Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Cisco
CCNP Security
300-730
Implementing Secure Solutions with Virtual Private Networks (SVPN) Questions and Answers

Pass the Cisco CCNP Security 300-730 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam 300-730 Premium Access

View all detail and faqs for the 300-730 exam

Go to Exam

811 Students Passed

86% Average Score

90% Same Questions

Viewing page 3 out of 5 pages

Viewing questions 21-30 out of questions

Questions # 21:

Which two features provide headend resiliency for Cisco AnyConnect clients? (Choose two.)

Options:

AnyConnect Auto Reconnect

AnyConnect Network Access Manager

AnyConnect Backup Servers

ASA failover

AnyConnect Always On

Answer

C, D

Explanation

According to the Implementing Secure Solutions with Virtual Private Networks (SVPN) documents and learning resources available at cisco.com, the two features that provide headend resiliency for Cisco AnyConnect clients are:

AnyConnect Backup Servers: This feature allows the AnyConnect client to automatically connect to a backup server in case the primary server is unreachable or fails. The backup server list is configured on the ASA or IOS headend and pushed to the client during the VPN connection establishment. The client can also manually select a backup server from the list if needed. This feature enhances the availability and reliability of the VPN service for the clients12.

ASA failover: This feature enables two identical ASAs to be paired together as an active/standby or active/active pair. The ASAs synchronize their configuration and state information and monitor each other’s health. If the active ASA fails or becomes unreachable, the standby ASA takes over the traffic and VPN sessions without any disruption for the clients. This feature provides high availability and redundancy for the VPN headend34.

1: AnyConnect Backup Servers 2: Redundancy options for IOS Headend for AnyConnect Clients 3: ASA Failover 4: AnyConnect Implementation and Performance/Scaling Reference for COVID-19 Preparation

Questions # 22:

Which configuration construct must be used in a FlexVPN tunnel?

Options:

EAP configuration

multipoint GRE tunnel interface

IKEv1 policy

IKEv2 profile

Answer

Explanation

The correct answer is D. IKEv2 profile. A FlexVPN tunnel requires an IKEv2 profile to define the parameters for the IKEv2 negotiation and the IPsec security association. The IKEv2 profile references the IKEv2 keyring, the authentication method, the identity of the peers, and other options. The IKEv2 profile is then applied to a virtual tunnel interface (VTI) or a dynamic virtual tunnel interface (DVTI) to protect the tunnel with IPsec12. An EAP configuration is used for authentication with Extensible Authentication Protocol (EAP), which is optional for FlexVPN3. A multipoint GRE tunnel interface is used for DMVPN, not FlexVPN. An IKEv1 policy is used for IKEv1, not IKEv2, which is the protocol for FlexVPN.

Questions # 23:

Refer to the exhibit.

Question # 23

The IKEv2 site-to-site VPN tunnel between two routers is down. Based on the debug output, which type of mismatch is the problem?

Options:

preshared key

peer identity

transform set

ikev2 proposal

Answer

Questions # 24:

Refer to the exhibit.

Question # 24

A site-to-site tunnel between two sites is not coming up. Based on the debugs, what is the cause of this issue?

Options:

An authentication failure occurs on the remote peer.

A certificate fragmentation issue occurs between both sides.

UDP 4500 traffic from the peer does not reach the router.

An authentication failure occurs on the router.

Answer

Explanation

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/113594-trouble-ios-ike-00.html#anc12

Questions # 25:

In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form. Which troubleshooting step solves the issue?

Options:

Verify the spoke configuration to check if the NHRP redirect is enabled.

Verify that the spoke receives redirect messages and sends resolution requests.

Verify the hub configuration to check if the NHRP shortcut is enabled.

Verify that the tunnel interface is contained within a VRF.

