Good 300-730 Exam Dumps Save Your Preparation Time

Category:

Comments:

0 Comments

Post Date:

October 27, 2023

Cisco 300-730 dumps questions are an essential tool for anyone looking to pursue the CCNP Security certification. By using these 300-730 dumps questions as part of your exam preparation, you can gain a deeper understanding of the exam format, identify knowledge gaps, build confidence, get real-time feedback, and stay up-to-date with the latest trends in Implementing Secure Solutions with Virtual Private Networks (SVPN). So, if you're serious about achieving 300-730 certification success, be sure to incorporate 300-730 exam dumps questions into your study plan. Test free Cisco 300-730 exam dumps below.

Page 1 of 6

1. Refer to the exhibit.

What is configured as a result of this command set?

FlexVPN client profile for IPv6

FlexVPN server to authorize groups by using an IPv6 external AAA

FlexVPN server for an IPv6 dVTI session

FlexVPN server to authenticate IPv6 peers by using EAP

2. Which two parameters help to map a VPN session to a tunnel group without using the tunnel-group list? (Choose two.)

group-alias

certificate map

optimal gateway selection

group-url

AnyConnect client version

3. An engineer has successfully established a Phase 1 and Phase 2 tunnel between two sites. Site A has internal subnet 192.168.0.0/24 and Site B has internal subnet 10.0.0.0/24. The engineer notices that no packets are decrypted at Site B. Pings to 192.168.0.1 from internal Site B devices make it to the Site B router, and the Site A router has incrementing encrypt and decrypt counters.

What must be done to ensure bidirectional communication between both sites?

Modify the routing at Site B so that traffic is sent to Site

Configure the correct DH group on both devices.

Allow protocol ESP or AH on the firewall in front of the Site B router.

Enable PFS on the headend device.

4. Which parameter must match on all routers in a DMVPN Phase 3 cloud?

GRE tunnel key

NHRP network ID

tunnel VRF

EIGRP split-horizon setting

5. Refer to the exhibit.

Which two conclusions should be drawn from the DMVPN phase 2 configuration? (Choose two.)

Next-hop-self is required.

EIGRP neighbor adjacency will fail.

EIGRP is used as the dynamic routing protocol.

EIGRP route redistribution is not allowed.

Spoke-to-spoke communication is allowed.

6. A second set of traffic selectors is negotiated between two peers using IKEv2.

Which IKEv2 packet will contain details of the exchange?

IKEv2 IKE_SA_INIT

IKEv2 INFORMATIONAL

IKEv2 CREATE_CHILD_SA

IKEv2 IKE_AUTH

7. A network administrator wants the Cisco ASA to automatically start downloading the Cisco AnyConnect client without prompting the user to select between WebVPN or AnyConnect.

Which command accomplishes this task?

anyconnect ssl df-bit-ignore enable

anyconnect ask none default anyconnect

anyconnect ask enable default anyconnect

anyconnect modules value default

8. 1.DRAG DROP

Drag and drop the correct commands from the night onto the blanks within the code on the left to implement a design that allow for dynamic spoke-to-spoke communication. Not all comments are used.

9. The corporate network security policy requires that all internet and network traffic must be tunneled to the corporate office. Remote workers have been provided with printers to use locally at home while they are remotely connected to the corporate network.

Which two steps must be executed to allow printing to the local printers? (Choose two.)

Configure the split-tunnel-policy on the Cisco ASA to tunnelall.

Check the Allow Local LAN access checkbox in the Cisco AnyConnect client.

Add a persistent static route in the client OS for the local LAN network.

Configure the split-tunnel-policy on the Cisco ASA to excludespecified.

Configure the split-tunnel-policy on the Cisco ASA to tunnelspecified.

10. An engineer notices that while an employee is connected remotely, all traffic is being routed to the

corporate network.

Which split-tunnel policy allows a remote client to use their local provider for Internet access when working from home?

tunnelall

excludeall

tunnelspecified

excludespecified

Page 2 of 6

11. Which command identifies a Cisco AnyConnect profile that was uploaded to the flash of an IOS router?

svc import profile SSL_profile flash:simos-profile.xml

anyconnect profile SSL_profile flash:simos-profile.xml

crypto vpn anyconnect profile SSL_profile flash:simos-profile.xml

webvpn import profile SSL_profile flash:simos-profile.xml

12. Why must a network engineer avoid usage of the default X.509 certificate when implementing clientless SSLVPN on an ASA?

The certificate must be managed by the local C

The certificate is regenerated at each reboot.

The default

509 certificate is not supported for SSLVP

The certificate is too weak to provide adequate security.

13. A router is being configured for IKEv2 AnyConnect using AnyConnect-EAP.

How would the administrator separate profiles for administrators and employees so that authorization differs when they connect?

