Cisco 300-209 Online Practice Questions and Exam Preparation

Cisco 300-209 Online Questions & Answers

• Question 441:

  Refer to the exhibit. A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which action can bring up the VPN tunnel?

  

  A. Increase the maximum SA limit on the local Cisco ASA.
  B. Correct the crypto access list on both Cisco ASA devices.
  C. Remove the maximum SA limit on the remote Cisco ASA.
  D. Reduce the maximum SA limit on the local Cisco ASA.
  E. Correct the IP address in the local and remote crypto maps.
  F. Increase the maximum SA limit on the remote Cisco ASA.
  A. Increase the maximum SA limit on the local Cisco ASA.

• Question 442:

  Which command clears all crypto configuration from a Cisco Adaptive Security Appliance?

  A. clear configure crypto
  B. clear configure crypto ipsec
  C. clear crypto map
  D. clear crypto ikev2 sa
  A. clear configure crypto

• Question 443:

  Refer to the exhibit. A NOC engineer is in the process of entering information into the Create New VPN Connection Entry fields.

  

  Which statement correctly describes how to do this?

  A. In the Connection Entry field, enter the name of the connection profile as it is specified on the Cisco ASA appliance.
  B. In the Host field, enter the IP address of the remote client device.
  C. In the Authentication tab, click the Group Authentication or Mutual Group Authentication radio button to enable symmetrical pre-shared key authentication.
  D. In the Name field, enter the name of the connection profile as it is specified on the Cisco ASA appliance.
  D. In the Name field, enter the name of the connection profile as it is specified on the Cisco ASA appliance.

• Question 444:

  Authorization of a clientless SSL VPN defines the actions that a user may perform within a clientless SSL VPN session. Which statement is correct concerning the SSL VPN authorization process?

  A. Remote clients can be authorized by applying a dynamic access policy, which is configured on an external AAA server.
  B. Remote clients can be authorized externally by applying group parameters from an external database.
  C. Remote client authorization is supported by RADIUS and TACACS+ protocols.
  D. To configure external authorization, you must configure the Cisco ASA for cut-through proxy.
  B. Remote clients can be authorized externally by applying group parameters from an external database.

• Question 445:

  In a spoke-to-spoke DMVPN topology, which type of interface does a branch router require?

  A. virtual tunnel interface
  B. multipoint GRE interface
  C. point-to-point GRE interface
  D. loopback interface
  B. multipoint GRE interface

• Question 446:

  Refer to the exhibit. Which VPN solution does this configuration represent?

  

  A. DMVPN
  B. GETVPN
  C. FlexVPN
  D. site-to-site
  C. FlexVPN

• Question 447:

  Which Cisco adaptive security appliance command can be used to view the IPsec PSK of a tunnel group in cleartext?

  A. more system:running-config
  B. show running-config crypto
  C. show running-config tunnel-group
  D. show running-config tunnel-group-map
  E. clear config tunnel-group
  F. show ipsec policy
  A. more system:running-config

• Question 448:

  Which three configurations are prerequisites for stateful failover for IPsec? (Choose three.)

  A. Only the IKE configuration that is set up on the active device must be duplicated on the standby device; the IPsec configuration is copied automatically.
  B. Only crypto map configuration that is set up on the active device must be duplicated on the standby device.
  C. The IPsec configuration that is set up on the active device must be duplicated on the standby device.
  D. The active and standby devices can run different versions of the Cisco IOS software but need to be the same type of device.
  E. The active and standby devices must run the same version of the Cisco IOS software and should be the same type of device.
  F. Only the IPsec configuration that is set up on the active device must be duplicated on the standby device; the IKE configuration is copied automatically.
  G. The IKE configuration that is set up on the active device must be duplicated on the standby device.
  C. The IPsec configuration that is set up on the active device must be duplicated on the standby device.
  E. The active and standby devices must run the same version of the Cisco IOS software and should be the same type of device.
  G. The IKE configuration that is set up on the active device must be duplicated on the standby device.

• Question 449:

  Which command clears all Cisco AnyConnect VPN sessions?

  A. vpn-sessiondb logoff anyconnect
  B. vpn-sessiondb logoff webvpn
  C. vpn-sessiondb logoff l2l
  D. clear crypto isakmp sa
  A. vpn-sessiondb logoff anyconnect

• Question 450:

  Using the Next Generation Encryption technologies, which is the minimum acceptable encryption level to protect sensitive information?

  A. AES 92 bits
  B. AES 128 bits
  C. AES 256 bits
  D. AES 512 bits
  B. AES 128 bits