Answer

Explanation

[Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn- dmvpn-15-mt-book/sec-conn-dmvpn-summ-maps.pdf, , On receiving the redirect, Spoke1 initiates a resolution request for Host2 over the point-to-point tunnel interface (the same interface over which it received the redirect). The resolution request traverses the routed path (Spoke1-hub-spoke2). On receiving the resolution request, Spoke2 determines that it is the exit point and needs to respond to the resolution request. https://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-2mt/sec-flex-spoke.html, ]

Questions # 26:

Refer to the exhibit.

Question # 26

Which type of mismatch is causing the problem with the IPsec VPN tunnel?

Options:

crypto access list

Phase 1 policy

transform set

preshared key

Answer

Explanation

IKE Message from X.X.X.X Failed its Sanity Check or is Malformed

This debug error appears if the pre-shared keys on the peers do not match. In order to fix this issue, check the pre-shared keys on both sides.

1d00H:%CRPTO-4-IKMP_BAD_MESSAGE: IKE message from 198.51.100.1 failed its

sanity check or is malformed

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html#anc17

[Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409- ipsec-debug-00.html#ike, ]

Questions # 27:

An engineer is troubleshooting a new DMVPN setup on a Cisco IOS router. After the show crypto isakmp sa command is issued, a response is returned of "MM_NO_STATE." Why does this failure occur?

Options:

The ISAKMP policy priority values are invalid.

ESP traffic is being dropped.

The Phase 1 policy does not match on both devices.

Tunnel protection is not applied to the DMVPN tunnel.

Answer

Explanation

https://www.cisco.com/c/en/us/support/docs/security/dynamic-multipoint-vpn-dmvpn/111976-dmvpn-troubleshoot-00.html

The MMNOSTATE failure occurs when the ISAKMP policy priority values are not configured correctly on both devices. The ISAKMP policy priority values are used to determine the order in which the ISAKMP policies are applied. If the priority values do not match between the two devices, the ISAKMP tunnel may not be established correctly, resulting in the MMNOSTATE failure. To resolve this issue, the engineer should ensure that the ISAKMP policy priority values are configured correctly on both the router and the peer.

Questions # 28:

Refer to the exhibit.

Question # 28

The customer can establish a Cisco AnyConnect connection without using an XML profile. When the host "ikev2" is selected in the AnyConnect drop down, the connection fails. What is the cause of this issue?

Options:

The HostName is incorrect.

The IP address is incorrect.

Primary protocol should be SSL.

UserGroup must match connection profile.

Answer

Explanation

[Reference: https://community.cisco.com/t5/security-documents/anyconnect-xml-settings/ta-p/3157891, User Group—Specify a user group. The user group is used in conjunction with Host Address to form a group-based URL. If you specify the Primary Protocol as IPsec, the User Group must be the exact name of the connection profile (tunnel group). For SSL, the user group is the group-url of the connection profile. ]

Questions # 29:

Refer to the exhibit.

Question # 29

An SSL client is connecting to an ASA headend. The session fails with the message “Connection attempt has timed out. Please verify Internet connectivity.” Based on how the packet is processed, which phase is causing the failure?

Options:

phase 9: rpf-check

phase 5: NAT

phase 4: ACCESS-LIST

phase 3: UN-NAT

Answer

Questions # 30:

Refer to the exhibit.

Question # 30

Based on the debug output, which type of mismatch is preventing the VPN from coming up?

Options:

interesting traffic

lifetime

preshared key

PFS

Answer

Explanation

The first of the two TS payloads is known as TSi (Traffic Selector- initiator). The second is known as TSr (Traffic Selector-responder). TSi specifies the source address of traffic forwarded from (or the destination address of traffic forwarded to) the initiator of the Child SA pair. https://www.rfc-editor.org/rfc/rfc5996#page-40

If the responder's policy does not allow it to accept any part of the proposed Traffic Selectors, it responds with a TS_UNACCEPTABLE Notify message.

Viewing page 3 out of 5 pages

Viewing questions 21-30 out of questions