Cisco 300-730 Online Practice Questions and Exam Preparation

Cisco 300-730 Online Questions & Answers

• Question 171:

  An engineer must investigate a connectivity issue and decides to use the packet capture feature on Cisco FTD. The goal is to see the real packet going through the Cisco FTD device and see Snort detection actions as a part of the output. After the capture-traffic command is issued, only the packets are displayed. Which action resolves this issue?

  A. Specify the trace using the -T option after the capture-traffic command
  B. Perform the trace within the Cisco FMC GUI instead of the Cisco FMC CLI
  C. Use the verbose option as a part of the capture-traffic command
  D. Use the capture command and specify the trace option to get the required information
  A. Specify the trace using the -T option after the capture-traffic command

  ---

  Explanation

  The correct answer is A. Specify the trace using the -T option after the capture-traffic command. According to the document Use Firepower Threat Defense Captures and Packet Tracer, the capture-traffic command allows you to capture packets on the Snort engine domain of the FTD device. However, by default, it only shows the packet headers and does not include the Snort detection actions. To see the Snort detection actions, you need to use the -T option, which enables tracing. For example: capture-traffic -T This will show the packet headers along with the Snort verdicts, such as allow, block, or replace. You can also use other options to filter or save the capture output1.

  B. Performing the trace within the Cisco FMC GUI instead of the Cisco FMC CLI is not a valid option, because the FMC GUI does not support packet capture or tracing on the FTD device. You can only use the FMC GUI to view and export captures that are taken on the FTD CLI1.

  C. Using the verbose option as a part of the capture-traffic command is not a valid option, because there is no verbose option for this command. The verbose option is only available for the capture command, which is used to capture packets on the LINA engine domain of the FTD device1.

  D. Using the capture command and specifying the trace option to get the required information is not a valid option, because the capture command does not have a trace option. The capture command allows you to capture packets on the LINA engine domain of the FTD device, but it does not show the Snort detection actions. The trace option is only available for the packet-tracer command, which is used to simulate a packet going through the FTD device and show its processing steps1.

• Question 172:

  Which state indicates that BFD is missing on a peer when troubleshooting DMVPN?

  A. DOWN(D)
  B. NONE(N)
  C. UP(U)
  D. INVALID(I)
  B. NONE(N)

  ---

  Explanation

• Question 173:

  An administrator is designing a VPN with a partner's non-Cisco VPN solution. The partner's VPN device will negotiate an IKEv2 tunnel that will only encrypt subnets 192.168.0.0/24 going to 10.0.0.0/24. Which technology must be used to meet these requirements?

  A. VTI
  B. crypto map
  C. GETVPN
  D. DMVPN
  B. crypto map

  ---

  Explanation

• Question 174:

  Refer to the exhibit.

  

  What is a result of this configuration?

  A. Spoke 1 fails the authentication because the authentication methods are incorrect.
  B. Spoke 2 passes the authentication to the hub and successfully proceeds to phase 2.
  C. Spoke 2 fails the authentication because the remote authentication method is incorrect.
  D. Spoke 1 passes the authentication to the hub and successfully proceeds to phase 2.
  A. Spoke 1 fails the authentication because the authentication methods are incorrect.

  ---

  Explanation

• Question 175:

  Which command is used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?

  A. show crypto ikev2 sa
  B. show crypto isakmp sa
  C. show crypto gkm
  D. show crypto identity
  A. show crypto ikev2 sa

  ---

  Explanation

  https://www.cisco.com/c/en/us/support/docs/security/flexvpn/116413-configure-flexvpn-00.pdf

• Question 176:

  An engineer has configured Cisco AnyConnect VPN using IKEv2 on a Cisco IOS router. The user cannot connect in the Cisco AnyConnect client, but receives an alert message "Use a browser to gain access." Which action does the engineer take to resolve this issue?

  A. Reset user login credentials.
  B. Correct the URL address.
  C. Connect using HTTPS.
  D. Disable the HTTP server.
  D. Disable the HTTP server.

  ---

  Explanation

• Question 177:

  Which Cisco AnyConnect component ensures that devices in a specific internal subnet are only accessible using port 443?

  A. routing
  B. WebACL
  C. split tunnel
  D. VPN filter
  D. VPN filter

  ---

  Explanation

• Question 178:

  Refer to the exhibit.

  

  A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which action brings up the VPN tunnel?

  A. Reduce the maximum SA limit on the local Cisco ASA.
  B. Increase the maximum in-negotiation SA limit on the local Cisco ASA.
  C. Remove the maximum SA limit on the remote Cisco ASA.
  D. Correct the crypto access list on both Cisco ASA devices.
  B. Increase the maximum in-negotiation SA limit on the local Cisco ASA.

  ---

  Explanation

• Question 179:

  Which two types of SSO functionality are available on the Cisco ASA without any external SSO servers? (Choose two.)

  A. SAML
  B. NTLM
  C. Kerberos
  D. OAuth 2.0
  E. HTTP Basic
  B. NTLM
  E. HTTP Basic

  ---

  Explanation

• Question 180:

  A second set of traffic selectors is negotiated between two peers using IKEv2. Which IKEv2 packet will contain details of the exchange?

  A. IKEv2 IKE_SA_INIT
  B. IKEv2 INFORMATIONAL
  C. IKEv2 CREATE_CHILD_SA
  D. IKEv2 IKE_AUTH
  C. IKEv2 CREATE_CHILD_SA

  ---

  Explanation

  The IKEv2 CREATE_CHILD_SA packet is used to establish a new security association (SA) between two peers. This packet contains the details of the exchange, including the traffic selectors, the cryptographic algorithms and keys to be used, and any other relevant information.