Define group aliases on the headend and have the user pick the appropriate alias when they connect

Define group-urls on the headend and create two XML profiles to match the administrator and user group urls

Create a certificate map and match on the appropriate certificate fields

Define key-ids on the headend and create two XML profiles to match the administrator and user key-ids.

14. A network engineer must expand a company's Cisco AnyConnect solution. Currently, a Cisco ASA is set up in North America and another will be installed in Europe with a different IP address. Users should connect to the ASA that has the lowest Round Trip Time from their network location as measured by the AnyConnect client.

Which solution must be implemented to meet this requirement?

VPN Load Balancing

IP SLA

DNS Load Balancing

Optimal Gateway Selection

15. Refer to the exhibit.

An IPsec Cisco AnyConnect client is failing to connect and generates these debugs every time a connection to an IOS headend is attempted.

Which action resolves this issue?

Correct the DH group setting.

Correct the PFS setting.

Correct the integrity setting.

Correct the encryption setting.

16. Refer to the exhibit.

Which VPN technology is used in the exhibit?

DVTI

VTI

DMVPN

GRE

17. Refer to the exhibit.

Upon setting up a tunnel between two sites, users are complaining that connections to applications over the VPN are not working consistently. The output of show crypto ipsec sa was collected on one of the VPN devices. Based on this output, what should be done to fix this issue?

Lower the tunnel MT

Enable perfect forward secrecy.

Specify the application networks in the remote identity.

Make an adjustment to IPSec replay window.

18. Which parameter in IPsec VPN tunnel configurations is optional?

hash

lifetime

encryption

Perfect Forward Secrecy

19. Which feature of GETVPN is a limitation of DMVPN and FlexVPN?

sequence numbers that enable scalable replay checking

enabled use of ESP or AH

design for use over public or private WAN

no requirement for an overlay routing protocol

20. Refer to the exhibit.

A site-to-site tunnel between two sites is not coming up.

Based on the debugs, what is the cause of this issue?

An authentication failure occurs on the remote peer.

A certificate fragmentation issue occurs between both sides.

UDP 4500 traffic from the peer does not reach the router.

An authentication failure occurs on the router.

Page 3 of 6

21. Which two components are required in a Cisco IOS GETVPN key server configuration? (Choose two.)

RSA key

IKE policy

SSL cipher

GRE tunnel

L2TP protocol

22. Which VPN solution uses TBAR?

GETVPN

VTI

DMVPN

Cisco AnyConnect

23. A network administrator is troubleshooting a FlexVPN tunnel. The hub router is unable to ping the spoke router's tunnel interface IP address of 192.168.1.2, even though the tunnel is showing up. The output of the debug ip packet CLI command on the hub router shows the following entry.

IP: tableid=0123456789 s=192.168.1.1 (local), d=192.168.1.2 (loopback2), routed via FIB.

What must be configured to fix this issue?

A matching IKEv2 pre-shared key on the hub and spoke routers in the crypto keyring configuration.

An outbound ACL on the dynamic VTI of the hub router that allows ICMP traffic to 192.168.1.2.

An IKEv2 authorization policy must be configured on the spoke router to advertise the interface route.

A route map must be configured on hub router to set the next hop for 192.168.1.2 to the dynamic VT

24. A Cisco AnyConnect client establishes a SSL VPN connection with an ASA at the corporate office. An engineer must ensure that the client computer meets the enterprise security policy.

Which feature can update the client to meet an enterprise security policy?

Endpoint Assessment

Cisco Secure Desktop

Basic Host Scan

Advanced Endpoint Assessment

25. A network engineer is installing Cisco AnyConnect on company laptops so that users can access corporate resources remotely. The VPN concentrator is a Cisco router running IOS-XE 16.9.1 code and configured as a FlexVPN server that uses local authentication and *$Cisc431089017$* as the key-id for the IKEv2 profile.

Which two steps must be taken on the computer to allow a successful AnyConnect connection to the router? (Choose two.)

In the Cisco AnyConnect XML profile, set the IPsec Authentication method to EAP-AnyConnect.

In the Cisco AnyConnect XML profile, add the hostname and host address to the server list.

In the Cisco AnyConnect XML profile, set the user group field to DefaultAnyConnectClientGroup.

In the Cisco AnyConnect Local Policy, set the BypassDownloader option in the local to true.

In the Cisco AnyConnect Local Policy, add the router IP address to the Update Policy.

26. In order to enable FlexVPN to use a AAA attribute list, which two tasks must be performed? (Choose two.)

Define the RADIUS server.

Verify that clients are using the correct authorization policy.

Define the AAA server.

Assign the list to an authorization policy.

Set the maximum segment size.

27. Refer to the exhibit.

An SSL client is connecting to an ASA headend. The session fails with the message “Connection attempt has timed out. Please verify Internet connectivity.”

