Download 300-730 Study Questions To Pass Implementing Secure Solutions with Virtual Private Networks (SVPN)

Jonnie Karnath2023-04-26T14:57:46+00:00

To pass the Implementing Secure Solutions with Virtual Private Networks (SVPN) exam, candidates need to have a deep understanding of these topics and be able to apply their knowledge to real-world scenarios. Our 300-730 study questions will help you develop a strong understanding of the exam’s content and format, giving you the confidence you need to tackle any question that comes your way. Our 300-730 study questions will help you identify any knowledge gaps or weak areas in your exam preparation, so you can focus your study efforts on the areas that need improvement. By using our 300-730 study questions, you will be fully prepared to pass the exam with flying colors and achieve your certification goals.

Page 1 of 5

1. Refer to the exhibit.

A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices.

Based on the syslog message, which action brings up the VPN tunnel?

Reduce the maximum SA limit on the local Cisco AS

Increase the maximum in-negotiation SA limit on the local Cisco AS

Remove the maximum SA limit on the remote Cisco AS

Correct the crypto access list on both Cisco ASA devices.

2. In order to enable FlexVPN to use a AAA attribute list, which two tasks must be performed? (Choose two.)

Define the RADIUS server.

Verify that clients are using the correct authorization policy.

Define the AAA server.

Assign the list to an authorization policy.

Set the maximum segment size.

3. A company is setting up a dynamic crypto map on the Cisco ASA at the headquarters to accept connections from the branch offices. There will be no IP subnet overlap between the branch offices, but the engineer does not know which encryption domains will be requested by the branch offices. Additionally, the company security policy states that routing protocol traffic should not leave the HQ network.

Which solution should be used to route traffic back to the branches from the Cisco ASA with minimal administrative effort?

Configure Reverse Route Injection on the dynamic crypto map.

Configure a default route with the tunneled keyword on all branch routers.

Configure static routes for remote subnets.

Configure snapshot routing with EIGRP to send out of band routing updates.

4. An engineer is troubleshooting a new DMVPN setup on a Cisco IOS router. After the show crypto isakmp sa command is issued, a response is returned of "MM_NO_STATE."

Why does this failure occur?

The ISAKMP policy priority values are invalid.

ESP traffic is being dropped.

The Phase 1 policy does not match on both devices.

Tunnel protection is not applied to the DMVPN tunnel.

5. What is a requirement for smart tunnels to function properly?

Java or ActiveX must be enabled on the client machine.

Applications must be UD

Stateful failover must not be configured.

The user on the client machine must have admin access.

6. Refer to the exhibit.

Based on the configuration output, what is the VPN technology?

site-to-site

DMVPN

L2VPN

multicast VPN

7. When a FlexVPN is configured, which two components must be configured for IKEv2? (Choose two.)

method

profile

proposal

preference

persistence

8. A user is trying to log in to a Cisco ASA using the clientless SSLVPN feature and receives the error message "clientless (browser) SSLVPN access is not allowed".

Which step should the Cisco ASA administrator take to resolve this issue?

Enable the clientless VPN protocol on the group policy.

Validate that the correct license is in use on the ASA for WebVP

Increase the number of simultaneous logins allowed on the group policy.

Verify that a user account exists in the local AAA database for the user.

9. Refer to the exhibit.

A network engineer is configuring a remote access SSLVPN and is unable to complete the connection using local credentials.

What must be done to remediate this problem?

Enable the client protocol in the Cisco AnyConnect profile.

Configure a AAA server group to authenticate the client.

Change the authentication method to local.

Configure the group policy to force local authentication.

10. A network engineer has almost finished setting up a clientless VPN that allows remote users to access internal HTTP servers. Users must enter their username and password twice: once on the clientless VPN web portal and again to log in to internal HTTP servers. The Cisco ASA and the HTTP servers use the same Active Directory server to authenticate users.

Which next step must be taken to allow users to enter their password only once?

Use LDAPS and add password management to the clientless tunnel group.

Configure auto-sign-on using NTLM authentication.

