Cisco 300-209 Online Practice Questions and Exam Preparation

Cisco 300-209 Online Questions & Answers

• Question 41:

  Refer to the exhibit. Which technology is represented by this configuration?

  

  A. AAA for FlexVPN
  B. AAA for EzVPN
  C. TACACS+ command authorization
  D. local command authorization
  A. AAA for FlexVPN

• Question 42:

  Which command displays the NBMA IP addresses when DMVPN is configured with tunnel protection?

  A. show crypto session
  B. show ip nhrp
  C. show ip interface tunnel
  D. show crypto socket
  B. show ip nhrp

• Question 43:

  Which statement is true when implementing a router with a dynamic public IP address in a crypto map based site-to-site VPN?

  A. The router must be configured with a dynamic crypto map.
  B. Certificates are always used for phase 1 authentication.
  C. The tunnel establishment will fail if the router is configured as a responder only.
  D. The router and the peer router must have NAT traversal enabled.
  C. The tunnel establishment will fail if the router is configured as a responder only.

• Question 44:

  What are two forms of SSL VPN? (Choose two.)

  A. port forwarding
  B. Full Tunnel Mode
  C. Cisco IOS WebVPN
  D. Cisco AnyConnect
  A. port forwarding
  B. Full Tunnel Mode

• Question 45:

  An engineer is troubleshooting network issues and wants to check the Layer 2 connectivity between routers. Which command must be run?

  A. show ip eigrp neighbors
  B. show cdp neighbor
  C. show crypto isakmp sa
  D. show crypto ipsec sa
  B. show cdp neighbor

• Question 46:

  When initiating a new SSL or TLS session, the client receives the server SSL certificate and validates it. After validating the server certificate, what does the client use the certificate for?

  A. The client and server use the server public key to encrypt the SSL session data.
  B. The server creates a separate session key and sends it to the client. The client decrypts the session key by using the server public key.
  C. The client and server switch to a DH key exchange to establish a session key.
  D. The client generates a random session key, encrypts it with the server public key, and then sends it to the server.
  D. The client generates a random session key, encrypts it with the server public key, and then sends it to the server.

• Question 47:

  Which feature is available in IKEv1 but not IKEv2?

  A. Layer 3 roaming
  B. aggressive mode
  C. EAP variants
  D. sequencing
  B. aggressive mode

• Question 48:

  Which Cisco adaptive security appliance command can be used to view the count of all active VPN sessions?

  A. show vpn-sessiondb summary
  B. show crypto ikev1 sa
  C. show vpn-sessiondb ratio encryption
  D. show iskamp sa detail
  E. show crypto protocol statistics all
  A. show vpn-sessiondb summary

• Question 49:

  The Cisco ASA software image has been erased from flash memory. Which two statements about the process to recover the Cisco ASA software image are true? (Choose two.)

  A. Access to the ROM monitor mode is required.
  B. The Cisco ASA appliance must have connectivity to the TFTP server where the Cisco ASA image is stored through the Management 0/0 interface.
  C. The copy tftp flash command is necessary to start the TFTP file transfer.
  D. The server command is necessary to set the TFTP server IP address.
  E. Cisco ASA password recovery must be enabled
  A. Access to the ROM monitor mode is required.
  D. The server command is necessary to set the TFTP server IP address.

• Question 50:

  Refer to the Exhibit. Why is the tunnel not establishing?

  

  A. Lifetimes are misconfigured.
  B. SAKMP packets are blocked.
  C. NAT statements are missing.
  D. GRE is not working correctly.
  B. SAKMP packets are blocked.