300-730 Dumps PDF – 300-730 Real Exam Questions Answers [Q94-Q115]

300-730 Dumps PDF - 300-730 Real Exam Questions Answers [Q94-Q115].

ExamBoosts 28 décembre 2023 300-730 > Cisco 0

Notez cet article

300-730 Dumps PDF – 300-730 Real Exam Questions Answers

Get Started: 300-730 Exam [year] Dumps Cisco PDF Questions

Cisco is a leading provider of networking and security solutions, and its certifications are highly valued in the IT industry. The Cisco 300-730 certification exam is an excellent opportunity for IT professionals to demonstrate their expertise in secure VPN implementation and advance their careers in the field of network security.

NOUVELLE QUESTION 94
Which technology works with IPsec stateful failover?

GLBR

HSRP

GRE

VRRP

Référence :
https://www.cisco.com/c/en/us/td/docs/ios/12_2/12_2y/12_2yx11/feature/guide/ ft_vpnha.html#wp1122512

NOUVELLE QUESTION 95
In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form. Which troubleshooting step solves the issue?

Verify the spoke configuration to check if the NHRP redirect is enabled.

Verify that the spoke receives redirect messages and sends resolution requests.

Verify the hub configuration to check if the NHRP shortcut is enabled.

Verify that the tunnel interface is contained within a VRF.

Référence :
On receiving the redirect, Spoke1 initiates a resolution request for Host2 over the point-to-point tunnel interface (the same interface over which it received the redirect). The resolution request traverses the routed path (Spoke1-hub-spoke2). On receiving the resolution request, Spoke2 determines that it is the exit point and needs to respond to the resolution request. https://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-2mt/sec-flex-spoke.html

NOUVELLE QUESTION 96
Which two features are valid backup options for an IOS FlexVPN client? (Choose two.)

HSRP stateless failover

DNS-based hub resolution

reactivate primary peer

tunnel pivot

need distractor

https://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-2mt/sec-cfg-flex-clnt.html#GUID-CA7D6429-5F13-4CB9-BE2E-EDFCFB3792B3

NOUVELLE QUESTION 97
An engineer is troubleshooting a new DMVPN setup on a Cisco IOS router. After the show crypto isakmp sa command is issued, a response is returned of “MM_NO_STATE.” Why does this failure occur?

The ISAKMP policy priority values are invalid.

ESP traffic is being dropped.

The Phase 1 policy does not match on both devices.

Tunnel protection is not applied to the DMVPN tunnel.

https://www.cisco.com/c/en/us/support/docs/security/dynamic-multipoint-vpn-dmvpn/111976-dmvpn-troubleshoot-00.html The MMNOSTATE failure occurs when the ISAKMP policy priority values are not configured correctly on both devices. The ISAKMP policy priority values are used to determine the order in which the ISAKMP policies are applied. If the priority values do not match between the two devices, the ISAKMP tunnel may not be established correctly, resulting in the MMNOSTATE failure. To resolve this issue, the engineer should ensure that the ISAKMP policy priority values are configured correctly on both the router and the peer.

NOUVELLE QUESTION 98
Which two statements about the Cisco ASA Clientless SSL VPN solution are true? (Choose two.)

When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the client uses the local DNS to perform FQDN resolution.

The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default.

A Cisco ASA can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions.

When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the ASA uses its configured DNS servers to perform FQDN resolution.

Clientless SSLVPN provides Layer 3 connectivity into the secured network.

Section: Remote access VPNs

NOUVELLE QUESTION 99
Se référer à la pièce jointe.

Which type of Cisco VPN is shown for group Cisc012345678?

Cisco AnyConnect Client VPN

DMVPN

Clientless SSLVPN

GETVPN

https://learningnetwork.cisco.com/s/question/0D53i00000Q4COCCA3/anyconnect-ssl-vpn

NOUVELLE QUESTION 100
A second set of traffic selectors is negotiated between two peers using IKEv2. Which IKEv2 packet will contain details of the exchange?

IKEv2 IKE_SA_INIT

IKEv2 INFORMATIONAL

IKEv2 CREATE_CHILD_SA

IKEv2 IKE_AUTH

Section: Site-to-site Virtual Private Networks on Routers and Firewalls Explanation/Reference:

NOUVELLE QUESTION 101
Which two NHRP functions are specific to DMVPN Phase 3 implementation? (Choose two.)

registration reply

redirect

resolution reply

registration request

resolution request

NOUVELLE QUESTION 102
Under which section must a bookmark or URL list be configured on a Cisco ASA to be available for clientless SSLVPN users?

tunnel-group (general-attributes)

tunnel-group (webvpn-attributes)

webvpn (group-policy)

webvpn (global configuration)

Section: Remote access VPNs

NOUVELLE QUESTION 103
Se référer à la pièce jointe.

Which type of VPN is being configured, based on the partial configuration snippet?

GET VPN with COOP key server

GET VPN with dual group member

FlexVPN load balancer

FlexVPN backup gateway

NOUVELLE QUESTION 104
In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form. Which troubleshooting step solves the issue?

