Cisco 300-730 Online Practice Questions and Exam Preparation

Cisco 300-730 Online Questions & Answers

• Question 161:

  A network engineer must design a clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was found that one website is not being rewritten correctly by the ASA. What is a potential solution for this issue while still allowing it to be a clientless VPN setup?

  A. Set up a smart tunnel with the IP address of the web server.
  B. Set up a NAT rule that translates the ASA public address to the web server private address on port 80.
  C. Set up Cisco AnyConnect with a split tunnel that has the IP address of the web server.
  D. Set up a WebACL to permit the IP address of the web server.
  A. Set up a smart tunnel with the IP address of the web server.

  ---

  Explanation

• Question 162:

  Which parameter must match on all routers in a DMVPN Phase 3 cloud?

  A. GRE tunnel key
  B. NHRP network ID
  C. tunnel VRF
  D. EIGRP split-horizon setting
  A. GRE tunnel key

  ---

  Explanation

• Question 163:

  Which feature of GETVPN is a limitation of DMVPN and FlexVPN?

  A. sequence numbers that enable scalable replay checking
  B. enabled use of ESP or AH
  C. design for use over public or private WAN
  D. no requirement for an overlay routing protocol
  D. no requirement for an overlay routing protocol

  ---

  Explanation

• Question 164:

  Over which two transport mediums is FlexVPN deployed? (Choose two.)

  A. 5G
  B. VPLS
  C. internet
  D. MPLS
  E. DWDM
  C. internet
  D. MPLS

  ---

  Explanation

• Question 165:

  An engineer is creating an URL object on Cisco FMC. How must it be configured so that the object will match for HTTPS traffic in an access control policy?

  A. Specify the protocol to match (HTTP or HTTPS).
  B. Use the FQDN including the subdomain for the website.
  C. Use the subject common name from the website certificate.
  D. Define the path to the individual webpage that uses HTTPS.
  B. Use the FQDN including the subdomain for the website.

  ---

  Explanation

  Use the FQDN including the subdomain for the website. According to the Firepower Management Center Configuration Guide, Version 6.61, when you create a URL object, you must use the fully qualified domain name (FQDN) of the website, including any subdomains, and omit the protocol prefix (HTTP or HTTPS). For example, to match www.example.com, you must enter www.example.com as the URL object value, not http://www.example.com or https://www.example.com. The system automatically matches both HTTP and HTTPS traffic for the same FQDN. Specifying the protocol to match (HTTP or HTTPS) is not required and will result in an invalid URL object. Using the subject common name from the website certificate or defining the path to the individual webpage that uses HTTPS are not supported options for URL objects.

• Question 166:

  Which parameter is initially used to elect the primary key server from a group of key servers?

  A. code version
  B. highest IP address
  C. highest-priority value
  D. lowest IP address
  C. highest-priority value

  ---

  Explanation

  https://www.cisco.com/c/en/us/products/collateral/security/group-encrypted-transport-vpn/deployment_guide_c07_554713.html

• Question 167:

  When a FlexVPN is configured, which two components must be configured for IKEv2? (Choose two.)

  A. method
  B. profile
  C. proposal
  D. preference
  E. persistence
  B. profile
  C. proposal

  ---

  Explanation

• Question 168:

  Refer to the exhibit.

  

  The customer can establish a Cisco AnyConnect connection without using an XML profile. When the host "ikev2" is selected in the AnyConnect drop down, the connection fails. What is the cause of this issue?

  A. The HostName is incorrect.
  B. The IP address is incorrect.
  C. Primary protocol should be SSL.
  D. UserGroup must match connection profile.
  D. UserGroup must match connection profile.

  ---

  Explanation

  https://community.cisco.com/t5/security-documents/anyconnect-xml-settings/ta-p/3157891

• Question 169:

  A network engineer is configuring a server. The router will terminate encrypted VPN connections on g0/0, which is in the VRF "Internet". The clear-text traffic that must be encrypted before being sent out traverses g0/1, which is in the VRF "Internal". Which two VRF-specific configurations allow VPN traffic to traverse the VRF-aware interfaces? (Choose two.)

  A. Under the IKEv2 profile, add the ivrf Internal command.
  B. Under the virtual-template interface, add the ip vrf forwarding Internet command.
  C. Under the IKEv2 profile, add the match fvrf Internal command.
  D. Under the IKEv2 profile, add the match fvrf Internet command.
  E. Under the virtual-template interface, add the tunnel vrf Internet command.
  D. Under the IKEv2 profile, add the match fvrf Internet command.
  E. Under the virtual-template interface, add the tunnel vrf Internet command.

  ---

  Explanation

• Question 170:

  Refer to the exhibit.

  

  Which type of VPN implementation is displayed?

  A. IKEv1 cluster
  B. IKEv2 backup gateway
  C. IKEv2 load balancer
  D. IKEv2 reconnect
  C. IKEv2 load balancer

  ---

  Explanation