[Dec-2022] The Best CCNP Security Study Guide for the 300-730 Exam [Q47-Q67]

[Dec-2022] The Best CCNP Security Study Guide for the 300-730 Exam

300-730 certification guide Q&A from Training Expert Free4Dump

What Domains Does 300-730 Measure?

In order to get a passing score in the Cisco 300-730 test, the entrant must have an adequate understanding of the following exam domains and all the terms that are included in it:

• Communication architecture security (30%)

  The final topic of the Cisco 300-730 test deals with communication architectures and their security. In order to earn a passing score in such an exam, the candidate must be capable of identifying the elements for functions of GETVPN, DMVPN, FlexVPN, and IPsec used for various site-to-site VPN solutions. Moreover, this domain consists of questions regarding issues for remotely accessing VPN solutions. What’s more, the applicant should be able to identify various VPN technologies based on the configuration output for both remote and site-to-site VPN solutions. This portion also includes the concept of split tunneling and its requirements along with designing solutions for both site-to-site and remotely accessible VPNs. In addition, the applicant should have the expertise in identifying considerations for designing such solutions based on functional requirements. Finally, this portion of the official exam includes the concept of algorithms for Elliptic Curve Cryptography (ECC).

• Accessing VPNs remotely (20%)

  The second section of the Cisco 300-730 exam is all about VPNs and their remote access. To get through this part, the entrant’s knowledge of the concept of AnyConnect will help tremendously. This includes the implementation of IKEv2 VPNs based on both ASA & various routers. The candidate must also understand AnyConnect SSLVPN, Clientless SSLVPN, and their implementation. Finally, this objective also deals with Flex VPN and its implementation on routes.

• Site-to-site VPN on firewalls and routers (15%)

  The first domain for the official exam tests the applicant’s knowledge of the concept of GETVPN. The candidate must be able to thoroughly describe it with ease. In addition to that, the exam also includes questions related to DMVPN and its implementation. This includes both hub-to-spoke as well as spoke-to-spoke technologies. Moreover, the candidate should also have a comprehension of FlexVPN and its implementation on IPv6 and IPv4 by using AAA that are local.

• CLI troubleshooting & ASDM (35%)

  The third portion of the final test is the one that covers the highest percentage of all the questions. In particular, this exam domain includes 5 topics that deal with ASDM as well as CLI and how to use them for troubleshooting. Thus, the applicant needs to have an understanding of IPSec and how to troubleshoot it. In addition to that, such a domain also includes troubleshooting DMVPN along with FlexVPN. Finally, the entrant should have the idea of troubleshooting IKEv2 of AnyConnect and SSL VPNs along with SSLVPN Clientless on both routers alongside ASA.

NO.47 Which parameter is initially used to elect the primary key server from a group of key servers?

 code version

 highest IP address

 highest-priority value

 lowest IP address

Reference:
https://www.cisco.com/c/en/us/products/collateral/security/group-encrypted-transport-vpn/ deployment_guide_c07_554713.html

NO.48 Which technology is used to send multicast traffic over a site-to-site VPN?

 GRE over IPsec on IOS router

 GRE over IPsec on FTD

 IPsec tunnel on FTD

 GRE tunnel on ASA

NO.49 Refer to the exhibit.

Which VPN technology is allowed for users connecting to the Employee tunnel group?

 SSL AnyConnect

 IKEv2 AnyConnect

 crypto map

 clientless

NO.50

Refer to the exhibit. What is a result of this configuration?

 Spoke 1 fails the authentication because the authentication methods are incorrect.

 Spoke 2 passes the authentication to the hub and successfully proceeds to phase 2.

 Spoke 2 fails the authentication because the remote authentication method is incorrect.

 Spoke 1 passes the authentication to the hub and successfully proceeds to phase 2.

Section: Troubleshooting using ASDM and CLI

NO.51 Drag and drop the code snippets from the right onto the blanks in the configuration to implement FlexVPN. Not all snippets are used.

NO.52 Which Cisco AnyConnect component ensures that devices in a specific internal subnet are only accessible using port 443?

 routing

 WebACL

 split tunnel

 VPN filter

NO.53 Refer to the exhibit.

What is configured as a result of this command set?

 FlexVPN client profile for IPv6

 FlexVPN server to authorize groups by using an IPv6 external AAA

 FlexVPN server for an IPv6 dVTI session

 FlexVPN server to authenticate IPv6 peers by using EAP

Reference:
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/xe-3s/sec-flex- vpn-xe-3s-book/sec-cfg-flex-clnt.html

NO.54 What is a requirement for smart tunnels to function properly?

