Updated Free Cisco 300-730 Test Engine Questions with 177 Q&As
The Best CCNP Security 300-730 Professional Exam Questions
NEW QUESTION # 88
An engineer notices that while an employee is connected remotely, all traffic is being routed to the corporate network. Which split-tunnel policy allows a remote client to use their local provider for Internet access when working from home?
- A. excludespecified
- B. tunnelall
- C. excludeall
- D. tunnelspecified
Answer: D
NEW QUESTION # 89
Which two changes must be made in order to migrate from DMVPN Phase 2 to Phase 3 when EIGRP is configured? (Choose two.)
- A. Enable EIGRP next-hop-self on the hub.
- B. Disable EIGRP next-hop-self on the hub.
- C. Add NHRP redirects on the spoke.
- D. Add NHRP shortcuts on the hub.
- E. Add NHRP redirects on the hub.
Answer: B,E
NEW QUESTION # 90
An administrator is designing a VPN with a partner's non-Cisco VPN solution. The partner's VPN device will negotiate an IKEv2 tunnel that will only encrypt subnets 192.168.0.0/24 going to 10.0.0.0/24. Which technology must be used to meet these requirements?
- A. crypto map
- B. GETVPN
- C. VTI
- D. DMVPN
Answer: A
NEW QUESTION # 91
Which VPN technology must be used to ensure that routers are able to dynamically form connections with each other rather than sending traffic through a hub and be able to advertise routes without the use of a dynamic routing protocol?
- A. DMVPN Phase 3
- B. FlexVPN
- C. GETVPN
- D. DMVPN Phase 2
Answer: A
Explanation:
DMVPN stands for Dynamic Multipoint VPN, which is a technology that allows routers to dynamically form VPN tunnels with each other without requiring a pre-configured static crypto map. DMVPN uses Multipoint GRE (mGRE) interfaces and Next Hop Resolution Protocol (NHRP) to establish direct connections between routers. DMVPN has three phases of operation, each with different features and benefits.
DMVPN Phase 1 is the basic configuration, where all spokes are configured with a single mGRE interface that points to the hub as the NHRP server. The spokes can only communicate with the hub, not with each other. All traffic must go through the hub, which creates a bottleneck and increases latency.
DMVPN Phase 2 improves on Phase 1 by allowing spoke-to-spoke communication without going through the hub. This is achieved by using NHRP to dynamically resolve the IP address of the destination spoke and create a direct GRE tunnel between the spokes. However, this still requires the use of a dynamic routing protocol to advertise routes between the spokes, which adds overhead and complexity.
DMVPN Phase 3 further enhances Phase 2 by enabling spoke-to-spoke communication without requiring a dynamic routing protocol. This is done by using NHRP shortcut switching and NHRP redirect messages. When a spoke wants to send traffic to another spoke, it sends an NHRP resolution request to the hub, which responds with an NHRP redirect message containing the IP address of the destination spoke. The source spoke then creates a direct GRE tunnel with the destination spoke and switches the traffic to the new tunnel. The hub also sends an NHRP resolution reply to the destination spoke, informing it of the source spoke's IP address. The destination spoke then creates a direct GRE tunnel with the source spoke and switches the traffic to the new tunnel. This way, the spokes can communicate directly without using a dynamic routing protocol or going through the hub.
NEW QUESTION # 92
A network engineer must design a clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was found that one website is not being rewritten correctly by the ASA.
What is a potential solution for this issue while still allowing it to be a clientless VPN setup?
- A. Set up Cisco AnyConnect with a split tunnel that has the IP address of the web server.
- B. Set up a smart tunnel with the IP address of the web server.
- C. Set up a NAT rule that translates the ASA public address to the web server private address on port 80.
- D. Set up a WebACL to permit the IP address of the web server.
Answer: C
NEW QUESTION # 93
Which two features provide headend resiliency for Cisco AnyConnect clients? (Choose two.)
- A. AnyConnect Network Access Manager
- B. AnyConnect Backup Servers
- C. AnyConnect Auto Reconnect
- D. ASA failover
- E. AnyConnect Always On
Answer: B,D
NEW QUESTION # 94
Refer to the exhibit.
A network engineer is reconfiguring clientless SSLVPN during a maintenance window, and after testing the new configuration, is unable to establish the connection. What must be done to remediate this problem?
- A. Enable DTLS under the group policy.
- B. Enable client services on the outside interface.
- C. Enable auto sign-on for the user's IP address.
- D. Enable clientless protocol under the group policy.
Answer: D
Explanation:
https://networksec-solutions.com/cisco-asa-ssl-clientless-vpn/
NEW QUESTION # 95
Refer to the exhibit.
A Cisco ASA is configured as a client to a router running as a FlexVPN server. The router is configured with a virtual template to terminate FlexVPN clients. Traffic between networks 192.168.0.0/24 and 172.16.20.0/24 does not work as expected. Based on the show crypto ikev2 sa output collected from the Cisco ASA in the exhibit, what is the solution to this issue?
- A. Modify the crypto ACL on the ASA to permit network 192.168.0.0/24 to network 172.16.20.0/24.
- B. Modify the crypto ACL on the router to permit network 192.168.0.0/24 to network 172.16.20.0/24.
- C. Modify the crypto ACL on the router to permit network 172.16.20.0/24 to network 192.168.0.0/24.
- D. Modify the crypto ACL on the ASA to permit network 172.16.20.0/24 to network 192.168.0.0/24.
