300-730 Free Exam Study Guide! (Updated 240 Questions)

300-730 Dumps for CCNP Security Certified Exam Questions and Answer

NEW QUESTION # 118
Refer to the exhibit.

Which two conclusions should be drawn from the DMVPN phase 2 configuration? (Choose two.)

• A. Spoke-to-spoke communication is allowed.
• B. EIGRP neighbor adjacency will fail.
• C. EIGRP route redistribution is not allowed.
• D. EIGRP is used as the dynamic routing protocol.
• E. Next-hop-self is required.

Answer: A,D

NEW QUESTION # 119
Refer to the exhibit. The DMVPN tunnel is dropping randomly and no tunnel protection is configured.

Which spoke configuration mitigates tunnel drops?

• A.
• B.
• C.
• D.

Answer: A

Explanation:
By default registration timeout is 1/3 of the holdtime, 40 minutes of 2 hour holdtime.
https://www.globalknowledge.com/us-en/resources/resource-library/articles/understanding-next- hop-resolution-protocol-commands/

NEW QUESTION # 120
Which type of VPN technology is being used when the ssl trust-point <trustpoint name>
<interface name> command is configured?

• A. SSL Remote Access VPN
• B. DMVPN
• C. IPsec site-to-site VPN
• D. GETVPN

Answer: A

Explanation:
The command ssl trust-point <trustpoint name> <interface name> is used in SSL VPN (Secure Sockets Layer Virtual Private Network) configurations. This command specifies the trustpoint (which contains the SSL certificate) that will be used for encrypting SSL VPN sessions. The trustpoint is a reference to a Certificate Authority (CA) that provides authentication for SSL connections.

NEW QUESTION # 121
Which two parameters help to map a VPN session to a tunnel group without using the tunnel-group list? (Choose two.)

• A. group-alias
• B. group-url
• C. certificate map
• D. optimal gateway selection
• E. AnyConnect client version

Answer: A,B

Explanation:
https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98580-enable-group-dropdown.html

NEW QUESTION # 122
Refer to the exhibit.

The network administrator must allow the Cisco AnyConnect Secure Mobility Client to securely access the corporate resources via IKEv2 and print locally. Traffic that is destined for the Internet must still be tunneled to the Cisco ASA.
Which configuration does the administrator use to accomplish this goal?

• A. Split exclude policy with a deny for 192.168.0.3/32.
• B. Tunnel all policy.
• C. Split exclude policy with a permit for 0.0.0.0/32.
• D. Split include policy with a permit for 192.168.0.0/24.

Answer: C

NEW QUESTION # 123
Refer to the exhibit.

Which VPN technology is used in the exhibit?

• A. DVTI
• B. GRE
• C. DMVPN
• D. VTI

Answer: D

NEW QUESTION # 124
Refer to the exhibit.

Which type of mismatch is causing the problem with the IPsec VPN tunnel?

• A. Phase 1 policy
• B. crypto access list
• C. transform set
• D. preshared key

Answer: D

Explanation:
IKE Message from X.X.X.X Failed its Sanity Check or is Malformed
This debug error appears if the pre-shared keys on the peers do not match. In order to fix this issue, check the pre-shared keys on both sides.
1d00H:%CRPTO-4-IKMP_BAD_MESSAGE: IKE message from 198.51.100.1 failed its sanity check or is malformed
https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html#anc17

NEW QUESTION # 125
A network engineer is setting up Cisco AnyConnect 4.9 on a Cisco ASA running ASA software 9.1. Cisco AnyConnect must connect to the Cisco ASA before the user logs on so that login scripts can work successfully. In addition, the VPN must connect without user intervention. Which two key steps accomplish this task? (Choose two.)

• A. Create a Cisco Anyconnect VPN Management Tunnel profile.
• B. Create a Cisco AnyConnect VPN profile with Always On set to true.
• C. Create a Network Access Manager profile with a client policy set to connect before user logon.
• D. Create a Cisco AnyConnect VPN profile with Start Before Logon set to true.
• E. Issue an identity certificate to the trusted root CA folder in the machine store.

Answer: D,E

NEW QUESTION # 126
Which command identifies a Cisco AnyConnect profile that was uploaded to the flash of an IOS router?

• A. webvpn import profile SSL_profile flash:simos-profile.xml
• B. anyconnect profile SSL_profile flash:simos-profile.xml
• C. crypto vpn anyconnect profile SSL_profile flash:simos-profile.xml
• D. svc import profile SSL_profile flash:simos-profile.xml

Answer: C

Explanation:
Reference:
https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200533- AnyConnect-Configure-Basic-SSLVPN-for-I.html

NEW QUESTION # 127
Refer to the exhibit. Based on the exhibit, why are users unable to access CCNP Webserver bookmark?

