Cisco 300-730 Online Practice Questions and Exam Preparation

Cisco 300-730 Online Questions & Answers

• Question 81:

  A network engineer must design a remote access solution to allow contractors to access internal servers. These contractors do not have permissions to install applications on their computers. Which VPN solution should be used in this design?

  A. IKEv2 AnyConnect
  B. Clientless
  C. Port forwarding
  D. SSL AnyConnect
  B. Clientless

  ---

  Explanation

• Question 82:

  Users are getting untrusted server warnings when they connect to the URL https://asa.lab from their browsers. This URL resolves to 192.168.10.10, which is the IP address for a Cisco ASA configured for a clientless VPN. The VPN was recently set up and issued a certificate from an internal CA server. Users can connect to the VPN by ignoring the message, however, when users access other webservers that use certificates issued by the same internal CA server, they do not experience this issue. Which action resolves this issue?

  A. Import the CA that signed the certificate into the machine trusted root CA store.
  B. Reissue the certificate with asa.lab in the subject alternative name field.
  C. Import the CA that signed the certificate into the user trusted root CA store.
  D. Reissue the certificate with 192.168.10.10 in the subject common name field.
  B. Reissue the certificate with asa.lab in the subject alternative name field.

  ---

  Explanation

• Question 83:

  Which remote access VPN technology requires transform sets to be explicitly defined?

  A. Clientless SSLVPN
  B. IPSec
  C. Cisco Anyconnect
  D. FlexVPN
  B. IPSec

  ---

  Explanation

• Question 84:

  A network administrator is deploying a Cisco IPS appliance and needs it to operate initially without affecting traffic flows. It must also collect data to provide a baseline of unwanted traffic before being reconfigured to drop it. Which Cisco IPS mode meets these requirements?

  A. failsafe
  B. inline tap
  C. promiscuous
  D. bypass
  C. promiscuous

  ---

  Explanation

  The correct answer is

  C. promiscuous mode. In promiscuous mode, the Cisco IPS appliance operates as a passive device that monitors a copy of the network traffic and analyzes it for malicious activity. The appliance does not affect the traffic flow, but it can generate alerts, logs, and reports based on the configured security policy. Promiscuous mode is useful for initial deployment and baseline analysis, as well as for monitoring lowrisk segments of the network12. A. failsafe mode is a feature that determines how the appliance behaves when a hardware or software failure occurs. It does not affect the normal traffic flow or analysis3.

  B. inline tap mode is a variation of inline mode that allows the appliance to pass traffic without inspection in case of a power failure or a software crash. It does not allow the appliance to collect data without affecting traffic4.

  D. bypass mode is a feature that enables the appliance to bypass traffic without inspection when it is overloaded or under maintenance. It does not allow the appliance to analyze traffic and generate alerts.

  1: How the Sensor Functions

  2: Cisco ASA IPS Module Quick Start Guide

  3: Failsafe Mode

  4: Inline Tap Mode : Bypass Mode

• Question 85:

  Refer to the exhibit.

  

  An engineer must allow Cisco AnyConnect users to access the outside interface using protocol UDP 500/4500. In addition, these clients must be able to establish an SSL connection to update Cisco AnyConnect software over the same connection. Which two actions must be taken to achieve this goal? (Choose two.)

  A. IPsec (IKEv2) Allow Access must be checked on the outside interface.
  B. SSL Enable DTLS must be checked on the outside interface.
  C. Bypass interface access lists for inbound VPN sessions must be unchecked.
  D. IPsec (IKEv2) Enable Client Services must be checked on the outside interface.
  E. SSL Allow Access must be checked on the outside interface.
  A. IPsec (IKEv2) Allow Access must be checked on the outside interface.
  D. IPsec (IKEv2) Enable Client Services must be checked on the outside interface.

  ---

  Explanation

• Question 86:

  An administrator is deciding which authentication protocol should be implemented for their upcoming Cisco AnyConnect deployment. A list of the security requirements from upper management are: the ability to force AnyConnect users to use complex passwords such as C1$c0451035084!, warn users a few days before their password expires, and allow users to change their password during a remote access session. Which authentication protocol must be used to meet these requirements?

  A. LDAPS
  B. RADIUS
  C. Kerberos
  D. TACACS+
  A. LDAPS

  ---

  Explanation

• Question 87:

  An administrator is setting up AnyConnect for the first time for a few users. Currently, the router does not have access to a RADIUS server. Which AnyConnect protocol must be used to allow users to authenticate?

  A. EAP-GTC
  B. EAP-MSCHAPv2
  C. EAP-MD5
  D. EAP-AnyConnect
  D. EAP-AnyConnect

  ---

  Explanation

• Question 88:

  An engineer must design a remote access VPN solution that meet these requirements:

  1.supports use by telecommuters on the go

  2.encrypts user connections to the corporate network by using TLS-based tunnels

  3.is client-based

  Which VPN technology must be used?

  A. Secure Client SSL VPN
  B. GET VPN
  C. Dynamic Multipoint VPN
  D. Clientless SSL VPN
  A. Secure Client SSL VPN

  ---

  Explanation

• Question 89:

  On an ASA with multiple connection profiles for different departments, what is the best design to ensure that AnyConnect users are assigned the correct connection profile based on their department and do not have the ability to choose a different connection profile?

  A. group URL
  B. group alias
  C. dynamic access policy
  D. certificate mapping
  D. certificate mapping

  ---

  Explanation

• Question 90:

  DRAG DROP

  Drag and drop the GETVPN components from the left onto the descriptions on the right.

  Select and Place:

  

  

  Explanation