Cisco 300-209 Online Practice Questions and Exam Preparation

Cisco 300-209 Online Questions & Answers

• Question 21:

  

  

  Which option shows the correct traffic selectors for the child SA on the remote ASA, when the headquarter ASA initiates the tunnel?

  A. Local selector 192.168.33.0/0-192.168.33.255/65535 Remote selector 192.168.20.0/0-192.168.20.255/65535
  B. Local selector 192.168.33.0/0-192.168.33.255/65535 Remote selector 192.168.22.0/0-192.168.22.255/65535
  C. Local selector 192.168.22.0/0-192.168.22.255/65535 Remote selector 192.168.33.0/0-192.168.33.255/65535
  D. Local selector 192.168.33.0/0-192.168.33.255/65535 Remote selector 0.0.0.0/0 - 0.0.0.0/65535
  E. Local selector 0.0.0.0/0 - 0.0.0.0/65535 Remote selector 192.168.22.0/0 -192.168.22.255/65535
  B. Local selector 192.168.33.0/0-192.168.33.255/65535 Remote selector 192.168.22.0/0-192.168.22.255/65535

• Question 22:

  A user is trying to connect to a Cisco IOS device using clientless SSL VPN and cannot establish the connection. Which three commands can be used for troubleshooting of the AAA subsystem? (Choose three.)

  A. debug aaa authentication
  B. debug radius
  C. debug vpn authorization error
  D. debug ssl openssl errors
  E. debug webvpn aaa
  F. debug ssl error
  A. debug aaa authentication
  B. debug radius
  E. debug webvpn aaa

• Question 23:

  An engineer is using DMVPN to provide secure connectivity between a data center and remote sites. Which two routing protocols are recommended for use between the routers? (Choose two.)

  A. EIGRP
  B. IS-IS
  C. RIPv2
  D. BGP
  E. OSPF
  A. EIGRP
  D. BGP

• Question 24:

  Refer to the exhibit. An administrator is adding IPv6 addressing to an already functioning tunnel. The administrator is unable to ping 2001:DB8:100::2 but can ping 209.165.200.226. Which configuration needs to be added or changed?

  

  A. No configuration change is necessary. Everything is working correctly.
  B. OSPFv3 needs to be configured on the interface.
  C. NHRP needs to be configured to provide NBMA mapping.
  D. Tunnel mode needs to be changed to GRE IPv4.
  E. Tunnel mode needs to be changed to GRE IPv6.
  D. Tunnel mode needs to be changed to GRE IPv4.

• Question 25:

  The Cisco AnyConnect client fails to connect via IKEv2 but works with SSL. The following error message is displayed:

  "Login Denied, unauthorized connection mechanism, contact your administrator"

  What is the most possible cause of this problem?

  A. DAP is terminating the connection because IKEv2 is the protocol that is being used.
  B. The client endpoint does not have the correct user profile to initiate an IKEv2 connection.
  C. The AAA server that is being used does not authorize IKEv2 as the connection mechanism.
  D. The administrator is restricting access to this specific user.
  E. The IKEv2 protocol is not enabled in the group policy of the VPN headend.
  E. The IKEv2 protocol is not enabled in the group policy of the VPN headend.

• Question 26:

  Which technology can provide high availability for an SSL VPN?

  A. DMVPN
  B. a multiple-tunnel configuration
  C. a Cisco ASA pair in active/passive failover configuration
  D. certificate to tunnel group maps
  C. a Cisco ASA pair in active/passive failover configuration

• Question 27:

  Refer to the exhibit, which result of this command is true?

  

  A. Makes the router generate a certificate signing request
  B. Generates an RSA key called TRIALFOUR
  C. It displays the RSA public keys of the router
  D. It specifies self- signed enrollment for a trust point
  D. It specifies self- signed enrollment for a trust point

• Question 28:

  Within a PKI system, which option is a trusted entity?

  A. registration authority
  B. root certificate
  C. certificate authority
  D. RSA authentication server
  C. certificate authority

• Question 29:

  When using clientless SSL VPN, you might not want some applications or web resources to go through the Cisco ASA appliance. For these application and web resources, as a Cisco ASA administrator, which configuration should you use?

  A. Configure the Cisco ASA appliance for split tunneling.
  B. Configure network access exceptions in the SSL VPN customization editor.
  C. Configure the Cisco ASA appliance to disable content rewriting.
  D. Configure the Cisco ASA appliance to enable URL Entry bypass.
  E. Configure smart tunnel to bypass the Cisco ASA appliance proxy function.
  C. Configure the Cisco ASA appliance to disable content rewriting.

• Question 30:

  An engineer is configuring SSL VPN to provide access to a corporate network for remote users.

  Traffic destined to the enterprise IP range should go over the tunnel and all other traffic should go directly to the internet.

  Which feature should be configured?

  A. dual-horning
  B. hairpinning
  C. split-tunnel
  D. U-turning
  C. split-tunnel