Cisco 300-209 Online Practice Questions and Exam Preparation

Cisco 300-209 Online Questions & Answers

• Question 411:

  

  

  After implementing the IKEv2 tunnel, it was observed that remote users on the 192.168.33.0/24 network are unable to access the internet. Which of the following can be done to resolve this problem?

  A. Change the Diffie-Hellman group on the headquarter ASA to group5forthe dynamic crypto map
  B. Change the remote traffic selector on the remote ASA to 192.168.22.0/24
  C. Change to an IKEvI configuration since IKEv2 does not support a full tunnel with static peers
  D. Change the local traffic selector on the headquarter ASA to 0.0.0.0/0
  E. Change the remote traffic selector on the headquarter ASA to 0.0.0.0/0
  B. Change the remote traffic selector on the remote ASA to 192.168.22.0/24

• Question 412:

  Refer to the exhibit. Which two characteristics of the VPN implementation are evident? (Choose two.)

  

  A. dual DMVPN cloud setup with dual hub
  B. DMVPN Phase 3 implementation
  C. single DMVPN cloud setup with dual hub
  D. DMVPN Phase 1 implementation
  E. quad DMVPN cloud with quadra hub
  F. DMVPN Phase 2 implementation
  B. DMVPN Phase 3 implementation
  C. single DMVPN cloud setup with dual hub

• Question 413:

  Where is split-tunneling defined for remote access clients on an ASA?

  A. Group-policy
  B. Tunnel-group
  C. Crypto-map
  D. Web-VPN Portal
  E. ISAKMP client
  A. Group-policy

• Question 414:

  

  Refer to the exhibit. You are implementing an IKEv1 Ipsec tunnel between two Internet routers by using PSKs. After the configuration is complete, the Ipsec VPN tunnel fails to negotiate. What must be configured to resolve the issue?

  A. matching PSKs on both routers
  B. matching ISAKMP policies on both routers
  C. correct tunnel destinations on both routers
  D. ISAKMP identity for both routers
  B. matching ISAKMP policies on both routers

• Question 415:

  An engineer is defining ECC variables and has set the input_mode set to B. Which statement is true?

  A. DTMF voice is accepted
  B. Get Digits are written to the CED
  C. Mixed mode input is not accepted
  D. An ASR is not being used
  C. Mixed mode input is not accepted

• Question 416:

  Which Cisco ASA SSL VPN feature provides support for PCI compliance by allowing for the validation of two sets of username and password credentials on the SSL VPN login page?

  A. Single Sign-On
  B. Certificate to Profile Mapping
  C. Double Authentication
  D. RSA OTP
  C. Double Authentication

• Question 417:

  Which two components are required for a Cisco IOS-based PKI solution? (Choose two)

  A. FTP/HTTP server
  B. certificate authority
  C. RADIUS server
  D. NTP
  B. certificate authority
  D. NTP

• Question 418:

  Which two operational advantages does GetVPN offer over site-to-site IPsec tunnel in a private MPLS-based core network? (Choose two.)

  A. Key servers perform encryption and decryption of all the data in the network, which allows for tight security policies.
  B. Traffic uses one VRF to encrypt data and a different on to decrypt data, which allows for multicast traffic isolation.
  C. GETVPN is tunnel-less, which allows any group member to perform decryption and routing around network failures.
  D. Packets carry original source and destination IP addresses, which allows for optimal routing of encrypted traffic.
  E. Group Domain of Interpretation protocol allows for homomorphic encryption, which allows group members to operate on messages without decrypting them
  C. GETVPN is tunnel-less, which allows any group member to perform decryption and routing around network failures.
  D. Packets carry original source and destination IP addresses, which allows for optimal routing of encrypted traffic.

• Question 419:

  When you troubleshoot Cisco AnyConnect, which step does Cisco recommend before you open a TAC case?

  A. Show applet Lifecycle exceptions.
  B. Disable cookies.
  C. Enable the WebVPN cache.
  D. Collect a DART bundle.
  D. Collect a DART bundle.

• Question 420:

  Scenario:

  You are the senior network security administrator for your organization. Recently and junior engineer configured a site-to-site IPsec VPN connection between your headquarters Cisco ASA and a remote branch office. You are now tasked with

  verifying the IKEvl IPsec installation to ensure it was properly configured according to designated parameters. Using the CLI on both the Cisco ASA and branch ISR. verify the IPsec configuration is properly configured between the two sites.

  NOTE: the show running-config command cannot be used for the this exercise.

  Topology:

  

  Which crypto map tag is being used on the Cisco ASA?

  A. outside_cryptomap
  B. VPN-to-ASA
  C. L2L_Tunnel
  D. outside_map1
  D. outside_map1