Cisco 300-209 Online Practice Questions and Exam Preparation

Cisco 300-209 Online Questions & Answers

• Question 221:

  Dynamic access policies can support several posture assessment methods to collect endpoint security attributes. From which operating system does an endpoint collect information?

  A. CISCO NAC
  B. Advanced Endpoint Assessment
  C. Host Scan
  D. CISCO Secure Desktop
  A. CISCO NAC

• Question 222:

  Which algorithm provides both encryption and authentication for plane communication?

  A. RC4
  B. SHA-384
  C. AES-256
  D. SHA-96
  E. 3DES
  F. AES-GCM
  F. AES-GCM

• Question 223:

  When an IPsec SVTI is configured, which technology processes traffic forwarding for encryption?

  A. ACL
  B. IP routing
  C. RRI
  D. front door VPN routing and forwarding
  B. IP routing

• Question 224:

  A user with IP address 10.10.10.10 is unable to access a HTTP website at IP address 209.165.200.225 through a Cisco ASA. Which two features and commands will help troubleshoot the issue? (Choose two.)

  A. Capture user traffic using command capture capin interface inside match ip host 10.10.10.10 any
  B. After verifying that user traffic reaches the firewall using syslogs or captures, use packet tracer command packet-tracer input inside tcp 10.10.10.10 1234 209.165.200.225 80
  C. Enable logging at level 1 and check the syslogs using commands logging enable, logging buffered 1 and show logging | include 10.10.10.10
  D. Check if an access-list on the firewall is blocking the user by using command show running-config access-list | include 10.10.10.10
  E. Use packet tracer command packet-tracer input inside udp 0.10.10.10 1234192.168.1.3 161 to see what the firewall is doing with the user's traffic
  A. Capture user traffic using command capture capin interface inside match ip host 10.10.10.10 any
  B. After verifying that user traffic reaches the firewall using syslogs or captures, use packet tracer command packet-tracer input inside tcp 10.10.10.10 1234 209.165.200.225 80

• Question 225:

  Which adaptive security appliance command can be used to see a generic framework of the requirements for configuring a VPN tunnel between an adaptive security appliance and a Cisco IOS router at a remote office?

  A. vpnsetup site-to-site steps
  B. show running-config crypto
  C. show vpn-sessiondb l2l
  D. vpnsetup ssl-remote-access steps
  A. vpnsetup site-to-site steps

• Question 226:

  You are troubleshooting a site-to-site VPN issue where the tunnel is not establishing. After issuing the debug crypto isakmp command on the headend router, you see the following output.

  What does this output suggest?

  1d00h: ISAKMP (0:1): atts are not acceptable. Next payload is 0 1d00h: ISAKMP (0:1); no offers accepted!

  1d00h: ISAKMP (0:1): SA not acceptable!

  1d00h: %CRYPTO-6-IKMP_MODE_FAILURE.

  Processing of Main Mode failed with peer at 10.10.10.10

  A. Phase 1 policy does not match on both sides.
  B. The transform set does not match on both sides.
  C. ISAKMP is not enabled on the remote peer.
  D. There is a mismatch in the ACL that identifies interesting traffic.
  A. Phase 1 policy does not match on both sides.

• Question 227:

  Which two parameters are configured within an IKEv2 proposal on an IOS router? (Choose two.)

  A. authentication
  B. encryption
  C. integrity
  D. lifetime
  B. encryption
  C. integrity

• Question 228:

  Which option is a benefit of DTLS as compared to TLS?

  A. increases performance
  B. controls packet order
  C. controls packet loss
  D. increases reliability
  A. increases performance

• Question 229:

  An engineer wants to ensure that Diffie-Helman keys are re-generated upon a pahse-2 rekey. What option can be configured to allow this?

  A. Aggressive mode
  B. Dead-peer detection
  C. Main mode
  D. Perfect-forward secrecy
  D. Perfect-forward secrecy

• Question 230:

  DRAG DROP

  Drag and drop the cryptographic algorithms for IPsec from the left onto the correct cryptographic processes on the right.

  Select and Place:

  

  

  ---

  Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/xe-3s/sec-sec-for-vpns-w-ipsec-xe-3s-book/sec-cfg-vpn-ipsec.html