300-730無料問題集「Cisco Implementing Secure Solutions with Virtual Private Networks」

質問 1

Users cannot log in to a Cisco ASA using clientless SSLVPN. Troubleshooting reveals the error message "WebVPN session terminated: Client type not supported". Which step does the administrator take to resolve this issue?

（A）Have the user upgrade to a supported browser.

（B）Enable the Cisco AnyConnect premium license on the Cisco ASA.

（C）Enable the clientless VPN protocol on the group policy.

（D）Increase the simultaneous logins on the group policy.

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 2

Cisco AnyConnect clients need to transfer large files over the VPN sessions. Which protocol provides the best throughput?

（A）L2TP

（B）SSL/TLS

（C）IPsec IKEv1

（D）DTLS

正解：D 解答を投票する

質問 3

In FlexVPN, what is the role of a NHRP resolution request?

（A）It dynamically assigns VPN users to a group

（B）It blocks these entities from to directly communicating with each other

（C）It makes sure that each VPN spoke directly communicates with the hub

（D）It allows these entities to directly communicate without requiring traffic to use an intermediate hop

正解：D 解答を投票する

質問 4

What are two functions of ECDH and ECDSA? (Choose two.)

（A）encryption

（B）revocation

（C）nonrepudiation

（D）digital signature

（E）key exchange

正解：D、E 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 5

What is a characteristic of GETVPN?

（A）An ACL that defines interesting traffic must be configured and applied to the crypto map.

（B）Quick mode is used to create an IPsec SA.

（C）The remote peer for the IPsec session is configured as part of the crypto map.

（D）All peers have one IPsec SPI for inbound and outbound communication.

正解：D 解答を投票する

質問 6

Refer to the exhibit. An SSL client is connecting to an ASA headend. The session fails with the message "Connection attempt has timed out. Please verify Internet connectivity." Based on how the packet is processed, which phase is causing the failure?

（A）phase 5: NAT

（B）phase 4: ACCESS-LIST

（C）phase 9: rpf-check

（D）phase 3: UN-NAT

正解：D 解答を投票する

質問 7

Refer to the exhibit. Cisco AnyConnect must be set up on a router to allow users to access internal servers 192.168.0.10 and 192.168.0.11.
All other traffic should go out of the client's local NIC.
Which command accomplishes this configuration?

（A）svc split include 192.168.0.0 255.255.255.0

（B）svc split exclude 192.168.0.0 255.255.255.0

（C）svc split exclude acl CCNP

（D）svc split include acl CCNP

正解：D 解答を投票する

質問 8

A clientless SSLVPN is set up to allow remote users to access internal HTTPS webservers.
Users can access all but one server and see the message "Connection Failed. Server
192.168.0.101 unavailable". Pings between the Cisco ASA and the webserver are successful, and users can connect to the webserver when they use their computer in the internal network.
Which action resolves this issue?

（A）Configure a DNS server that can resolve the webserver domain on the Cisco ASA.

（B）Add the http 192.168.0.101 255.255.255.255 inside command to the Cisco ASA.

（C）Configure routing on the Cisco ASA so it can reach the webserver.

（D）Add an SSL cipher that can be negotiated with the webserver to the Cisco ASA.

正解：D 解答を投票する

質問 9

Refer to the exhibit. Which VPN technology is allowed for users connecting to the Employee tunnel group?

（A）IKEv2 AnyConnect

（B）SSL AnyConnect

（C）clientless

（D）crypto map

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 10

Refer to the exhibit. All internal clients behind the ASA are port address translated to the public outside interface that has an IP address of 3.3.3.3. Client 1 and client 2 have established successful SSL VPN connections to the ASA.
What must be implemented so that "3.3.3.3" is returned from a browser search on the IP address?

（A）Tunnel All Networks under Group Policy

（B）Tunnel Network List Below under Group Policy

（C）Same-security-traffic permit inter-interface under Group Policy

（D）Exclude Network List Below under Group Policy

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 11

An engineer is requesting an SSL certificate for a VPN load-balancing cluster in which two Cisco ASAs provide clientless SSLVPN access. The FQDN that users will enter to access the clientless VPN is asa.example.com, and users will be redirected to either asa1.example.com or asa2.example.com. The cluster FQDN and individual Cisco ASAs FQDNs resolve to IP addresses 192.168.0.1, 192.168.0.2, and 192.168.0.3 respectively. The issued certificate must be able to be used to validate the identity of either ASA in the cluster without returning any certificate validation errors. Which fields must be included in the certificate to meet these requirements?

（A）CN=asa.example.com, SAN=asa.example.com, asa1.example.com, asa2.example.com

（B）CN=*.example.com, SAN=asa.example.com

（C）CN=192.168.0.1, SAN=192.168.0.1, 192.168.0.2, 192.168.0.3

（D）CN=192.168.0.1, SAN=asa1.example.com, asa2.example.com

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 12

An organization wants to implement a site-to-site VPN solution that must be able to support 350 sites with direct communications between all sites, fully encrypt the packet header and payload, and support propagation of routing information over IPsec. Which solution meets these requirements?

（A）DMVPN

（B）IPsec full mesh

（C）GETVPN

（D）FlexVPN

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 13

Which VPN solution uses TBAR?

（A）DMVPN

（B）Cisco AnyConnect

（C）GETVPN

（D）VTI

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 14

Which IKEv2 feature minimizes the configuration of a FlexVPN on Cisco IOS devices?

（A）IKEv2 profiles

（B）IKEv2 Suite-B

（C）IKEv2 proposals

（D）IKEv2 Smart Defaults

正解：D 解答を投票する

質問 15

A network engineer must design a clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was found that one website is not being rewritten correctly by the ASA. What is a potential solution for this issue while still allowing it to be a clientless VPN setup?

（A）Set up Cisco AnyConnect with a split tunnel that has the IP address of the web server.

（B）Set up a WebACL to permit the IP address of the web server.

（C）Set up a NAT rule that translates the ASA public address to the web server private address on port 80.

（D）Set up a smart tunnel with the IP address of the web server.

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

300-730 無料問題集「Cisco Implementing Secure Solutions with Virtual Private Networks」

弊社を連絡する

関連リンク

トップ試験