Set up the Cisco ASA to authenticate users via a SAML 2.0 ID

Create smart tunnels for the HTTP servers.

Page 2 of 5

11. In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form.

Which troubleshooting step solves the issue?

Verify the spoke configuration to check if the NHRP redirect is enabled.

Verify that the spoke receives redirect messages and sends resolution requests.

Verify the hub configuration to check if the NHRP shortcut is enabled.

Verify that the tunnel interface is contained within a VR

12. Over the weekend, an administrator upgraded the Cisco ASA image on the firewalls and noticed that users cannot connect to the headquarters site using Cisco AnyConnect.

What is the solution for this issue?

Upgrade the Cisco AnyConnect client version to be compatible with the Cisco ASA software image.

Upgrade the Cisco AnyConnect Network Access module to be compatible with the Cisco ASA software image.

Upgrade the Cisco AnyConnect client driver to be compatible with the Cisco ASA software image.

Upgrade the Cisco AnyConnect Start Before Logon module to be compatible with the Cisco ASA software image.

13. An administrator is planning a VPN configuration that will encrypt traffic between multiple servers that will be passing unicast and multicast traffic. This configuration must be able to be implemented without the need to modify routing within the network.

Which VPN technology must be used for this task?

FlexVPN

VTI

GETVPN

DMVPN

14. Refer to the exhibit.

The customer must launch Cisco AnyConnect in the RDP machine.

Which IOS configuration accomplishes this task?

A)

Option A

Option B

Option C

Option D

15. An engineer has configured Cisco AnyConnect VPN using IKEv2 on a Cisco IOS router. The user cannot connect in the Cisco AnyConnect client, but receives an alert message "Use a browser to gain access."

Which action does the engineer take to resolve this issue?

Reset user login credentials.

Correct the URL address.

Connect using HTTP

Disable the HTTP server.

16. What are two functions of ECDH and ECDSA? (Choose two.)

nonrepudiation

revocation

digital signature

key exchange

encryption

17. Which two types of SSO functionality are available on the Cisco ASA without any external SSO servers? (Choose two.)

SAML

NTLM

Kerberos

OAuth 2.0

HTTP Basic

18. Which VPN solution uses TBAR?

GETVPN

VTI

DMVPN

Cisco AnyConnect

19. Which command shows the smart default configuration for an IPsec profile?

show run all crypto ipsec profile

ipsec profile does not have any smart default configuration

show smart-defaults ipsec profile

show crypto ipsec profile default

20. A user is experiencing delays on audio calls over a Cisco AnyConnect VPN.

Which implementation step resolves this issue?

Change to 3DES Encryption.

Shorten the encryption key lifetime.

Install the Cisco AnyConnect 2.3 client for the user to download.

Enable DTL

Page 3 of 5

21. DRAG DROP

Drag and drop the correct commands from the night onto the blanks within the code on the left to implement a design that allow for dynamic spoke-to-spoke communication. Not all comments are used.

22. Refer to the exhibit.

A Cisco ASA is configured as a client to a router running as a FlexVPN server. The router is configured with a virtual template to terminate FlexVPN clients. Traffic between networks 192.168.0.0/24 and 172.16.20.0/24 does not work as expected.

Based on the show crypto ikev2 sa output collected from the Cisco ASA in the exhibit, what is the solution to this issue?

Modify the crypto ACL on the router to permit network 192.168.0.0/24 to network 172.16.20.0/24.

Modify the crypto ACL on the ASA to permit network 192.168.0.0/24 to network 172.16.20.0/24.

Modify the crypto ACL on the ASA to permit network 172.16.20.0/24 to network 192.168.0.0/24.

Modify the crypto ACL on the router to permit network 172.16.20.0/24 to network 192.168.0.0/24.

23. A network engineer must implement an SSLVPN Cisco AnyConnect solution that supports 500 concurrent users, ensures all traffic from the client passes through the ASA, and allows users to access all devices on the inside interface subnet (192.168.0.0/24).

Assuming all other configuration is set up appropriately, which configuration implements this solution?

