Cisco 300-209 Online Practice Questions and Exam Preparation

Cisco 300-209 Online Questions & Answers

• Question 1:

  Which Cisco ASA platform should be selected if the requirements are to support 35,000 connections per second, 600,000 maximum connections, and traffic shaping?

  A. 5540
  B. 5550
  C. 5580-20
  D. 5580-40
  B. 5550

• Question 2:

  Refer to the exhibit. You have implemented an SSL VPN as shown. Which type of communication takes place between the secure gateway R1 and the Cisco Secure ACS?

  

  A. HTTP proxy
  B. AAA
  C. policy
  D. port forwarding
  B. AAA

• Question 3:

  An engineer is troubleshooting a DMVPN spoken router and sees a CRPTO-4- IKMP_BAD_MESSAGE debug message that a spoke router "failed its sanity check or is malformed" Which issue does the error message indicate?

  A. mismatched preshared key
  B. unsupported transform propsal
  C. invalid IP packet SPI
  D. incompatible transform set
  A. mismatched preshared key

• Question 4:

  Which command configures IKEv2 symmetric identity authentication?

  A. match identity remote address 0.0.0.0
  B. authentication local pre-share
  C. authentication pre-share
  D. authentication remote rsa-sig
  D. authentication remote rsa-sig

• Question 5:

  Refer to the exhibit. While troubleshooting a remote-access application, a new NOC engineer received the logging message that is shown in the exhibit.

  

  Which configuration is most likely to be mismatched?

  A. IKE configuration
  B. extended authentication configuration
  C. IPsec configuration
  D. digital certificate configuration
  C. IPsec configuration

• Question 6:

  Refer to the exhibit. Which two statements about the given configuration are true? (Choose two.)

  

  A. Defined PSK can be used by any IPSec peer.
  B. Any router defined in group 2 will be allowed to connect.
  C. It can be used in a DMVPN deployment
  D. It is a LAN-to-LAN VPN ISAKMP policy.
  E. It is an AnyConnect ISAKMP policy.
  F. PSK will not work as configured
  A. Defined PSK can be used by any IPSec peer.
  C. It can be used in a DMVPN deployment

• Question 7:

  SIMULATION

  Scenario:

  You are the network security manager for your organization. Your manager has received a request to allow an external user to access to your HQ and DM2 servers. You are given the following connection parameters for this task.

  Using ASDM on the ASA, configure the parameters below and test your configuration by accessing the Guest PC. Not all AS DM screens are active for this exercise. Also, for this exercise, all changes are automatically applied to the ASA and

  you will not have to click APPLY to apply the changes manually.

  1.

  Enable Clientless SSL VPN on the outside interface

  2.

  Using the Guest PC, open an Internet Explorer window and test and verify the basic connection to the SSL VPN portal using address: https://vpn-secure-x.public

  3.

  a. You may notice a certificate error in the status bar, this can be ignored for this exercise

  4.

  b. Username: vpnuser

  5.

  c. Password: cisco123

  6.

  d. Logout of the portal once you have verified connectivity

  7.

  Configure two bookmarks with the following parameters:

  8.

  a. Bookmark List Name: MY-BOOKMARKS

  9.

  b. Use the: URL with GET or POST method

  10.c. Bookmark Title: HQ-Server

  11.i. http://10.10.3.20

  12.d. Bookmark Title: DMZ-Server-FTP

  13.i. ftp://172.16.1.50

  14.e. Assign the configured Bookmarks to:

  15.i. DfltGrpPolicy

  16.ii. DfltAccessPolicy

  17.iii. LOCAL User: vpnuser 18.From the Guest PC, reconnect to the SSL VPN Portal

  19.Test both configured Bookmarks to ensure desired connectivity

  You have completed this exercise when you have configured and successfully tested Clientless SSL VPN connectivity.

  Topology:

  

  

  A. Check the answer below
  A. Check the answer below

  ---

  Correct Answer: Please find the solution in below explanation

  First, enable clientless VPN access on the outside interface by checking the box found below:

  

  Then, log in to the given URL using the vpnuser/cisco123 credentials:

  

  Logging in will take you to this page, which means you have now verified basic connectivity:

  

  Now log out by hitting the logout button.

  Now, go back to the ASDM and navigate to the Bookmarks portion:

  

  Make the name MY-BOOKMARKS and use the "Add" tab and add the bookmarks per the instructions:

  

  Ensure the "URL with GET of POST method" button is selected and hit OK:

  

  Add the two bookmarks as given in the instructions:

  

  You should now see the two bookmarks listed:

  

  Hit OK and you will see this:

  

  Select the MY-BOOKMARKS Bookmarks and click on the "Assign" button. Then, click on the appropriate check boxes as specified in the instructions and hit OK.

  

  After hitting OK, you will now see this:

  

  Then, go back to the Guest-PC, log back in and you should be able to test out the two new bookmarks.

• Question 8:

  Refer to the exhibit. The network administrator is adding a new spoke, but the tunnel is not passing traffic. What could cause this issue?

  

  A. DMVPN is a point-to-point tunnel, so there can be only one spoke.
  B. There is no EIGRP configuration, and therefore the second tunnel is not working.
  C. The NHRP authentication is failing.
  D. The transform set must be in transport mode, which is a requirement for DMVPN.
  E. The NHRP network ID is incorrect.
  C. The NHRP authentication is failing.

• Question 9:

  A company has a Flex VPN solution for remote access and one of their Cisco any Connect remote clients is having trouble connecting property. Which command verifies that packets are being encrypted and decrypted?

  A. show crypto session active
  B. show crypto ikev2 stats
  C. show crypto ikev1 sa
  D. show crypto ikev2 sa
  E. show crypto session detail
  E. show crypto session detail

• Question 10:

  Which three parameters are specified in the isakmp (IKEv1) policy? (Choose three.)

  A. the hashing algorithm
  B. the authentication method
  C. the lifetime
  D. the session key
  E. the transform-set
  F. the peer
  A. the hashing algorithm
  B. the authentication method
  C. the lifetime