 Java or ActiveX must be enabled on the client machine.

 Applications must be UDP.

 Stateful failover must not be configured.

 The user on the client machine must have admin access.

Reference:
https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation- firewalls/111007-smart-tunnel-asa-00.html

NO.55 Refer to the exhibit.

Which two conclusions should be drawn from the DMVPN phase 2 configuration? (Choose two.)

 Next-hop-self is required.

 EIGRP neighbor adjacency will fail.

 EIGRP is used as the dynamic routing protocol.

 EIGRP route redistribution is not allowed.

 Spoke-to-spoke communication is allowed.

NO.56 In order to enable FlexVPN to use a AAA attribute list, which two tasks must be performed? (Choose two.)

 Define the RADIUS server.

 Verify that clients are using the correct authorization policy.

 Define the AAA server.

 Assign the list to an authorization policy.

 Set the maximum segment size.

NO.57 Refer to the exhibit.

An SSL client is connecting to an ASA headend. The session fails with the message “Connection attempt has timed out. Please verify Internet connectivity.” Based on how the packet is processed, which phase is causing the failure?

 phase 9: rpf-check

 phase 5: NAT

 phase 4: ACCESS-LIST

 phase 3: UN-NAT

NO.58 Which two parameters help to map a VPN session to a tunnel group without using the tunnel-group list? (Choose two.)

 group-alias

 certificate map

 optimal gateway selection

 group-url

 AnyConnect client version

NO.59 Which two statements about the Cisco ASA Clientless SSL VPN solution are true? (Choose two.)

 When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the client uses the local DNS to perform FQDN resolution.

 The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default.

 A Cisco ASA can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions.

 When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the ASA uses its configured DNS servers to perform FQDN resolution.

 Clientless SSLVPN provides Layer 3 connectivity into the secured network.

NO.60 Which requirement is needed to use local authentication for Cisco AnyConnect Secure Mobility Clients that connect to a FlexVPN server?

 use of certificates instead of username and password

 EAP-AnyConnect

 EAP query-identity

 AnyConnect profile

Reference:
https://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2- Remote-Access.html

NO.61 Which technology works with IPsec stateful failover?

 GLBR

 HSRP

 GRE

 VRRP

Section: Secure Communications Architectures
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/ios/12_2/12_2y/12_2yx11/feature/guide/ ft_vpnha.html#wp1122512

NO.62 An engineer notices that while an employee is connected remotely, all traffic is being routed to the corporate network. Which split-tunnel policy allows a remote client to use their local provider for Internet access when working from home?

 tunnelall

 excludeall

 tunnelspecified

 excludespecified

NO.63 Which technology works with IPsec stateful failover?

 GLBR

 HSRP

 GRE

 VRRP

Reference:
https://www.cisco.com/c/en/us/td/docs/ios/12_2/12_2y/12_2yx11/feature/guide/ ft_vpnha.html#wp1122512

NO.64 Refer to the exhibit.

The customer must launch Cisco AnyConnect in the RDP machine. Which IOS configuration accomplishes this task?

 Option A

 Option B

 Option C

 Option D

Reference:
https://community.cisco.com/t5/vpn/starting-anyconnect-vpn-through-rdp-session-on-cisco-891/td- p/2128284

NO.65 Which command is used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?

 show crypto ikev2 sa

 show crypto isakmp sa

 show crypto gkm

 show crypto identity

NO.66 Which technology is used to send multicast traffic over a site-to-site VPN?

 GRE over IPsec on IOS router

 GRE over IPsec on FTD

 IPsec tunnel on FTD

 GRE tunnel on ASA

Section: Secure Communications Architectures

NO.67 Which IKE identity does an IOS/IOS-XE headend expect to receive if an IPsec Cisco AnyConnect client uses default settings?

 *$SecureMobilityClient$*

 *$AnyConnectClient$*

 *$RemoteAccessVpnClient$*

 *$DfltlkeldentityS*

Reference:
https://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2- Remote-Access.html

 Loading …

The Best Cisco 300-730 Study Guides and Dumps of 2022: https://www.free4dump.com/300-730-braindumps-torrent.html

         

Related Links: www.stes.tyc.edu.tw myportal.utt.edu.tt myportal.utt.edu.tt www.stes.tyc.edu.tw myportal.utt.edu.tt www.stes.tyc.edu.tw