Cisco 300-209 Online Practice Questions and Exam Preparation

Cisco 300-209 Online Questions & Answers

• Question 61:

  The following configuration steps have been completed:

  -WebVPN was enabled on the ASA outside interface.

  -SSL VPN client software was loaded to the ASA.

  - A DHCP scope was configured and applied to a WebVPN Tunnel Group.

  What additional step is required if the client software fails to load when connecting to the ASA SSL page?

  A. The SSL client must be loaded to the client by an ASA administrator
  B. The SSL client must be downloaded to the client via FTP
  C. The SSL VPN client must be enabled on the ASA after loading
  D. The SSL client must be enabled on the client machine before loading
  C. The SSL VPN client must be enabled on the ASA after loading

• Question 62:

  

  Refer to the exhibit. You are implementing an IKEv2 Ipsec tunnel between two Internet routers by using PSKs. After the configuration is complete, the Ipsec VPN tunnel fails to negotiate. You enable debugging to troubleshoot the issue. Which action do you take to resolve the issue?

  A. Verify the IKEv2 keyring address and PSK configuration on both routers.
  B. Configure an IKEv2 authorization policy to authorize the peer router.
  C. Configure the IKEv2 identity of each router by using an email address.
  D. Modify the Diffie-Hellman key used in the IKEv2 policy.
  D. Modify the Diffie-Hellman key used in the IKEv2 policy.

• Question 63:

  An engineer is troubleshooting IPsec VPN and wants to review the IKE connectivity status between peers. Which IKE status indicates that all is running properly?

  A. AG_AUTH
  B. QM_IDLE
  C. MM_SA_SETUP
  D. AC_INT_EXCH
  B. QM_IDLE

• Question 64:

  When Cisco ASA applies VPN permissions, what is the first set of attributes that it applies?

  A. dynamic access policy attributes
  B. group policy attributes
  C. connection profile attributes
  D. user attributes
  A. dynamic access policy attributes

• Question 65:

  Which three configuration parameters are mandatory for an IKEv2 profile? (Choose three.)

  A. IKEv2 proposal
  B. local authentication method
  C. match identity or certificate
  D. IKEv2 policy
  E. PKI certificate authority
  F. remote authentication method
  G. IKEv2 profile description
  H. virtual template
  B. local authentication method
  C. match identity or certificate
  F. remote authentication method

• Question 66:

  When a Cisco ASA is configured for Active/Standby failover, what is replicated between the devices?

  A. HostScan images
  B. Cisco AnyConnect profiles
  C. VPN sessions
  D. Cisco AnyConnect images
  C. VPN sessions

• Question 67:

  An engineer is configuring clientless SSL VPN. The finance department has a database server that only they should access, but the sales department can currently access it. The finance and the sales departments are configured as separate group-policies. Which option must be added to the configuration to make sure the users in the sales department cannot access the finance department server?

  A. Web type ACL
  B. Port forwarding
  C. Tunnel group lock
  D. VPN filter ACL
  C. Tunnel group lock

• Question 68:

  Refer to the exhibit. Which VPN solution does this configuration represent?

  

  A. Cisco AnyConnect (IKEv2)
  B. site-to-site
  C. DMVPN
  D. SSL VPN
  D. SSL VPN

• Question 69:

  Refer to the exhibit. The user "contractor" inherits which VPN group policy?

  

  A. employee
  B. management
  C. DefaultWEBVPNGroup
  D. DfltGrpPolicy
  E. new_hire
  D. DfltGrpPolicy

• Question 70:

  When you configure an access list on the external interface of a FlexVPN hub, which step is optional

  A. allowing ICMP protocol
  B. allowing IP Protocol 50
  C. allowing UDP port 500
  D. allowing UDP port 4500
  A. allowing ICMP protocol