Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Cisco
CCNP Security
300-730
Implementing Secure Solutions with Virtual Private Networks (SVPN) Questions and Answers

Pass the Cisco CCNP Security 300-730 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam 300-730 Premium Access

View all detail and faqs for the 300-730 exam

Go to Exam

811 Students Passed

86% Average Score

90% Same Questions

Viewing page 4 out of 5 pages

Viewing questions 31-40 out of questions

Questions # 31:

Refer to the exhibit.

Question # 31

Client 1 cannot communicate with client 2. Both clients are using Cisco AnyConnect and have established a successful SSL VPN connection to the hub ASA. Which command on the ASA is missing?

Options:

dns-server value 10.1.1.2

same-security-traffic permit intra-interface

same-security-traffic permit inter-interface

dns-server value 10.1.1.3

Answer

Explanation

The same-security-traffic intra-interface command lets traffic enter and exit the same interface, which is normally not allowed. This feature might be useful for VPN traffic that enters an interface, but is then routed out the same interface. The VPN traffic might be unencrypted in this case, or it might be reencrypted for another VPN connection. For example, if you have a hub and spoke VPN network, where the security appliance is the hub, and remote VPN networks are spokes, for one spoke to communicate with another spoke, traffic must go into the security appliance and then out again to the other spoke.

Questions # 32:

Which command is used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?

Options:

show crypto ikev2 sa

show crypto isakmp sa

show crypto gkm

show crypto identity

Answer

Explanation

[Reference: https://www.cisco.com/c/en/us/support/docs/security/flexvpn/116413-configure-flexvpn-00.pdf, ]

Questions # 33:

Refer to the exhibit.

Question # 33

What is a result of this configuration?

Options:

Spoke 1 fails the authentication because the authentication methods are incorrect.

Spoke 2 passes the authentication to the hub and successfully proceeds to phase 2.

Spoke 2 fails the authentication because the remote authentication method is incorrect.

Spoke 1 passes the authentication to the hub and successfully proceeds to phase 2.

Answer

Questions # 34:

Drag and drop the correct commands from the night onto the blanks within the code on the left to implement a design that allow for dynamic spoke-to-spoke communication. Not all comments are used.

Question # 34

Options:

Answer

Answer:

Explanation

[Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/xe-16/sec-conn- dmvpn-xe-16-book/sec-conn-dmvpn-summ-maps.html, ]

Questions # 35:

Which method dynamically installs the network routes for remote tunnel endpoints?

Options:

policy-based routing

CEF

reverse route injection

route filtering

Answer

Explanation

Reverse route injection (RRI) is a method that dynamically installs the network routes for remote tunnel endpoints. The RRI feature allows the router to automatically learn the routes for the remote networks and automatically install these routes into the routing table. This eliminates the need for the administrator to manually configure and maintain the routes for the remote networks. This feature is commonly used in VPN environments, where the router at the VPN endpoint needs to learn the routes for the remote networks behind the other VPN endpoint. The other options such as policy-based routing, CEF, and route filtering are not used to dynamically install the network routes for remote tunnel endpoints

[Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnav/configuration/12-4t/sec-vpn- availability-12-4t-book/sec-rev-rte-inject.html, ]

Questions # 36:

Refer to the exhibit.

Question # 36

The DMVPN tunnel is dropping randomly and no tunnel protection is configured. Which spoke configuration mitigates tunnel drops?

Question # 36

Options:

Option A

Option B

Option C

Option D

Answer

Explanation

https://www.globalknowledge.com/us-en/resources/resource-library/articles/understanding-next-hop-resolution-protocol-commands/

Questions # 37:

Refer to the exhibit.

Question # 37

A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which action brings up the VPN tunnel?

Options:

Reduce the maximum SA limit on the local Cisco ASA.

Increase the maximum in-negotiation SA limit on the local Cisco ASA.

Remove the maximum SA limit on the remote Cisco ASA.

Correct the crypto access list on both Cisco ASA devices.

Answer

Explanation

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ikevpn/configuration/xe-3s/sec-ike-for-ipsec-vpns-xe-3s-book/sec-call-addmsn-ike.html

Questions # 38:

On a FlexVPN hub-and-spoke topology where spoke-to-spoke tunnels are not allowed, which command is needed for the hub to be able to terminate FlexVPN tunnels?

Options:

interface virtual-access

ip nhrp redirect

interface tunnel

interface virtual-template

Answer

Explanation

On a FlexVPN hub-and-spoke topology where spoke-to-spoke tunnels are not allowed, the command that is needed for the hub to be able to terminate FlexVPN tunnels is interface virtual-template. The interface virtual-template command is used to configure a virtual template interface which provides a secure tunnel for FlexVPN connections. The other commands listed - interface virtual-access, ip nhrp redirect, and interface tunnel - are not related to FlexVPN and are not used to terminate FlexVPN tunnels.

Questions # 39:

Which statement about GETVPN is true?

Options:

The configuration that defines which traffic to encrypt originates from the key server.

TEK rekeys can be load-balanced between two key servers operating in COOP.

The pseudotime that is used for replay checking is synchronized via NTP.

Group members must acknowledge all KEK and TEK rekeys, regardless of configuration.

Answer

Explanation

KS (key server) is ‘caretaker’ of the GM group. Group registrations and authentication of GMs is taken care of by KS server. Any GM who wants to join the group is required to be successfully authenticated in the group and sends encryption keys and policy to be used within the group.

===

https://ipwithease.com/introduction-to-getvpn/

Questions # 40:

Refer to the exhibit.

Question # 40