Deck 27: Automating Cisco Security Solutions (SAUTO)

Question 1

Refer to the exhibit. An engineer is troubleshooting a new GRE over IPsec tunnel. The tunnel is established but the engineer cannot ping from spoke 1 to spoke 2. Which type of traffic is being blocked?

A) ESP packets from spoke2 to spoke1
B) ISAKMP packets from spoke2 to spoke1
C) ESP packets from spoke1 to spoke2
D) ISAKMP packets from spoke1 to spoke2

Answer 1

ESP packets from spoke2 to spoke1

Question 2

Refer to the exhibit. What is a result of this configuration?

A) Spoke 1 fails the authentication because the authentication methods are incorrect.
B) Spoke 2 passes the authentication to the hub and successfully proceeds to phase 2.
C) Spoke 2 fails the authentication because the remote authentication method is incorrect.
D) Spoke 1 passes the authentication to the hub and successfully proceeds to phase 2.

Answer 2

Spoke 1 fails the authentication because the authentication methods are incorrect.

Question 3

Under which section must a bookmark or URL list be configured on a Cisco ASA to be available for clientless SSLVPN users?

A) tunnel-group (general-attributes)
B) tunnel-group (webvpn-attributes)
C) webvpn (group-policy)
D) webvpn (global configuration)

Answer 3

webvpn (global configuration)

Question 4

Refer to the exhibit. A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which action brings up the VPN tunnel?

A) Reduce the maximum SA limit on the local Cisco ASA.
B) Increase the maximum in-negotiation SA limit on the local Cisco ASA.
C) Remove the maximum SA limit on the remote Cisco ASA.
D) Correct the crypto access list on both Cisco ASA devices.

Question 5

Refer to the exhibit. Based on the debug output, which type of mismatch is preventing the VPN from coming up?

A) interesting traffic
B) lifetime
C) preshared key
D) PFS

Question 6

Which technology works with IPsec stateful failover?

A) GLBR
B) HSRP
C) GRE
D) VRRP

Question 7

Refer to the exhibit. The customer can establish a Cisco AnyConnect connection without using an XML profile. When the host "ikev2" is selected in the AnyConnect drop down, the connection fails. What is the cause of this issue?

A) The HostName is incorrect.
B) The IP address is incorrect.
C) Primary protocol should be SSL.
D) UserGroup must match connection profile.

Question 8

Refer to the exhibit. Based on the exhibit, why are users unable to access CCNP Webserver bookmark?

A) The URL is being blocked by a WebACL.
B) The ASA cannot resolve the URL.
C) The bookmark has been disabled.
D) The user cannot access the URL.

Question 9

Which redundancy protocol must be implemented for IPsec stateless failover to work?

A) SSO
B) GLBP
C) HSRP
D) VRRP

Question 10

Which command automatically initiates a smart tunnel when a user logs in to the WebVPN portal page?

A) auto-upgrade
B) auto-connect
C) auto-start
D) auto-run

Question 11

Which two features provide headend resiliency for Cisco AnyConnect clients? (Choose two.)

A) AnyConnect Auto Reconnect
B) AnyConnect Network Access Manager
C) AnyConnect Backup Servers
D) ASA failover
E) AnyConnect Always On

Question 12

Refer to the exhibit. Which VPN technology is allowed for users connecting to the Employee tunnel group?

A) SSL AnyConnect
B) IKEv2 AnyConnect
C) crypto map
D) clientless

Question 13

Refer to the exhibit. The DMVPN tunnel is dropping randomly and no tunnel protection is configured. Which spoke configuration mitigates tunnel drops?

A)
B)
C)
D)

Question 14

Refer to the exhibit. A site-to-site tunnel between two sites is not coming up. Based on the debugs, what is the cause of this issue?

A) An authentication failure occurs on the remote peer.
B) A certificate fragmentation issue occurs between both sides.
C) UDP 4500 traffic from the peer does not reach the router.
D) An authentication failure occurs on the router.

Question 15

Which IKE identity does an IOS/IOS-XE headend expect to receive if an IPsec Cisco AnyConnect client uses default settings?

A) *$SecureMobilityClient$*
B) *$AnyConnectClient$*
C) *$RemoteAccessVpnClient$*
D) *$DfltlkeldentityS*

Question 16

Refer to the exhibit. The IKEv2 site-to-site VPN tunnel between two routers is down. Based on the debug output, which type of mismatch is the problem?

A) preshared key
B) peer identity
C) transform set
D) ikev2 proposal

Question 17

Which configuration construct must be used in a FlexVPN tunnel?

A) EAP configuration
B) multipoint GRE tunnel interface
C) IKEv1 policy
D) IKEv2 profile

Question 18

Which requirement is needed to use local authentication for Cisco AnyConnect Secure Mobility Clients that connect to a FlexVPN server?

