Cisco 300-209 Online Practice Questions and Exam Preparation

Cisco 300-209 Online Questions & Answers

• Question 311:

  What are the three primary components of a GET VPN network? (Choose three.)

  A. Group Domain of Interpretation protocol
  B. Simple Network Management Protocol
  C. server load balancer
  D. accounting server
  E. group member
  F. key server
  A. Group Domain of Interpretation protocol
  E. group member
  F. key server

• Question 312:

  Which two options are benefits of IKEv2 over IKEv1? (choose two)

  A. IKEv2 supports NAT traversal whereas IKEv1 cannot
  B. IKEv2 supports EAP for remote access connections
  C. IKEv2 supports sending identifiers in clear text
  D. IKEv2 supports stronger encryption ciphers than IKEv1
  E. IKEv2 supports public key encryption whereas IKEv1 does not
  B. IKEv2 supports EAP for remote access connections
  C. IKEv2 supports sending identifiers in clear text

• Question 313:

  What are two benefits of SSL VPN versus IPsec VPN when considering a remote-access VPN technology? (Choose two.)

  A. It works in environment that are heavily filtered
  B. It is accessible via web browser
  C. It allows for increased client customization
  D. It leverages existing network infrastructure
  E. It minimizes desktop support
  B. It is accessible via web browser
  C. It allows for increased client customization

• Question 314:

  Which PKI enrollment method allows the user to separate authentication and enrollment actions and also provides an option to specify HTTP/TFTP commands to perform file retrieval from the server?

  A. enrollment profile
  B. enrollment terminal
  C. enrollment url
  D. enrollment selfsigned
  A. enrollment profile

• Question 315:

  Refer to the exhibit. You configure Clientless SSL VPN on a Cisco ASA. Users from Company A cannot connect to the Clientless SSL VPN. Which possible cause of the connection failure is most likely?

  

  A. The users have authentication issues
  B. The users are behind the same NAT IP address
  C. An ACL for DAP is blocking the users
  D. The license limit is exceeded
  B. The users are behind the same NAT IP address

• Question 316:

  Refer to the Exhibit. Which description of the status of this VPN tunnel is true?

  

  A. The pre shared key in phase 1 is mismatched between tunnel endpoints
  B. The phase 1 is complete, phase 2 status is unknown
  C. The integrity algorithm does not match between the two endpoints.
  D. The tunnel is up and waiting for traffic to flow across it
  A. The pre shared key in phase 1 is mismatched between tunnel endpoints

• Question 317:

  Which protocol must be enabled on the inside interface to use cluster encryption in SSL VPN load balancing?

  A. TLS
  B. DTLS
  C. IKEv2
  D. ISAKMP
  D. ISAKMP

• Question 318:

  Which command will allow a referenced ASA interface to become accessible across a site-to-site VPN?

  A. access-list 101 extended permit ICMP any any
  B. crypto map vpn 10 match address 101
  C. crypto map vpn interface inside
  D. management-access
  D. management-access

• Question 319:

  Scenario

  Your organization has just implemented a Cisco AnyConnect SSL VPN solution. Using Cisco ASDM, answer the questions regarding the implementation. Note: Not all screens or option selections are active for this exercise.

  

  Topology

  

  Default_Home

  

  

  

  

  

  

  

  Which address range will be assigned to the AnyConnect users?

  A. Check the explanation

  Explanation:

  ---

  First Navigate to the Configuration -> Remote Access VPN tab and then choose the “AnyConnect Connection Profile as shown below:

  

  Then, clicking on the AnyConnect Profile at the bottom will bring you to the edit page shown below:

  

  From here, click the Select button on the “VPN_Address_Pool” and you will see the following pools defined:

  

  Here we see that the VPN_Address_Pool contains the IP address range of 10.10.15.20-10.10.15.30/24.

• Question 320:

  Which other match command is used with the match flow ip destination-address command within the class map configurations of the Cisco ASA MPF?

  A. match tunnel-group
  B. match access-list
  C. match default-inspection-traffic
  D. match port
  E. match dscp
  A. match tunnel-group