Based on how the packet is processed, which phase is causing the failure?

phase 9: rpf-check

phase 5: NAT

phase 4: ACCESS-LIST

phase 3: UN-NAT

28. A TCP based application that should be accessible over the VPN tunnel is not working.

Pings to the appropriate IP address are failing.

Based on the output, what is a fix for this issue?

Add a route on the remote peer for 209.165.201.0/27.

Add a route on the local peer for 10.1.1.0/24.

Add a permit for TCP traffic going to 10.1.1.0/24.

Add a permit for TCP traffic going to 209.165.201.0/27.

29. Refer to the exhibit.

Which component must be configured on routers for a GETVPN deployment work properly?

PE3: Key Server C Customer 2 CEs: Group Members

Customer 1 CE1: Key Server C R1 and Customer 1 CE2: Group Members

R1: Key Server C Customer 1 CEs: Group Members

PE3: Key Server C all CEs: Group Members

30. When a FlexVPN is configured, which two components must be configured for IKEv2? (Choose two.)

method

profile

proposal

preference

persistence

Page 4 of 6

31. Where must an engineer configure a preshared key for a site-to-site VPN tunnel configured on a Cisco ASA?

isakmp policy

group policy

crypto map

tunnel group

32. A network engineer must design a clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was found that one website is not being rewritten correctly by the ASA.

What is a potential solution for this issue while still allowing it to be a clientless VPN setup?

Set up a smart tunnel with the IP address of the web server.

Set up a NAT rule that translates the ASA public address to the web server private address on port 80.

Set up Cisco AnyConnect with a split tunnel that has the IP address of the web server.

Set up a WebACL to permit the IP address of the web server.

33. Which VPN technology must be used to ensure that routers are able to dynamically form connections with each other rather than sending traffic through a hub and be able to advertise routes without the use of a dynamic routing protocol?

FlexVPN

DMVPN Phase 3

DMVPN Phase 2

GETVPN

34. Which clientless SSLVPN supported feature works when the http-only-cookie command is enabled?

Citrix load balancer

port reflector

Java rewriter -

Java plug-ins

script browser

35. Refer to the exhibit.

Which type of mismatch is causing the problem with the IPsec VPN tunnel?

crypto access list

Phase 1 policy

transform set

preshared key

36. Which DMVPN feature allows spokes to be deployed with dynamically assigned public IP addresses?

2547oDMVPN

NHRP

OSPF

NAT Traversal

37. An engineer has configured Cisco AnyConnect VPN using IKEv2 on a Cisco IOS router. The user cannot connect in the Cisco AnyConnect client, but receives an alert message "Use a browser to gain access."

Which action does the engineer take to resolve this issue?

Reset user login credentials.

Correct the URL address.

Connect using HTTP

Disable the HTTP server.

38. Which two protocols does DMVPN leverage to build dynamic VPNs to multiple destinations? (Choose two.)

IKEv2

NHRP

mGRE

mBGP

GDOI

39. A user at a company HQ is having trouble accessing a network share at a branch site that is connected with a L2L IPsec VPN. While troubleshooting, a network security engineer runs a packet tracer on the Cisco ASA to simulate the user traffic and discovers that the encryption counter is increasing but the decryption counter is not.

What must be configured to correct this issue?

Adjust the routing on the remote peer device to direct traffic back over the tunnel.

Adjust the preshared key on the remote peer to allow traffic to flow over the tunnel.

Adjust the transform set to allow bidirectional traffic.

Adjust the peer IP address on the remote peer to direct traffic back to the AS

40. An engineer has integrated a new DMVPN to link remote offices across the internet using Cisco IOS routers. When connecting to remote sites, pings and voice data appear to flow properly, and all tunnel stats show that they are up. However, when trying to connect to a remote server using RDP, the connection fails.

Which action resolves this issue?

Adjust the MTU size within the routers.

Add RDP port to the extended AC

Replace certificate on the RDP server.

Change DMVPN timeout values.

Page 5 of 6

41. Under which section must a bookmark or URL list be configured on a Cisco ASA to be available for clientless SSLVPN users?

tunnel-group (general-attributes)

tunnel-group (webvpn-attributes)

webvpn (group-policy)

webvpn (global configuration)

42. A network engineer is configuring a server. The router will terminate encrypted VPN connections on g0/0, which is in the VRF "Internet". The clear-text traffic that must be encrypted before being sent out traverses g0/1, which is in the VRF "Internal".

Which two VRF-specific configurations allow VPN traffic to traverse the VRF-aware interfaces? (Choose two.)

Under the IKEv2 profile, add the ivrf Internal command.

Under the virtual-template interface, add the ip vrf forwarding Internet command.

Under the IKEv2 profile, add the match fvrf Internal command.

Under the IKEv2 profile, add the match fvrf Internet command.

Under the virtual-template interface, add the tunnel vrf Internet command.

