Implementing Secure Solutions with Virtual Private Networks (300-730) Free Practice Test

Question 1

Refer to the exhibit. A site-to-site tunnel between two sites is not coming up.
Based on the debugs, what is the cause of this issue?

A. A certificate fragmentation issue occurs between both sides.

B. UDP 4500 traffic from the peer does not reach the router.

C. An authentication failure occurs on the router.

D. An authentication failure occurs on the remote peer.

Correct Answer: B

Question 2

Refer to the exhibit. A Cisco ASA is configured as a client to a router running as a FlexVPN server. The router is configured with a virtual template to terminate FlexVPN clients. Traffic between networks 192.168.0.0/24 and 172.16.20.0/24 does not work as expected. Based on the show crypto ikev2 sa output collected from the Cisco ASA in the exhibit, what is the solution to this issue?

A. Modify the crypto ACL on the ASA to permit network 172.16.20.0/24 to network 192.168.0.0/24.

B. Modify the crypto ACL on the router to permit network 192.168.0.0/24 to network 172.16.20.0/24.

C. Modify the crypto ACL on the ASA to permit network 192.168.0.0/24 to network 172.16.20.0/24.

D. Modify the crypto ACL on the router to permit network 172.16.20.0/24 to network 192.168.0.0/24.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

A network engineer must implement an SSLVPN Cisco AnyConnect solution that supports 500 concurrent users, ensures all traffic from the client passes through the ASA, and allows users to access all devices on the inside interface subnet (192.168.0.0/24). Assuming all other configuration is set up appropriately, which configuration implements this solution?

A.

B.

C.

D.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

Which technology is used to send multicast traffic over a site-to-site VPN?

A. IPsec tunnel on FTD

B. GRE over IPsec on FTD

C. GRE tunnel on ASA

D. GRE over IPsec on IOS router

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

Which command automatically initiates a smart tunnel when a user logs in to the WebVPN portal page?

A. auto-start

B. auto-upgrade

C. auto-connect

D. auto-run

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

Refer to the exhibit. An engineer must allow Cisco AnyConnect users to access the outside interface using protocol UDP 500/4500. In addition, these clients must be able to establish an SSL connection to update Cisco AnyConnect software over the same connection. Which two actions must be taken to achieve this goal? (Choose two.)

A. SSL Allow Access must be checked on the outside interface.

B. IPsec (IKEv2) Enable Client Services must be checked on the outside interface.

C. Bypass interface access lists for inbound VPN sessions must be unchecked.

D. IPsec (IKEv2) Allow Access must be checked on the outside interface.

E. SSL Enable DTLS must be checked on the outside interface.

Correct Answer: B,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

Refer to the exhibit. An engineer is building an IKEv1 tunnel to a peer Cisco ASA, but the tunnel is failing. Based on the configuration in the exhibit, which action must be taken to allow the VPN tunnel to come up?

A. Change the IKEv1 policy number to be at least 256.

B. Add a route for the 10.7.7.0/24 network to egress the outside interface.

C. Enable IKEv1 on the outside interface.

D. Change the transform set mode to transport.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

Which remote access VPN technology requires the use of the IPsec-proposal configuration option?

A. IKEv1-based VPN

B. IKEv2-based VPN

C. clientless SSLVPN

D. SSLVPN Full Tunnel

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

An engineer must design a VPN solution with this criteria:
- Configured on an IOS XE router.
- Able to terminate policy-based VPNs from Cisco and non-Cisco devices.
- QoS can be applied on a per-tunnel basis.
Which VPN technology must be used to accomplish this design?

A. Dynamic Crypto map

B. Multi-SA VTIs

C. GETVPN

D. DMVPN

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 10

Refer to the exhibit. An engineer has configured two new VPN tunnels to 172.18.1.1 and
172.19.1.1. However, communication between 10.1.0.10 and 10.1.11.10 does not function.
Which action should be taken to resolve this issue?

A. Adjust the network objects to match the appropriate subnets.

B. Remove and reapply the crypto map to the interface.

C. Insert routes for the 10.1.9.0/24 and 10.1.10.0/24 subnets.

D. Modify the transform set to use transport mode.

Correct Answer: A

Question 11

A user is trying to log in to a Cisco ASA using the clientless SSLVPN feature and receives the error message "clientless (browser) SSLVPN access is not allowed". Which step should the Cisco ASA administrator take to resolve this issue?

A. Enable the clientless VPN protocol on the group policy.

B. Increase the number of simultaneous logins allowed on the group policy.

C. Validate that the correct license is in use on the ASA for WebVPN.

D. Verify that a user account exists in the local AAA database for the user.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 12

Which benefit of FlexVPN is a limitation of DMVPN using IKEv1?

A. Dynamic routing protocols can be configured.

B. NHRP authentication provides enhanced security.

C. GRE encapsulation allows for forwarding of non-IP traffic.

D. IKE implementation can install routes in routing table.

Correct Answer: D

Welcome to TestSimulate

Cisco Implementing Secure Solutions with Virtual Private Networks (300-730) Free Practice Test