Verify the spoke configuration to check if the NHRP redirect is enabled.

Verify that the spoke receives redirect messages and sends resolution requests.

Verify the hub configuration to check if the NHRP shortcut is enabled.

Verify that the tunnel interface is contained within a VRF.

Section: Troubleshooting using ASDM and CLI
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec- conn-dmvpn-15-mt-book/sec-conn-dmvpn-summ-maps.pdf

NOUVELLE QUESTION 105
A company needs to ensure only corporate issued laptops and devices are allowed to connect with the Cisco AnyConnect client. The solution should be applicable to multiple operating systems, including Windows, MacOS, and Linux, and should allow for remote remediation if a corporate issued device is stolen. Which solution should be used to accomplish these goals?

Use a DAP registry check on the system to determine the relationship with the corporate domain.

Use a DAP file check on the system to determine the relationship with the corporate domain.

Install and authenticate user certificates on the corporate devices.

Install and authenticate machine certificates on the corporate devices

https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/asdm78/vpn/asdm-78-vpn-config/vpn-asdm-dap.html#ID-2184-00000017

NOUVELLE QUESTION 106

Refer to the exhibit. Based on the exhibit, why are users unable to access CCNP Webserver bookmark?

The URL is being blocked by a WebACL.

The ASA cannot resolve the URL.

The bookmark has been disabled.

The user cannot access the URL.

Section: Remote access VPNs

NOUVELLE QUESTION 107
Se référer à la pièce jointe.

Which value must be configured in the User Group field when the Cisco AnyConnect Profile is created to connect to an ASA headend with IPsec as the primary protocol?

address-pool

group-alias

group-policy

tunnel-group

Référence :
https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect41/ administration/guide/b_AnyConnect_Administrator_Guide_4-1/configure-vpn.html

NOUVELLE QUESTION 108
Which statement about GETVPN is true?

The configuration that defines which traffic to encrypt originates from the key server.

TEK rekeys can be load-balanced between two key servers operating in COOP.

The pseudotime that is used for replay checking is synchronized via NTP.

Group members must acknowledge all KEK and TEK rekeys, regardless of configuration.

KS (key server) is ‘caretaker’ of the GM group. Group registrations and authentication of GMs is taken care of by KS server. Any GM who wants to join the group is required to be successfully authenticated in the group and sends encryption keys and policy to be used within the group.
===
https://ipwithease.com/introduction-to-getvpn/

NOUVELLE QUESTION 109
Se référer à la pièce jointe.

The IKEv2 site-to-site VPN tunnel between two routers is down. Based on the debug output, which type of mismatch is the problem?

preshared key

peer identity

transform set

ikev2 proposal

NOUVELLE QUESTION 110

Refer to the exhibit. A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which action brings up the VPN tunnel?

Reduce the maximum SA limit on the local Cisco ASA.

Increase the maximum in-negotiation SA limit on the local Cisco ASA.

Remove the maximum SA limit on the remote Cisco ASA.

Correct the crypto access list on both Cisco ASA devices.

Section: Site-to-site Virtual Private Networks on Routers and Firewalls

NOUVELLE QUESTION 111
A network engineer must design a clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was found that one website is not being rewritten correctly by the ASA.
What is a potential solution for this issue while still allowing it to be a clientless VPN setup?

Set up a smart tunnel with the IP address of the web server.

Set up a NAT rule that translates the ASA public address to the web server private address on port 80.

Set up Cisco AnyConnect with a split tunnel that has the IP address of the web server.

Set up a WebACL to permit the IP address of the web server.

NOUVELLE QUESTION 112
A network engineer is setting up Cisco AnyConnect 4.9 on a Cisco ASA running ASA software 9.1. Cisco AnyConnect must connect to the Cisco ASA before the user logs on so that login scripts can work successfully. In addition, the VPN must connect without user intervention. Which two key steps accomplish this task? (Choose two.)

Create a Network Access Manager profile with a client policy set to connect before user logon.

Create a Cisco AnyConnect VPN profile with Start Before Logon set to true.

Issue an identity certificate to the trusted root CA folder in the machine store.

Create a Cisco AnyConnect VPN profile with Always On set to true.

Create a Cisco Anyconnect VPN Management Tunnel profile.

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/215442-configure-anyconnect-management-vpn-tunn.html

NOUVELLE QUESTION 113
Se référer à la pièce jointe.

DMVPN spoke-to-spoke traffic works, but it passes through the hub, and never sends direct spoke-to-spoke traffic. Based on the tunnel interface configuration shown, what must be configured on the hub to solve the issue?

Enable NHRP redirect.

Enable split horizon.

Enable IP redirects.

Enable NHRP shortcut.

NOUVELLE QUESTION 114
Which redundancy protocol must be implemented for IPsec stateless failover to work?

SSO

GLBP

HSRP

VRRP

Section: Secure Communications Architectures
Explanation/Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike- protocols/17826-ipsec-feat.html

NOUVELLE QUESTION 115
Se référer à la pièce jointe.

Based on the exhibit, why are users unable to access CCNP Webserver bookmark?