practice Tests

Practice Tests