Cisco 300-209 Online Practice Questions and Exam Preparation

Cisco 300-209 Online Questions & Answers

• Question 331:

  Refer to the exhibit. A junior network engineer configured the corporate Cisco ASA appliance to accommodate a new temporary worker. For security reasons, the IT department wants to restrict the internal network access of the new

  temporary worker to the corporate server, with an IP address of 10.0.4.10. After the junior network engineer finished the configuration, an IT security specialist tested the account of the temporary worker. The tester was able to access the

  URLs of additional secure servers from the WebVPN user account of the temporary worker.

  What did the junior network engineer configure incorrectly?

  

  A. The ACL was configured incorrectly.
  B. The ACL was applied incorrectly or was not applied.
  C. Network browsing was not restricted on the temporary worker group policy.
  D. Network browsing was not restricted on the temporary worker user policy.
  B. The ACL was applied incorrectly or was not applied.

• Question 332:

  An engineer is troubleshooting VPN connectivity issues between a PC and ASA using Cisco AnyConnect IPsec IKEv2. Which requirement must be satisfied for proper functioning?

  A. PC certificate must contain the server-auth EKU.
  B. The connection must use EAP-AnyConnect.
  C. The SAN must be used as the CN for the ASA-side certificates.
  D. profile and binary updates must be downloading over IPSec
  A. PC certificate must contain the server-auth EKU.

• Question 333:

  You are troubleshooting a DMVPN NHRP registration failure. Which command can you use to view request counters?

  A. show ip nhrp nhs detail
  B. show ip nhrp tunnel
  C. show ip nhrp incomplete
  D. show ip nhrp incomplete tunnel tunnel_interface_number
  A. show ip nhrp nhs detail

• Question 334:

  What represents a possible network configuration issue in clientless SSL VPN deployment?

  A. The AnyConnect version is not up to date
  B. NAT exemption has not been configured
  C. The VPN IP pool is exhausted
  D. The SSL server public certificate is untrusted
  D. The SSL server public certificate is untrusted

• Question 335:

  In the Cisco ASDM interface, where do you enable the DTLS protocol setting?

  A. Configuration > Remote Access VPN > Network (Client) Access > Group Policies > Add or Edit > Add or Edit Internal Group Policy
  B. Configuration > Remote Access VPN > Network (Client) Access > AAA Setup > Local Users > Add or Edit
  C. Device Management > Users/AAA > User Accounts > Add or Edit > Add or Edit User Account > VPN Policy > SSL VPN Client
  D. Configuration > Remote Access VPN > Network (Client) Access > Group Policies > Add or Edit
  D. Configuration > Remote Access VPN > Network (Client) Access > Group Policies > Add or Edit

• Question 336:

  Which protocol supports high availability in a Cisco IOS SSL VPN environment?

  A. HSRP
  B. VRRP
  C. GLBP
  D. IRDP
  A. HSRP

• Question 337:

  

  Refer to the exhibit. Which VPN technology produces this configuration output?

  A. DVTI
  B. SVTI
  C. DMVPN
  D. FlexVPN
  C. DMVPN

• Question 338:

  Which option is the main difference between GET VPN and DMVPN?

  A. AES encryption support
  B. dynamic spoke-to-spoke tunnel communications
  C. Next Hop Resolution Protocol
  D. Group Domain of Interpretation protocol
  B. dynamic spoke-to-spoke tunnel communications

• Question 339:

  Which two troubleshooting steps should be taken when Cisco AnyConnect cannot establish an IKEv2 connection, while SSL works fine? (Choose two.)

  A. Verify that the primary protocol on the client machine is set to IPsec.
  B. Verify that AnyConnect is enabled on the correct interface.
  C. Verify that the IKEv2 protocol is enabled on the group policy.
  D. Verify that ASDM and AnyConnect are not using the same port.
  E. Verify that SSL and IKEv2 certificates are not referencing the same trustpoint.
  A. Verify that the primary protocol on the client machine is set to IPsec.
  C. Verify that the IKEv2 protocol is enabled on the group policy.

• Question 340:

  Refer to the exhibit. A NOC engineer needs to tune some postlogin parameters on an SSL VPN tunnel.

  

  From the information shown, where should the engineer navigate to, in order to find all the postlogin session parameters?

  A. "engineering" Group Policy
  B. "contractor" Connection Profile
  C. DefaultWEBVPNGroup Group Policy
  D. DefaultRAGroup Group Policy
  E. "engineer1" AAA/Local Users
  B. "contractor" Connection Profile