A) use of certificates instead of username and password
B) EAP-AnyConnect
C) EAP query-identity
D) AnyConnect profile

Question 19

Which method dynamically installs the network routes for remote tunnel endpoints?

A) policy-based routing
B) CEF
C) reverse route injection
D) route filtering

Question 20

Refer to the exhibit. Which two commands under the tunnel-group webvpn-attributes result in a Cisco AnyConnect user receiving the AnyConnect prompt in the exhibit? (Choose two.)

A) group-url https://172.16.31.10/General enable
B) group-policy General internal
C) authentication aaa
D) authentication certificate
E) group-alias General enable

Question 21

What uses an Elliptic Curve key exchange algorithm?

A) ECDSA
B) ECDHE
C) AES-GCM
D) SHA

Question 22

Refer to the exhibit. The customer must launch Cisco AnyConnect in the RDP machine. Which IOS configuration accomplishes this task?

A)
B)
C)
D)

Question 23

Which technology is used to send multicast traffic over a site-to-site VPN?

A) GRE over IPsec on IOS router
B) GRE over IPsec on FTD
C) IPsec tunnel on FTD
D) GRE tunnel on ASA

Question 24

Which parameter is initially used to elect the primary key server from a group of key servers?

A) code version
B) highest IP address
C) highest-priority value
D) lowest IP address

Question 25

A Cisco ASA is configured in active/standby mode. What is needed to ensure that Cisco AnyConnect users can connect after a failover event?

A) AnyConnect images must be uploaded to both failover ASA devices.
B) The vpnsession-db must be cleared manually.
C) Configure a backup server in the XML profile.
D) AnyConnect client must point to the standby IP address.

Question 26

What is a requirement for smart tunnels to function properly?

A) Java or ActiveX must be enabled on the client machine.
B) Applications must be UDP.
C) Stateful failover must not be configured.
D) The user on the client machine must have admin access.

Question 27

Which two commands help determine why the NHRP registration process is not being completed even after the IPsec tunnel is up? (Choose two.)

A) show crypto isakmp sa
B) show ip traffic
C) show crypto ipsec sa
D) show ip nhrp traffic
E) show dmvpn detail

Question 28

In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form. Which troubleshooting step solves the issue?

A) Verify the spoke configuration to check if the NHRP redirect is enabled.
B) Verify that the spoke receives redirect messages and sends resolution requests.
C) Verify the hub configuration to check if the NHRP shortcut is enabled.
D) Verify that the tunnel interface is contained within a VRF.

Question 29

Which feature of GETVPN is a limitation of DMVPN and FlexVPN?

A) sequence numbers that enable scalable replay checking
B) enabled use of ESP or AH
C) design for use over public or private WAN
D) no requirement for an overlay routing protocol

Question 30

Which two types of web resources or protocols are enabled by default on the Cisco ASA Clientless SSL VPN portal? (Choose two.)

A) HTTP
B) ICA (Citrix)
C) VNC
D) RDP
E) CIFS

Question 31

Which feature allows the ASA to handle nonstandard applications and web resources so that they display correctly over a clientless SSL VPN connection?

A) single sign-on
B) Smart Tunnel
C) WebType ACL
D) plug-ins

Question 32

Which VPN does VPN load balancing on the ASA support?

A) VTI
B) IPsec site-to-site tunnels
C) L2TP over IPsec
D) Cisco AnyConnect

Question 33

Cisco AnyConnect clients need to transfer large files over the VPN sessions. Which protocol provides the best throughput?

A) SSL/TLS
B) L2TP
C) DTLS
D) IPsec IKEv1

Question 34

A Cisco AnyConnect client establishes a SSL VPN connection with an ASA at the corporate office. An engineer must ensure that the client computer meets the enterprise security policy. Which feature can update the client to meet an enterprise security policy?

A) Endpoint Assessment
B) Cisco Secure Desktop
C) Basic Host Scan
D) Advanced Endpoint Assessment

Question 35

Refer to the exhibit. Which two tunnel types produce the show crypto ipsec sa output seen in the exhibit? (Choose two.)

A) crypto map
B) DMVPN
C) GRE
D) FlexVPN
E) VTI

Question 36

Which two changes must be made in order to migrate from DMVPN Phase 2 to Phase 3 when EIGRP is configured? (Choose two.)

A) Add NHRP shortcuts on the hub.
B) Add NHRP redirects on the spoke.
C) Disable EIGRP next-hop-self on the hub.
D) Enable EIGRP next-hop-self on the hub.
E) Add NHRP redirects on the hub.

Question 37

Which two parameters help to map a VPN session to a tunnel group without using the tunnel-group list? (Choose two.)

A) group-alias
B) certificate map
C) optimal gateway selection
D) group-url
E) AnyConnect client version

Question 38

On a FlexVPN hub-and-spoke topology where spoke-to-spoke tunnels are not allowed, which command is needed for the hub to be able to terminate FlexVPN tunnels?

