How Many Questions Of 300-730 Test Preparation

NEW QUESTION 1
A Cisco AnyConnect client establishes a SSL VPN connection with an ASA at the corporate office. An engineer must ensure that the client computer meets the enterprise security policy. Which feature can update the client to meet an enterprise security policy?

• A. Endpoint Assessment
• B. Cisco Secure Desktop
• C. Basic Host Scan
• D. Advanced Endpoint Assessment

Answer: D

NEW QUESTION 2
Which configuration construct must be used in a FlexVPN tunnel?

• A. EAP configuration
• B. multipoint GRE tunnel interface
• C. IKEv1 policy
• D. IKEv2 profile

Answer: D

NEW QUESTION 3
Refer to the exhibit.

Which value must be configured in the User Group field when the Cisco AnyConnect Profile is created to connect to an ASA headend with IPsec as the primary protocol?

• A. address-pool
• B. group-alias
• C. group-policy
• D. tunnel-group

Answer: D

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect41/administration/guide/b_AnyConnect_Administrator_Guide_4-1/configure-vpn.html

NEW QUESTION 4
Which feature of GETVPN is a limitation of DMVPN and FlexVPN?

• A. sequence numbers that enable scalable replay checking
• B. enabled use of ESP or AH
• C. design for use over public or private WAN
• D. no requirement for an overlay routing protocol

Answer: D

NEW QUESTION 5
A Cisco ASA is configured in active/standby mode. What is needed to ensure that Cisco AnyConnect users can connect after a failover event?

• A. AnyConnect images must be uploaded to both failover ASA devices.
• B. The vpnsession-db must be cleared manually.
• C. Configure a backup server in the XML profile.
• D. AnyConnect client must point to the standby IP address.

Answer: A

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_active_standby.html

NEW QUESTION 6
Refer to the exhibit.

What is configured as a result of this command set?

• A. FlexVPN client profile for IPv6
• B. FlexVPN server to authorize groups by using an IPv6 external AAA
• C. FlexVPN server for an IPv6 dVTI session
• D. FlexVPN server to authenticate IPv6 peers by using EAP

Answer: A

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/xe-3s/sec-flex-vpn-xe-3s-book/sec-cfg-flex-clnt.html

NEW QUESTION 7
Where is split tunneling defined for IKEv2 remote access clients on a Cisco router?

• A. IKEv2 authorization policy
• B. Group Policy
• C. virtual template
• D. webvpn context

Answer: B

NEW QUESTION 8
An engineer is troubleshooting a new DMVPN setup on a Cisco IOS router. After the show crypto isakmp sa command is issued, a response is returned of "MM_NO_STATE." Why does this failure occur?

• A. The ISAKMP policy priority values are invalid.
• B. ESP traffic is being dropped.
• C. The Phase 1 policy does not match on both devices.
• D. Tunnel protection is not applied to the DMVPN tunnel.

Answer: B

NEW QUESTION 9
Refer to the exhibit.

An engineer is troubleshooting a new GRE over IPsec tunnel. The tunnel is established but the engineer cannot ping from spoke 1 to spoke 2. Which type of traffic is being blocked?

• A. ESP packets from spoke2 to spoke1
• B. ISAKMP packets from spoke2 to spoke1
• C. ESP packets from spoke1 to spoke2
• D. ISAKMP packets from spoke1 to spoke2

Answer: A

NEW QUESTION 10
Refer to the exhibit.

Which two commands under the tunnel-group webvpn-attributes result in a Cisco AnyConnect user receiving the AnyConnect prompt in the exhibit? (Choose two.)

• A. group-url https://172.16.31.10/General enable
• B. group-policy General internal
• C. authentication aaa
• D. authentication certificate
• E. group-alias General enable

Answer: BE

NEW QUESTION 11
Which benefit of FlexVPN is a limitation of DMVPN using IKEv1?

• A. GRE encapsulation allows for forwarding of non-IP traffic.
• B. IKE implementation can install routes in routing table.
• C. NHRP authentication provides enhanced security.
• D. Dynamic routing protocols can be configured.

Answer: B

NEW QUESTION 12
Refer to the exhibit.