• A. The bookmark has been disabled.
• B. The URL is being blocked by a WebACL.
• C. The ASA cannot resolve the URL.
• D. The user cannot access the URL.

Answer: C

Explanation:
WebVPN Clients Cannot Hit Bookmarks and is Grayed Out
Problem
If these bookmarks were configured for users to sign in to the clientless VPN, but on the home screen under "Web Applications" they show up as grayed out, how can I enable these HTTP links so that the users are able to click them and go into the particular URL?
Solution
You should first make sure that the ASA can resolve the websites through DNS. Try to ping the websites by name. If the ASA cannot resolve the name, the link is grayed out. If the DNS servers are internal to your network, configure the DNS domain-lookup private interface.
https://www.cisco.com/c/en/us/support/docs/security-vpn/webvpn-ssl-vpn/119417-config-asa-
00.html#anc15

NEW QUESTION # 128
Why must a network engineer avoid usage of the default X.509 certificate when implementing clientless SSLVPN on an ASA?

• A. The certificate is too weak to provide adequate security.
• B. The certificate is regenerated at each reboot.
• C. The certificate must be managed by the local CA.
• D. The default X.509 certificate is not supported for SSLVPN.

Answer: B

Explanation:
By default, the ASA generates a self-signed X.509 certificate upon startup. This certificate is used in order to serve client connections by default. It is not recommended to use this certificate because its authenticity cannot be verified by the browser. Furthermore, this certificate is regenerated upon each reboot so it changes after each reboot.
https://www.cisco.com/c/en/us/support/docs/security-vpn/webvpn-ssl-vpn/119417-config-asa-
00.html

NEW QUESTION # 129
A network administrator deployed IKEv2 Cisco AnyConnect on a Cisco ASA. The current configuration tunnels all traffic through the VPN. Users report poor performance with cloud-based applications, but no issues have been reported about connections to on-premises servers. Packet analysis on Cisco Webex traffic shows very few duplicate ACKs, high RTT, and no IP fragments.
Which action improves Webex performance for VPN users?

• A. Reduce the Cisco AnyConnect tunnel MTU.
• B. Configure QoS on the outside interface of the ASA.
• C. Configure Cisco AnyConnect to use DTLS.
• D. Configure a dynamic split tunnel exclusion.

Answer: D

NEW QUESTION # 130
Refer to the exhibit. A network engineer is troubleshooting a new DMVPN configuration. The network connectivity between the hub and spoke is working as it should, but users cannot access VPN resources. Which action resolves the issue?

• A. Unblock IP protocol 50 on devices between the VPN devices.
• B. Ensure that the IPsec profile is configured on the tunnel interface.
• C. Ensure that the NHS is configured on the tunnel interface.
• D. Review ISAKMP packets on devices between the VPN devices.

Answer: B

Explanation:
The output of show crypto isakmp sa shows that all security associations are in the
"MM_NO_STATE" state. This indicates that IKE Phase 1 negotiation did not complete successfully, preventing IPsec tunnel establishment. A common cause of this issue in DMVPN (Dynamic Multipoint VPN) is that the IPsec profile is missing or incorrectly applied on the tunnel interface.

NEW QUESTION # 131
What are two variables for configuring clientless SSL VPN single sign-on? (Choose two.)

• A. CSCO_WEBVPN_OTP_PASSWORD
• B. CSCO_WEBVPN_USERNAME
• C. CSCO_WEBVPN_INTERNAL_PASSWORD
• D. CSCO_WEBVPN_RADIUS_USER

Answer: B,C

NEW QUESTION # 132
Which configuration allows a Cisco ASA to receive an IPsec connection from a peer with an unknown IP address?

• A. dynamic AAA attributes
• B. dynamic tunnel group
• C. dynamic access policy
• D. dynamic crypto map

Answer: D

NEW QUESTION # 133
Where is split tunneling defined for IKEv2 remote access clients on a Cisco router?

• A. virtual template
• B. webvpn context
• C. IKEv2 authorization policy
• D. Group Policy

Answer: D

Explanation:
Section: Secure Communications Architectures

NEW QUESTION # 134
......

Use Real 300-730 Dumps - 100% Free 300-730 Exam Dumps: https://www.testsimulate.com/300-730-study-materials.html