Cisco 300-730 Online Practice Questions and Exam Preparation

Cisco 300-730 Online Questions & Answers

• Question 51:

  Refer to the exhibit.

  

  The DMVPN spoke is not establishing a session with the hub. Which two actions resolve this issue? (Choose two.)

  A. Change the spoke nhs to 172.16.18.1 and the nbma to 10.0.0.1.
  B. Change the transform set to mode tunnel.
  C. Change the ISAKMP policy authentication on the spoke to pre-shared.
  D. Change the ISAKMP key address on the spoke to 0.0.0.0.
  E. Change the nhrp authentication key on the spoke to cisco123.
  C. Change the ISAKMP policy authentication on the spoke to pre-shared.
  E. Change the nhrp authentication key on the spoke to cisco123.

  ---

  Explanation

• Question 52:

  Cisco AnyConnect clients need to transfer large files over the VPN sessions. Which protocol provides the best throughput?

  A. SSL/TLS
  B. L2TP
  C. DTLS
  D. IPsec IKEv1
  C. DTLS

  ---

  Explanation

• Question 53:

  Refer to the exhibit.

  

  

  An SSL client is connecting to an ASA headend. The session fails with the message "Connection attempt has timed out. Please verify Internet connectivity." Based on how the packet is processed, which phase is causing the failure?

  A. phase 9: rpf-check
  B. phase 5: NAT
  C. phase 4: ACCESS-LIST
  D. phase 3: UN-NAT
  D. phase 3: UN-NAT

  ---

  Explanation

• Question 54:

  A network engineer must configure the Cisco ASA so that Cisco AnyConnect clients establishing an SSL VPN connection create an additional tunnel for real-time traffic that is sensitive to packet delays. If this additional tunnel experiences any issues, it must fall back to a TLS connection. Which two Cisco AnyConnect features must be configured to accomplish this task? (Choose two.)

  A. DTLS
  B. DSCP Preservation
  C. DPD
  D. SSL Rekey
  E. OMTU
  A. DTLS
  C. DPD

  ---

  Explanation

• Question 55:

  Which VPN does VPN load balancing on the ASA support?

  A. VTI
  B. IPsec site-to-site tunnels
  C. L2TP over IPsec
  D. Cisco AnyConnect
  D. Cisco AnyConnect

  ---

  Explanation

• Question 56:

  After a network security administrator configures site-to-site IPsec VPN peer, they receive this error message: 1d00h: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Main Mode failed with peer at 150.150.150.1. What is the solution to this problem?

  A. ISAKMP policy must match between sites.
  B. IPsec policy must match between sites.
  C. Crypto map must be applied to correct interface.
  D. Transport set must match between sites.
  A. ISAKMP policy must match between sites.

  ---

  Explanation

• Question 57:

  Refer to the exhibit.

  

  An engineer has configured two new VPN tunnels to 172.18.1.1 and 172.19.1.1. However, communication between 10.1.0.10 and 10.1.11.10 does not function. Which action should be taken to resolve this issue?

  A. Remove and reapply the crypto map to the interface.
  B. Insert routes for the 10.1.9.0/24 and 10.1.10.0/24 subnets.
  C. Modify the transform set to use transport mode.
  D. Adjust the network objects to match the appropriate subnets.
  D. Adjust the network objects to match the appropriate subnets.

  ---

  Explanation

• Question 58:

  What is the default rekey timer for security association pair in the case of IPsec for Cisco ASA?

  A. 8 hours
  B. 12 hours
  C. 18 hours
  D. 24 hours
  D. 24 hours

  ---

  Explanation

• Question 59:

  Refer to the exhibit.

  

  Which type of mismatch is causing the problem with the IPsec VPN tunnel?

  A. crypto access list
  B. Phase 1 policy
  C. transform set
  D. preshared key
  D. preshared key

  ---

  Explanation

  https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html#ike

• Question 60:

  Which parameter in IPsec VPN tunnel configurations is optional?

  A. hash
  B. lifetime
  C. encryption
  D. Perfect Forward Secrecy
  D. Perfect Forward Secrecy

  ---

  Explanation