Cisco CCNP 300-730 Questions & Answers

• Question 171:

  On a FlexVPN hub-and-spoke topology where spoke-to-spoke tunnels are not allowed, which command is needed for the hub to be able to terminate FlexVPN tunnels?

  A. interface virtual-access

  B. ip nhrp redirect

  C. interface tunnel

  D. interface virtual-template

  Correct Answer: D

  A: has no sense

  B: spoke to spoke is not allowed and this command is used for spoke to spoke

  c: makes no sense

  D: most right answer as this command is needed on the hub for hub and spoke communication.

• Question 172:

  An administrator is deciding which authentication protocol should be implemented for their upcoming Cisco AnyConnect deployment. A list of the security requirements from upper management are: the ability to force AnyConnect users to use complex passwords such as C1$c0451035084!, warn users a few days before their password expires, and allow users to change their password during a remote access session. Which authentication protocol must be used to meet these requirements?

  A. LDAPS

  B. RADIUS

  C. Kerberos

  D. TACACS+

  Correct Answer: B

• Question 173:

  Which Diffie Hellman group should be used when ECDH is required in a VPN configuration?

  A. 24

  B. 19

  C. 16

  D. 15

  Correct Answer: B

• Question 174:

  Refer to the exhibit.

  

  Which action must be taken on the IPsec tunnel configuration to resolve the issue?

  A. The access lists on each peer must mirror each other.

  B. The transform set on each peer must match.

  C. The access lists on each peer must be identical.

  D. The transform set on each peer must be compatible.

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html

• Question 175:

  Refer to the exhibit.

  

  The network security engineer identified that the hub router cannot send traffic to the spoke router. Based on the provided output, which action resolves the issue?

  A. Permit UDP ports 500 and 4500 between the hub and spoke.

  B. Correct the next hop server IP address on the spoke router.

  C. Ensure the preshared key on the hub-and-spoke router matches.

  D. Adjust the ip nhrp network-id command on the hub router.

  Correct Answer: B

• Question 176:

  Refer to the exhibit.

  

  A company has been using SAML to authenticate their clientless SSLVPN users. After about a year of uptime in production, users begin to experience issues authenticating. Based on the collected debugs, which action resolves the issue?

  A. Increase the SAML Request Timeout value on the ASA.

  B. Verify that the IdP is using the SAML-attribute NameID.

  C. Ensure that the ASA and IdP are synchronized to a NTP server.

  D. Replace the expired IdP signing certificate with a valid one.

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215935-configure-asa-anyconnect-vpn-with-micros.pdf

• Question 177:

  Refer to the exhibit.

  

  A network administrator is setting up a phone VPN on a Cisco ASA. The phone cannot connect and the error is presented in a debug on the Cisco ASA. Which action fixes this issue?

  A. Enable web-deploy of the posture module so that the module can be downloaded from the Cisco ASA to an IP phone.

  B. Configure the Cisco ASA to present an RSA certificate to the phone for authentication.

  C. Disable Cisco Secure Desktop under the connection profile VPNPhone.

  D. Install the posture module on the Cisco ASA.

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116162-trouble-anyconnect-vpn-phone-00.html

• Question 178:

  A network administrator wants the Cisco ASA to automatically start downloading the Cisco AnyConnect client without prompting the user to select between WebVPN or AnyConnect. Which command accomplishes this task?

  A. anyconnect ssl df-bit-ignore enable

  B. anyconnect ask none default anyconnect

  C. anyconnect ask enable default anyconnect

  D. anyconnect modules value default

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/configuration/vpn/asa-98-vpn-config/vpn-anyconnect.html

• Question 179:

  A clientless SSLVPN solution is built for 10 employees on a newly installed Cisco ASA. After a couple of days in production, it has been observed that only the first two users to log in each day are able to connect successfully. The remaining users encounter the message "Login failed". Which action resolves the issue?

  A. Allocate additional Cisco AnyConnect Premium licenses to the ASA.

  B. Increase the vpn-simultaneous-logins parameter to a value of more than 2.

  C. Increase the number or IP addresses available in the VPN pool.

  D. Verify that the users that cannot log in are in the correct AD group with VPN permissions.

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/212972-anyconnect-vpn-client-troubleshooting-gu.html#anc70

• Question 180:

  Which remote access VPN technology requires transform sets to be explicitly defined?

  A. Clientless SSLVPN

  B. IPSec

  C. Cisco Anyconnect

  D. FlexVPN

  Correct Answer: B