43. Refer to the exhibit.

A Cisco ASA is configured as a client to a router running as a FlexVPN server. The router is configured with a virtual template to terminate FlexVPN clients. Traffic between networks 192.168.0.0/24 and 172.16.20.0/24 does not work as expected.

Based on the show crypto ikev2 sa output collected from the Cisco ASA in the exhibit, what is the solution to this issue?

Modify the crypto ACL on the router to permit network 192.168.0.0/24 to network 172.16.20.0/24.

Modify the crypto ACL on the ASA to permit network 192.168.0.0/24 to network 172.16.20.0/24.

Modify the crypto ACL on the ASA to permit network 172.16.20.0/24 to network 192.168.0.0/24.

Modify the crypto ACL on the router to permit network 172.16.20.0/24 to network 192.168.0.0/24.

44. Refer to the exhibit.

All internal clients behind the ASA are port address translated to the public outside interface that has an IP address of 3.3.3.3. Client 1 and client 2 have established successful SSL VPN connections to the ASA.

What must be implemented so that "3.3.3.3" is returned from a browser search on the IP address?

Same-security-traffic permit inter-interface under Group Policy

Exclude Network List Below under Group Policy

Tunnel All Networks under Group Policy

Tunnel Network List Below under Group Policy

45. What are two advantages of using GETVPN to traverse over the network between corporate offices? (Choose two.)

It has unique session keys for improved security.

It supports multicast.

It has QoS support.

It is a highly scalable any to any mesh topology.

It supports a hub-and-spoke topology.

46. What are two differences between ECC and RSA? (Choose two.)

Key generation in ECC is slower and more CPU intensive than RS

ECC can have the same security as RSA but with a shorter key size.

ECC cannot have the same security as RSA, even with an increased key size.

Key generation in ECC is faster and less CPU intensive than RS

ECC lags in performance when compared with RS

47. Refer to the exhibit.

A network engineer is configuring a remote access SSLVPN and is unable to complete the connection using local credentials.

What must be done to remediate this problem?

Enable the client protocol in the Cisco AnyConnect profile.

Configure a AAA server group to authenticate the client.

Change the authentication method to local.

Configure the group policy to force local authentication.

48. Which method dynamically installs the network routes for remote tunnel endpoints?

policy-based routing

CEF

reverse route injection

route filtering

49. A user is experiencing delays on audio calls over a Cisco AnyConnect VPN.

Which implementation step resolves this issue?

Change to 3DES Encryption.

Shorten the encryption key lifetime.

Install the Cisco AnyConnect 2.3 client for the user to download.

Enable DTL

50. Refer to the exhibit.

DMVPN spoke-to-spoke traffic works, but it passes through the hub, and never sends direct spoke-to-spoke traffic.

Based on the tunnel interface configuration shown, what must be configured on the hub to solve the issue?

Enable NHRP redirect.

Enable split horizon.

Enable IP redirects.

Enable NHRP shortcut.

Page 6 of 6

51. What must be configured in a FlexVPN deployment to allow for direct communication between spokes connected to different hubs?

EIGRP must be used as routing protocol.

Hub routers must be on same Layer 2 network.

Load balancing must be disabled.

A GRE tunnel must exist between hub routers.

52. A network engineer has set up a FlexVPN server to terminate multiple FlexVPN clients. The VPN tunnels are established without issue. However, when a Change of Authorization is issued by the RADIUS server, the FlexVPN server does not update the authorization of connected FlexVPN clients.

Which action resolves this issue?

Add the aaa server radius dynamic-author command on the FlexVPN clients.

Fix the RADIUS key mismatch between the RADIUS server and FlexVPN server.

Add the aaa server radius dynamic-author command on the FlexVPN server.

Fix the RADIUS key mismatch between the RADIUS server and FlexVPN clients.

53. Over which two transport mediums is FlexVPN deployed? (Choose two.)

VPLS

internet

MPLS

DWDM

TAGS:

300-730, 300-730 exam dumps

Notify of

Label

Name*

Email*

Website

Label

Name*

Email*

Website

0 Comments

Oldest

Newest Most Voted

Inline Feedbacks

View all comments

Get 300-730 Dumps Full Version

Q&As: 175
Versions: PDF and Software Download Now

About Dumpsinfo

Dumpsinfo is a good platform providing the latest exam information and dumps questions for all IT certification exams. You can study all the latest exam dumps questions online.

[email protected]

Mon - Sat 9:00am - 6:00pm

Good 300-730 Exam Dumps Save Your Preparation Time

Related

Posts

100-160 Dumps Guarantee You Pass 100-160 Exam Easily

Pass 300-815 Exam to Get Cisco Certification

Test Online 300-445 Dumps Questions to Be Certified

Improve Your Knowledge with 300-540 Exam Dumps

About Us

EMAIL

Services

Opening Hours