Option A

Option B

Option C

Option D

24. A network engineer is setting up Cisco AnyConnect 4.9 on a Cisco ASA running ASA software 9.1. Cisco AnyConnect must connect to the Cisco ASA before the user logs on so that login scripts can work successfully. In addition, the VPN must connect without user intervention.

Which two key steps accomplish this task? (Choose two.)

Create a Network Access Manager profile with a client policy set to connect before user logon.

Create a Cisco AnyConnect VPN profile with Start Before Logon set to true.

Issue an identity certificate to the trusted root CA folder in the machine store.

Create a Cisco AnyConnect VPN profile with Always On set to true.

Create a Cisco Anyconnect VPN Management Tunnel profile.

25. Refer to the exhibit.

An engineer has configured a spoke to connect to a FlexVPN hub. The tunnel is up, but pings fail when the engineer attempts to reach host 192.168.200.10 behind the spoke, and traffic is sourced from host 192.168.100.3, which is behind the FlexVPN server.

Based on packet captures, the engineer discovers that host 192.168.200.10 receives the icmp echo and sends an icmp reply that makes it to the inside interface of the spoke. Based on the output in the exhibit captured on the spoke by the engineer, which action resolves this issue?

Add the aaa authorization group cert list default default command to the spoke ikev2 profile.

Add the route set remote ipv4 192.168.200.0 255.255.255.0 command to the hub authorization policy.

Add the aaa authorization group cert list default default command to the hub ikev2 profile.

Add the route set remote ipv4 192.168.100.0 255.255.255.0 command to the spoke authorization policy.

26. A network engineer is installing Cisco AnyConnect on company laptops so that users can access corporate resources remotely. The VPN concentrator is a Cisco router running IOS-XE 16.9.1 code and configured as a FlexVPN server that uses local authentication and *$Cisc431089017$* as the key-id for the IKEv2 profile.

Which two steps must be taken on the computer to allow a successful AnyConnect connection to the router? (Choose two.)

In the Cisco AnyConnect XML profile, set the IPsec Authentication method to EAP-AnyConnect.

In the Cisco AnyConnect XML profile, add the hostname and host address to the server list.

In the Cisco AnyConnect XML profile, set the user group field to DefaultAnyConnectClientGroup.

In the Cisco AnyConnect Local Policy, set the BypassDownloader option in the local to true.

In the Cisco AnyConnect Local Policy, add the router IP address to the Update Policy.

27. A DMVPN spoke router tunnel is up and passing traffic, but it cannot establish an EIGRP neighbor relationship with the hub router.

Which solution resolves this issue?

Enable EIGRP Split Horizon on the hub tunnel interface.

Remove the EIGRP stub configuration on the spoke tunnel interface.

Enable the EIGRP next hop self feature on the hub tunnel interface.

Configure the dynamic NHRP multicast map on the hub tunnel interface.

28. Refer to the exhibit.

Which type of VPN implementation is displayed?

IKEv1 cluster

IKEv2 backup gateway

IKEv2 load balancer

IKEv2 reconnect

29. Refer to the exhibit.

Which type of Cisco VPN is shown for group Cisc012345678?

Cisco AnyConnect Client VPN

DMVPN

Clientless SSLVPN

GETVPN

30. Under which section must a bookmark or URL list be configured on a Cisco ASA to be available for clientless SSLVPN users?

tunnel-group (general-attributes)

tunnel-group (webvpn-attributes)

webvpn (group-policy)

webvpn (global configuration)

Page 4 of 5

31. An engineer is configuring clientless SSL VPN. The finance department has a database server that only they should access, but the sales department can currently access it. The finance and the sales departments are configured as separate group-policies.

What must be added to the configuration to make sure the users in the sales department cannot access the finance department server?

tunnel group lock

smart tunnel

port forwarding

webtype ACL

32. Refer to the exhibit.

Which two commands under the tunnel-group webvpn-attributes result in a Cisco AnyConnect user receiving the AnyConnect prompt in the exhibit? (Choose two.)

group-url https://172.16.31.10/General enable

group-policy General internal

authentication aaa

authentication certificate

group-alias General enable

33. 1. Topic 1, Site-to-site Virtual Private Networks on Routers and Firewall

Refer to the exhibit.