Answer: A
Explanation:
the show crypto ukev2 sa output from the ASA, the local selector is 192.168.0.0/24 the remote selector is 172.16.2.0/24 ( which is wrong , should be .20.0/24) . so , the ACL in the ASA should be to permit 192.168.0.0/24 to 172.16.20.0/24
NEW QUESTION # 96
Refer to the exhibit.
All internal clients behind the ASA are port address translated to the public outside interface that has an IP address of 3.3.3.3. Client 1 and client 2 have established successful SSL VPN connections to the ASA. What must be implemented so that "3.3.3.3" is returned from a browser search on the IP address?
- A. Same-security-traffic permit inter-interface under Group Policy
- B. Exclude Network List Below under Group Policy
- C. Tunnel Network List Below under Group Policy
- D. Tunnel All Networks under Group Policy
Answer: D
Explanation:
The reason is that by default, the SSL VPN clients use split tunneling, which means they only send traffic destined for the corporate network through the VPN tunnel, and use their local gateway for other traffic, such as browsing the internet. This means that when they search for their IP address on a browser, they will see their local IP address, not the IP address of the ASA.
To change this behavior, you need to configure the Group Policy on the ASA to tunnel all networks, which means that all traffic from the SSL VPN clients will go through the VPN tunnel, regardless of the destination. This way, when they search for their IP address on a browser, they will see the IP address of the ASA, which is 3.3.3.3.
To configure tunnel all networks under Group Policy, you can use either ASDM or CLI. For example, using ASDM, you can follow these steps1:
Choose Configuration > Remote Access VPN > Network (Client) Access > Group Policies.
Select the group policy that you want to modify and click Edit.
In the Edit Internal Group Policy window, choose Advanced > Split Tunneling.
In the Policy drop-down list, choose Tunnel All Networks.
Click OK and then Apply.
Using CLI, you can enter these commands:
ciscoasa(config)# group-policy <group_policy_name> attributes ciscoasa(config-group-policy)# split-tunnel-policy tunnelall
NEW QUESTION # 97
Refer to the exhibit.
The IKEv2 site-to-site VPN tunnel between two routers is down. Based on the debug output, which type of mismatch is the problem?
- A. transform set
- B. preshared key
- C. peer identity
- D. ikev2 proposal
Answer: C
NEW QUESTION # 98
Refer to the exhibit.
All internal clients behind the ASA are port address translated to the public outside interface that has an IP address of 3.3.3.3. Client 1 and client 2 have established successful SSL VPN connections to the ASA. What must be implemented so that "3.3.3.3" is returned from a browser search on the IP address?
- A. Tunnel Network List Below under Group Policy
- B. Same-security-traffic permit inter-interface under Group Policy
- C. Exclude Network List Below under Group Policy
- D. Tunnel All Networks under Group Policy
Answer: A
NEW QUESTION # 99
Which parameter is initially used to elect the primary key server from a group of key servers?
- A. code version
- B. lowest IP address
- C. highest-priority value
- D. highest IP address
Answer: C
Explanation:
Reference:
https://www.cisco.com/c/en/us/products/collateral/security/group-encrypted-transport-vpn/ deployment_guide_c07_554713.html
NEW QUESTION # 100
Refer to the exhibit.
Upon setting up a tunnel between two sites, users are complaining that connections to applications over the VPN are not working consistently. The output of show crypto ipsec sa was collected on one of the VPN devices. Based on this output, what should be done to fix this issue?
- A. Lower the tunnel MTU.
- B. Specify the application networks in the remote identity.
- C. Enable perfect forward secrecy.
- D. Make an adjustment to IPSec replay window.
Answer: A
NEW QUESTION # 101
Which technology and VPN component allows a VPN headend to dynamically learn post NAT IP addresses of remote routers at different sites?
- A. DMVPN with NHRP
- B. GETVPN with ISAKMP
- C. GETVPN with NHRP
- D. DMVPN with ISAKMP
Answer: A
NEW QUESTION # 102
A network engineer is setting up a clientless SSLVPN on a Cisco ASA. Remote users must be able to access an internal webserver via the URL example.com. Which two steps accomplish this task? (Choose two.)
- A. Configure a bookmark for the webserver.
- B. Configure routing so that the Cisco ASA can reach the webserver.
- C. Configure routing so that the user's computer can reach the webserver.
- D. Configure a DNS server that can resolve the webserver URL.
- E. Configure a browser plugin on the Cisco ASA.
Answer: A,D
NEW QUESTION # 103
An administrator is setting up Cisco AnyConnect on a Cisco ASA with the requirement that AnyConnect automatically establishes a VPN when a company-owned laptop is connected to the internet outside of the corporate network. Which configuration meets these requirements?
- A. SBL with machine certificate authentication
- B. TND with machine certificate authentication
- C. TND with user certificate authentication
- D. SBL with user certificate authentication
Answer: B
Explanation:
Trusted Network Detection (TND) gives you the ability to have AnyConnect automatically disconnect a VPN connection when the user is inside the corporate network (the trusted network) and start the VPN connection when the user is outside the corporate network (the untrusted network). https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect41/administration/guide/b_AnyConnect_Administrator_Guide_4-1/configure-vpn.html#id_100236
NEW QUESTION # 104
......
Try 100% Updated 300-730 Exam Questions [2024]: https://passcertification.preppdf.com/Cisco/300-730-prepaway-exam-dumps.html