Cisco 300-730 Online Practice Questions and Exam Preparation

Cisco 300-730 Online Questions & Answers

• Question 71:

  An engineer has successfully established a Phase 1 and Phase 2 tunnel between two sites. Site A has internal subnet 192.168.0.0/24 and Site B has internal subnet 10.0.0.0/24. The engineer notices that no packets are decrypted at Site

  B. Pings to 192.168.0.1 from internal Site B devices make it to the Site B router, and the Site A router has incrementing encrypt and decrypt counters. What must be done to ensure bidirectional communication between both sites?

  A. Modify the routing at Site B so that traffic is sent to Site A.
  B. Configure the correct DH group on both devices.
  C. Allow protocol ESP or AH on the firewall in front of the Site B router.
  D. Enable PFS on the headend device.
  C. Allow protocol ESP or AH on the firewall in front of the Site B router.

  ---

  Explanation

• Question 72:

  Refer to the exhibit.

  

  A network engineer is troubleshooting a new DMVPN configuration. The network connectivity between the hub and spoke is working as it should, but users cannot access VPN resources. Which action resolves the issue?

  A. Review ISAKMP packets on devices between the VPN devices.
  B. Unblock IP protocol 50 on devices between the VPN devices.
  C. Ensure that the IPsec profile is configured on the tunnel interface.
  D. Ensure that the NHS is configured on the tunnel interface.
  C. Ensure that the IPsec profile is configured on the tunnel interface.

  ---

  Explanation

• Question 73:

  A user at a company HQ is having trouble accessing a network share at a branch site that is connected with a L2L IPsec VPN. While troubleshooting, a network security engineer runs a packet tracer on the Cisco ASA to simulate the user traffic and discovers that the encryption counter is increasing but the decryption counter is not. What must be configured to correct this issue?

  A. Adjust the routing on the remote peer device to direct traffic back over the tunnel.
  B. Adjust the preshared key on the remote peer to allow traffic to flow over the tunnel.
  C. Adjust the transform set to allow bidirectional traffic.
  D. Adjust the peer IP address on the remote peer to direct traffic back to the ASA.
  A. Adjust the routing on the remote peer device to direct traffic back over the tunnel.

  ---

  Explanation

• Question 74:

  Which two parameters help to map a VPN session to a tunnel group without using the tunnel-group list? (Choose two.)

  A. group-alias
  B. certificate map
  C. optimal gateway selection
  D. group-url
  E. AnyConnect client version
  B. certificate map
  D. group-url

  ---

  Explanation

• Question 75:

  Refer to the exhibit.

  

  What is configured as a result of this command set?

  A. FlexVPN client profile for IPv6
  B. FlexVPN server to authorize groups by using an IPv6 external AAA
  C. FlexVPN server for an IPv6 dVTI session
  D. FlexVPN server to authenticate IPv6 peers by using EAP
  C. FlexVPN server for an IPv6 dVTI session

  ---

  Explanation

  The configuration snippet is an identical match to the server configuration when you look it up. Not the client.

• Question 76:

  A network administrator is troubleshooting an IPSec Site-to-Site VPN tunnel on a Cisco ASA rewall. The VPN tunnel is established but is unable to pass traffic between 192.168.10.155 and 192.168.100.172. The administrator observes the log

  message:

  %ASA-4-402116: IPSEC: Received an ESP packet (SPI= 0x489041899C, sequence number= 0x9E) from 100.1.1.1 (user= 100.1.1.1) to 12.12.12.12. What must the administrator do to resolve this issue?

  A. Implement IKE Phase 1 proposal to match other rewall.
  B. Confirm that IP address of tunnel interface is correctly configured.
  C. Configure ACL for interesting traffic to match remote rewall.
  D. Setup identical Pre-shared keys must be on both rewalls.
  C. Configure ACL for interesting traffic to match remote rewall.

  ---

  Explanation

• Question 77:

  Refer to the exhibit.

  

  An engineer is diagnosing an issue that occurred after a router at a branch site was assigned a new address. Based on the debugs, what must be done to resolve this issue?

  A. Add the remote peer's IP address to the server's IKEv2 keyring.
  B. Ensure that the correct preshared keys are set on both sides.
  C. Ensure that the UDP 500 packets between devices are not dropped.
  D. Add the remote peer's identity to the server's IKEv2 profile.
  D. Add the remote peer's identity to the server's IKEv2 profile.

  ---

  Explanation

• Question 78:

  Which feature allows the ASA to handle nonstandard applications and web resources so that they display correctly over a clientless SSL VPN connection?

  A. single sign-on
  B. Smart Tunnel
  C. WebType ACL
  D. plug-ins
  B. Smart Tunnel

  ---

  Explanation

  https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/vpn_clientless_ssl.html#29951

• Question 79:

  A company's remote locations connect to the data centers via MPLS. A new request requires that unicast and multicast traffic that exits in the remote locations be encrypted. Which non-tunneled technology should be used to satisfy this requirement?

  A. SSL
  B. FlexVPN
  C. DMVPN
  D. GETVPN
  D. GETVPN

  ---

  Explanation

• Question 80:

  Refer to the exhibit.

  

  A new IPsec VPN tunnel has been configured and the security associations do not establish. After the show crypto isakmp command is run, the output is displayed. What must be reConfigured to resolve the issue?

  A. peer address
  B. transform sets
  C. pre-shared key
  D. keep-alive values
  C. pre-shared key

  ---

  Explanation