Cisco 300-209 Online Practice Questions and Exam Preparation

Cisco 300-209 Online Questions & Answers

• Question 421:

  A private wan connection is suspected of intermittently corrupting data. Which technology can a network administrator use to detect and drop the altered data traffic?

  A. AES-128
  B. RSA Certificates
  C. SHA2-HMAC
  D. 3DES
  E. Diffie-Helman Key Generation
  C. SHA2-HMAC

• Question 422:

  Which option is most effective at preventing a remote access VPN user from bypassing the corporate transparent web proxy?

  A. using the proxy-server settings of the client computer to specify a PAC file for the client computer to download
  B. instructing users to use the corporate proxy server for all web browsing
  C. disabling split tunneling
  D. permitting local LAN access
  C. disabling split tunneling

• Question 423:

  Which two options arc purposes of the key server in Cisco IOS GETVPN? (Choose two.)

  A. to define group members.
  B. to distribute static routing information.
  C. to distribute dynamic routing information.
  D. to encrypt transit traffic.
  A. to define group members.
  D. to encrypt transit traffic.

• Question 424:

  A customer requires all traffic to go through a VPN. However, access to the local network is also required. Which two options can enable this configuration? (Choose two.)

  A. split exclude
  B. use of an XML profile
  C. full tunnel by default
  D. split tunnel
  E. split include
  A. split exclude
  B. use of an XML profile

• Question 425:

  A user at a company HQ is having trouble accessing a network share at a branch site, connected with a L2L IPsec VPN. While troubleshooting, a network security engineer runs a packet tracer on the Cisco ASA to simulate the user traffic and finds that the encryption counter is increasing but the decryption counter is not. Which misconfiguration is causing this issue?

  A. PSK
  B. ACLs
  C. peer IP address
  D. phase II
  B. ACLs

• Question 426:

  

  Refer to the exhibit. Which action must be taken to allow IKEv2 Cisco AnyConnect access on the outside interface?

  A. IPsec (IKev2) Allow Access must be checked.
  B. SSL Allow Access must be unchecked.
  C. Enable DTLS must be unchecked.
  D. The inside interface SSL Allow Access must be checked.
  A. IPsec (IKev2) Allow Access must be checked.

• Question 427:

  Your company network security policy requires that all network traffic be tunneled to the corporate office. End users must be able to access local LAN resources when they connect to the corporate network. Which two configurations do you implement in Cisco AnyConnect? (Choose two.)

  A. split-exclude tunneling
  B. local LAN access
  C. static routes
  D. Client Bypass Protocol
  E. tunnel all
  B. local LAN access
  E. tunnel all

• Question 428:

  Which two statements about the internet Key Exchange version 1 are true? (Choose two)

  A. Aggressive mode negotiates faster than main mode.
  B. When using aggressive mode, perfect forward secrecy is required.
  C. When using aggressive mode, the initiator and responder identities are passed in clear
  D. Main mode negotiates faster than aggressive mode.
  E. When using main mode, the initiator and responder identities are passed in clear text
  A. Aggressive mode negotiates faster than main mode.
  C. When using aggressive mode, the initiator and responder identities are passed in clear

• Question 429:

  Refer to the exhibit. In this tunnel mode GRE multipoint example, which command on the hub router distinguishes one spoken form the other?

  

  A. no ip route
  B. ip nhrp map
  C. ip frame-relay
  D. tunnel mode gre multipoint
  B. ip nhrp map

• Question 430:

  During a SSL session between a client and a server, who is the responsible for generating the master key that generates the symmetric keys that are used during the session?

  A. public key infrastructure
  B. client browser
  C. web server
  D. cipher suite
  B. client browser