Cisco 300-209 Online Practice Questions and Exam Preparation

Cisco 300-209 Online Questions & Answers

• Question 351:

  Which two Cisco ASA licensing features are correct with Cisco ASA Software Version 8.3 and later? (Choose two.)

  A. Identical licenses are not required on the primary and secondary Cisco ASA appliance.
  B. Cisco ASA appliances configured as failover pairs disregard the time-based activation keys.
  C. Time-based licenses are stackable in duration but not in capacity.
  D. A time-based license completely overrides the permanent license, ignoring all permanently licensed features until the time-based license is uninstalled.
  A. Identical licenses are not required on the primary and secondary Cisco ASA appliance.
  C. Time-based licenses are stackable in duration but not in capacity.

• Question 352:

  A client has asked an engineer to assist in installing and upgrading to the latest version of Cisco Any Connect Secure and upgrading to the latest version of Cisco Any Connect Secure Mobility Client. Which type of deployment method requires the updated version of the client to be loaded only on the headend device such as an ASA or ISE device?

  A. Web-deploy
  B. Cloud-deploy
  C. Cloud-update
  D. Web-update
  A. Web-deploy

• Question 353:

  A customer requires site-to-site VPNs to connect third-party business partners and has purchased two ASAs.

  The customer requests an active/active configuration.

  Which model is needed to support an active/active solution?

  A. NAT context
  B. single context
  C. multiple context
  D. PAT context.
  C. multiple context

• Question 354:

  Which two operational advantages does Get VPN offer over site-to-site IPsec tunnel in a private MPLS-based core network? (Choose two.)

  A. Packets carry original source and destination IP addresses, which allows (or optimal routing of encrypted traffic.
  B. Group Domain of Interpretation protocol allows for homomorphic encryption, which allows group members to operate on messages without decrypting them.
  C. NETVPN is tunnel-less, which allows any group member to perform decryption and routing around network failures.
  D. Key servers perform encryption and decryption of all the data in the network, which allows for tight security policies
  E. Traffic uses one VRF to encrypt data and a different one to decrypt data, which allows for multicast traffic isolation
  A. Packets carry original source and destination IP addresses, which allows (or optimal routing of encrypted traffic.
  C. NETVPN is tunnel-less, which allows any group member to perform decryption and routing around network failures.

• Question 355:

  Which two statements about the running configuration of the Cisco ASA are true? (Choose Two)

  A. The auto NAT configuration causes all traffic arriving on the inside interface destined to any outside destinations to be translated with dynamic port address transmission using the outside interface IP address.
  B. The Cisco ASA is using the Cisco ASDM image from disk1:/asdm-642.bin
  C. The Cisco ASA is setup as the DHCP server for hosts that are on the inside and outside interfaces.
  D. SSH and Cisco ASDM access to the Cisco ASA requires AAA authentication using the LOCAL user database.
  E. The Cisco ASA is using a persistent self-signed certified so users can authenticate the Cisco ASA when accessing it via ASDM
  A. The auto NAT configuration causes all traffic arriving on the inside interface destined to any outside destinations to be translated with dynamic port address transmission using the outside interface IP address.
  E. The Cisco ASA is using a persistent self-signed certified so users can authenticate the Cisco ASA when accessing it via ASDM

• Question 356:

  Refer to the exhibit. A new NOC engineer, while viewing a real-time log from an SSL VPN tunnel, has a question about a line in the log.

  

  The IP address 172.26.26.30 is attached to which interface in the network?

  A. the Cisco ASA physical interface
  B. the physical interface of the end user
  C. the Cisco ASA SSL VPN tunnel interface
  D. the SSL VPN tunnel interface of the end user
  B. the physical interface of the end user

• Question 357:

  Which option lists the main tasks in the correct order to configure a new Layer 3 and 4 inspection policy on the Cisco ASA appliance using the Cisco ASDM Configuration > Firewall > Service Policy Rules pane?

  A. 1. Create a class map to identify which traffic to match. 2. Create a policy map and apply action(s) to the traffic class(es). 3. Apply the policy map to an interface or globally using a service policy.
  B. 1. Create a service policy rule. 2. Identify which traffic to match. 3. Apply action(s) to the traffic.
  C. 1. Create a Layer 3 and 4 type inspect policy map. 2. Create class map(s) within the policy map to identify which traffic to match. 3. Apply the policy map to an interface or globally using a service policy.
  D. 1. Identify which traffic to match. 2. Apply action(s) to the traffic. 3. Create a policy map. 4. Apply the policy map to an interface or globally using a service policy.
  B. 1. Create a service policy rule. 2. Identify which traffic to match. 3. Apply action(s) to the traffic.

• Question 358:

  In FlexVPN, what is the role of a NHRP resolution request?

  A. It allows these entities to directly communicate without requiring traffic to use an intermediate hop
  B. It dynamically assigns VPN users to a group
  C. It blocks these entities from to directly communicating with each other
  D. It makes sure that each VPN spoke directly communicates with the hub
  A. It allows these entities to directly communicate without requiring traffic to use an intermediate hop

• Question 359:

  Why must a network engineer avoid usage of the default X509 certificate when implementing clientless SSLVPN on an ASA?

  A. The certificate is too weak to provide adequate security.
  B. The certificate is regenerated at each reboot.
  C. The certificate must be managed by the local CA.
  D. The default X.509 certificate is not supported for SSLVPN.
  C. The certificate must be managed by the local CA.

• Question 360:

  

  

  An engineer wants to ensure that employees cannot access corporate resources on untrusted networks, but does not want a new VPN session to be established each time they leave the trusted network. Which Cisco AnyConnect Trusted Network Policy option allows this ability?

  A. Pause
  B. Connect
  C. Do Nothing
  D. Disconnect
  A. Pause