The DMVPN tunnel is dropping randomly and no tunnel protection is configured.

Which spoke configuration mitigates tunnel drops?

A)

Option A

Option B

Option C

Option D

34. Refer to the exhibit.

Users cannot connect via AnyConnect SSLVPN.

Which action resolves this issue?

Configure the ASA to act as a DHCP server.

Configure the HTTP server to listen on port 443.

Add an IPsec preshared key to the group policy.

Add ssl-client to the allowed list of VPN protocols.

35. Which benefit of FlexVPN is a limitation of DMVPN using IKEv1?

GRE encapsulation allows for forwarding of non-IP traffic.

IKE implementation can install routes in routing table.

NHRP authentication provides enhanced security.

Dynamic routing protocols can be configured.

36. Which technology and VPN component allows a VPN headend to dynamically learn post NAT IP addresses of remote routers at different sites?

DMVPN with ISAKMP

GETVPN with ISAKMP

DMVPN with NHRP

GETVPN with NHRP

37. On a FlexVPN hub-and-spoke topology where spoke-to-spoke tunnels are not allowed, which command is needed for the hub to be able to terminate FlexVPN tunnels?

interface virtual-access

ip nhrp redirect

interface tunnel

interface virtual-template

38. A network engineer is implementing a FlexVPN tunnel between two Cisco IOS routers. The FlexVPN tunnels will terminate on encrypted traffic on an interface configured with an IP MTU of 1500, and the company has a security policy to drop fragmented traffic coming into or leaving the network. The tunnel will be used to transfer TFTP data between users and internal servers.

When the TFTP traffic is not traversing a VPN, it can have a maximum IP packet size of 1500. Assuming the encrypted payload will add 90 bytes, which configuration allows TFTP traffic to traverse the FlexVPN tunnel without being dropped?

Set the tunnel IP MTU to 1500.

Set the tunnel tcp adjust-mss to 1460.

Set the tunnel IP MTU to 1400.

Set the tunnel tcp adjust-mss to 1360.

39. Which command automatically initiates a smart tunnel when a user logs in to the WebVPN portal page?

auto-upgrade

auto-connect

auto-start

auto-run

40. Refer to the exhibit.

What is a result of this configuration?

Spoke 1 fails the authentication because the authentication methods are incorrect.

Spoke 2 passes the authentication to the hub and successfully proceeds to phase 2.

Spoke 2 fails the authentication because the remote authentication method is incorrect.

Spoke 1 passes the authentication to the hub and successfully proceeds to phase 2.

Page 5 of 5

41. Where must an engineer configure a preshared key for a site-to-site VPN tunnel configured on a Cisco ASA?

isakmp policy

group policy

crypto map

tunnel group

42. Which technology is used to send multicast traffic over a site-to-site VPN?

GRE over IPsec on IOS router

GRE over IPsec on FTD

IPsec tunnel on FTD

GRE tunnel on ASA

43. An engineer must configure remote desktop connectivity for offsite admins via clientless SSL VPN, configured on a Cisco ASA to Windows Vista workstations.

Which two configurations provide the requested access? (Choose two.)

Telnet bookmark via the Telnet plugin

RDP2 bookmark via the RDP2 plugin

VNC bookmark via the VNC plugin

Citrix bookmark via the ICA plugin

SSH bookmark via the SSH plugin

44. VPN tunnels between a spoke and two DMVPN hubs are not coming up. The network administrator has verified that the encryption, hashing, and DH group proposals for Phase 1 and Phase 2 match on both ends.

What is the solution to this issue?

Ensure bidirectional UDP 500/4500 traffic.

Increase the isakmp phase 1 lifetime.

Add NAT statements for VPN traffic.

Enable shared tunnel protection.

Facebook Twitter LinkedIn Google + Email