Cisco Implementing Secure Solutions with Virtual Private Networks

QUESTION NO: 1
What is the purpose of a web-type access control list in a Clientless SSL VPN configuration?

A. It manages and restricts user access to specific web resources. B. It logs user activities for compliance and monitoring. C. It authenticates users based on their credentials. D. It encrypts and decrypts the data traffic passing through the VPN.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
Refer to the exhibit. An IPsec Cisco AnyConnect client is failing to connect and generates these debugs every time a connection to an IOS headend is attempted. Which action resolves this issue?

A. Correct the DH group setting. B. Correct the integrity setting. C. Correct the encryption setting. D. Correct the PFS setting.

Correct Answer: A

QUESTION NO: 3
After a network security administrator configures site-to-site IPsec VPN peer, they receive this error message:
1d00h: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Main Mode failed with peer at 150.150.150.1.
What is the solution to this problem?

A. Crypto map must be applied to correct interface. B. ISAKMP policy must match between sites. C. Transport set must match between sites. D. IPsec policy must match between sites.

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
Refer to the exhibit. Which two conclusions should be drawn from the DMVPN phase 2 configuration? (Choose two.)

A. EIGRP is used as the dynamic routing protocol. B. Next-hop-self is required. C. EIGRP neighbor adjacency will fail. D. Spoke-to-spoke communication is allowed. E. EIGRP route redistribution is not allowed.

Correct Answer: A,D

QUESTION NO: 5
What action does the hub take when it receives a NHRP resolution request from a spoke for a network that exists behind another spoke?

A. The hub waits for the second spoke to send a request so that it can respond to both spokes. B. The hub sends back a resolution reply to the requesting spoke. C. The hub forwards the request to the destination spoke. D. The hub updates its own NHRP mapping.

Correct Answer: C

QUESTION NO: 6
Refer to the exhibit. An engineer is building an IKEv1 tunnel to a peer Cisco ASA, but the tunnel is failing. Based on the configuration in the exhibit, which action must be taken to allow the VPN tunnel to come up?

A. Enable IKEv1 on the outside interface. B. Add a route for the 10.7.7.0/24 network to egress the outside interface. C. Change the transform set mode to transport. D. Change the IKEv1 policy number to be at least 256.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
An engineer is configuring clientless SSL VPN. The finance department has a database server that only they should access, but the sales department can currently access it. The finance and the sales departments are configured as separate group-policies. What must be added to the configuration to make sure the users in the sales department cannot access the finance department server?

A. smart tunnel B. webtype ACL C. port forwarding D. tunnel group lock

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
Which two remote access VPN solutions support SSL? (Choose two.)

A. Cisco AnyConnect B. EZVPN C. clientless D. FlexVPN E. L2TP

Correct Answer: A,C

QUESTION NO: 9
Refer to the exhibit. An administrator had the above configuration working with SSL protocol, but as soon as the administrator specified IPsec as the primary protocol, the Cisco AnyConnect client was not able to connect. What is the problem?

A. A new XML profile should be created instead of modifying the existing profile, so that the clients force the update. B. If you specify the primary protocol as IPsec, the User Group must be the exact name of the connection profile (tunnel group). C. The Cisco AnyConnect implementation does not allow the two group URLs to be the same.
SSL does allow this. D. IPsec will not work in conjunction with a group URL.

Correct Answer: B

QUESTION NO: 10
Which technology and VPN component allows a VPN headend to dynamically learn post NAT IP addresses of remote routers at different sites?

A. DMVPN with ISAKMP B. GETVPN with ISAKMP C. GETVPN with NHRP D. DMVPN with NHRP

Correct Answer: D

QUESTION NO: 11
What are two advantages of using GETVPN to traverse over the network between corporate offices? (Choose two.)

A. It is a highly scalable any to any mesh topology. B. It has QoS support. C. It supports multicast. D. It supports a hub-and-spoke topology. E. It has unique session keys for improved security.

Correct Answer: A,C

Cisco Implementing Secure Solutions with Virtual Private Networks - 300-730 Exam Questions