The customer can establish a Cisco AnyConnect connection without using an XML profile. When the host "ikev2" is selected in the AnyConnect drop down, the connection fails. What is the cause of this issue?

• A. The HostName is incorrect.
• B. The IP address is incorrect.
• C. Primary protocol should be SSL.
• D. UserGroup must match connection profile.

Answer: D

Explanation:
Reference: https://community.cisco.com/t5/security-documents/anyconnect-xml-settings/ta-p/3157891

NEW QUESTION 13
Refer to the exhibit.

A site-to-site tunnel between two sites is not coming up. Based on the debugs, what is the cause of this issue?

• A. An authentication failure occurs on the remote peer.
• B. A certificate fragmentation issue occurs between both sides.
• C. UDP 4500 traffic from the peer does not reach the router.
• D. An authentication failure occurs on the router.

Answer: C

NEW QUESTION 14
Which VPN solution uses TBAR?

• A. GETVPN
• B. VTI
• C. DMVPN
• D. Cisco AnyConnect

Answer: A

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_getvpn/configuration/xe-3s/sec-get-vpn-xe-3s-book/sec-get-vpn.html

NEW QUESTION 15
Which two statements about the Cisco ASA Clientless SSL VPN solution are true? (Choose two.)

• A. When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the client uses the local DNS to perform FQDN resolution.
• B. The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default.
• C. A Cisco ASA can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions.
• D. When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the ASA uses its configured DNS servers to perform FQDN resolution.
• E. Clientless SSLVPN provides Layer 3 connectivity into the secured network.

Answer: CD

NEW QUESTION 16
Refer to the exhibit.

All internal clients behind the ASA are port address translated to the public outside interface that has an IP address of 3.3.3.3. Client 1 and client 2 have established successful SSL VPN connections to the ASA. What must be implemented so that "3.3.3.3" is returned from a browser search on the IP address?

• A. Same-security-traffic permit inter-interface under Group Policy
• B. Exclude Network List Below under Group Policy
• C. Tunnel All Networks under Group Policy
• D. Tunnel Network List Below under Group Policy

Answer: D

NEW QUESTION 17
Refer to the exhibit.

The customer must launch Cisco AnyConnect in the RDP machine. Which IOS configuration accomplishes this task?

• A.
• B.
• C.
• D.

Answer: C

Explanation:
Reference: https://community.cisco.com/t5/vpn/starting-anyconnect-vpn-through-rdp-session-on-cisco-891/td-p/2128284

NEW QUESTION 18
Which command automatically initiates a smart tunnel when a user logs in to the WebVPN portal page?

• A. auto-upgrade
• B. auto-connect
• C. auto-start
• D. auto-run

Answer: C

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/vpn/asa_91_vpn_config/webvpn-configure-policy-group.html

NEW QUESTION 19
Refer to the exhibit.

Based on the debug output, which type of mismatch is preventing the VPN from coming up?

• A. interesting traffic
• B. lifetime
• C. preshared key
• D. PFS

Answer: B

Explanation:
If the responder's policy does not allow it to accept any part of the proposed Traffic Selectors, it responds with a TS_UNACCEPTABLE Notify message.

NEW QUESTION 20
DRAG DROP
Drag and drop the correct commands from the night onto the blanks within the code on the left to implement a design that allow for dynamic spoke-to-spoke communication. Not all comments are used.
Select and Place:

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/xe-16/sec-conn-dmvpn-xe-16-book/sec-conn-dmvpn-summ-maps.html

NEW QUESTION 21
Which parameter must match on all routers in a DMVPN Phase 3 cloud?

• A. GRE tunnel key
• B. NHRP network ID
• C. tunnel VRF
• D. EIGRP split-horizon setting

Answer: A

NEW QUESTION 22
Which two remote access VPN solutions support SSL? (Choose two.)

• A. FlexVPN
• B. clientless
• C. EZVPN
• D. L2TP
• E. Cisco AnyConnect

Answer: BE

NEW QUESTION 23
Which two commands help determine why the NHRP registration process is not being completed even after the IPsec tunnel is up? (Choose two.)

• A. show crypto isakmp sa
• B. show ip traffic
• C. show crypto ipsec sa
• D. show ip nhrp traffic
• E. show dmvpn detail

Answer: AD

NEW QUESTION 24
......