A) interface virtual-access
B) ip nhrp redirect
C) interface tunnel
D) interface virtual-template

Question 39

Refer to the exhibit. What is configured as a result of this command set?

A) FlexVPN client profile for IPv6
B) FlexVPN server to authorize groups by using an IPv6 external AAA
C) FlexVPN server for an IPv6 dVTI session
D) FlexVPN server to authenticate IPv6 peers by using EAP

Question 40

Which benefit of FlexVPN is a limitation of DMVPN using IKEv1?

A) GRE encapsulation allows for forwarding of non-IP traffic.
B) IKE implementation can install routes in routing table.
C) NHRP authentication provides enhanced security.
D) Dynamic routing protocols can be configured.

Question 41

An engineer is configuring clientless SSL VPN. The finance department has a database server that only they should access, but the sales department can currently access it. The finance and the sales departments are configured as separate group-policies. What must be added to the configuration to make sure the users in the sales department cannot access the finance department server?

A) tunnel group lock
B) smart tunnel
C) port forwarding
D) webtype ACL

Question 42

Refer to the exhibit. Which type of mismatch is causing the problem with the IPsec VPN tunnel?

A) crypto access list
B) Phase 1 policy
C) transform set
D) preshared key

Question 43

An engineer has integrated a new DMVPN to link remote offices across the internet using Cisco IOS routers. When connecting to remote sites, pings and voice data appear to flow properly, and all tunnel stats show that they are up. However, when trying to connect to a remote server using RDP, the connection fails. Which action resolves this issue?

A) Adjust the MTU size within the routers.
B) Add RDP port to the extended ACL.
C) Replace certificate on the RDP server.
D) Change DMVPN timeout values.

Question 44

Which statement about GETVPN is true?

A) The configuration that defines which traffic to encrypt originates from the key server.
B) TEK rekeys can be load-balanced between two key servers operating in COOP.
C) The pseudotime that is used for replay checking is synchronized via NTP.
D) Group members must acknowledge all KEK and TEK rekeys, regardless of configuration.

Question 45

Refer to the exhibit. The DMVPN spoke is not establishing a session with the hub. Which two actions resolve this issue? (Choose two.)

A) Change the spoke nhs to 172.16.18.1 and the nbma to 10.0.0.1.
B) Change the transform set to mode tunnel.
C) Change the ISAKMP policy authentication on the spoke to pre-shared.
D) Change the ISAKMP key address on the spoke to 0.0.0.0.
E) Change the nhrp authentication key on the spoke to cisco123.

Question 46

Which VPN solution uses TBAR?

A) GETVPN
B) VTI
C) DMVPN
D) Cisco AnyConnect

Question 47

Which command shows the smart default configuration for an IPsec profile?

A) show run all crypto ipsec profile
B) ipsec profile does not have any smart default configuration
C) show smart-defaults ipsec profile
D) show crypto ipsec profile default

Question 48

Where must an engineer configure a preshared key for a site-to-site VPN tunnel configured on a Cisco ASA?

A) isakmp policy
B) group policy
C) crypto map
D) tunnel group

Question 49

Refer to the exhibit. All internal clients behind the ASA are port address translated to the public outside interface that has an IP address of 3.3.3.3. Client 1 and client 2 have established successful SSL VPN connections to the ASA. What must be implemented so that "3.3.3.3" is returned from a browser search on the IP address?

A) Same-security-traffic permit inter-interface under Group Policy
B) Exclude Network List Below under Group Policy
C) Tunnel All Networks under Group Policy
D) Tunnel Network List Below under Group Policy

Question 50

Refer to the exhibit. Which value must be configured in the User Group field when the Cisco AnyConnect Profile is created to connect to an ASA headend with IPsec as the primary protocol?

A) address-pool
B) group-alias
C) group-policy
D) tunnel-group

Question 51

Which parameter must match on all routers in a DMVPN Phase 3 cloud?

A) GRE tunnel key
B) NHRP network ID
C) tunnel VRF
D) EIGRP split-horizon setting

Question 52

Refer to the exhibit. An SSL client is connecting to an ASA headend. The session fails with the message "Connection attempt has timed out. Please verify Internet connectivity." Based on how the packet is processed, which phase is causing the failure?

A) phase 9: rpf-check
B) phase 5: NAT
C) phase 4: ACCESS-LIST
D) phase 3: UN-NAT

Question 53

Which two statements about the Cisco ASA Clientless SSL VPN solution are true? (Choose two.)

A) When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the client uses the local DNS to perform FQDN resolution.
B) The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default. The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default.
C) A Cisco ASA can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions.
D) When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the ASA uses its configured DNS servers to perform FQDN resolution.
E) Clientless SSLVPN provides Layer 3 connectivity into the secured network.

Question 54

Refer to the exhibit. Which VPN technology is used in the exhibit?

A) DVTI
B) VTI
C) DMVPN
D) GRE

Question 55

A network engineer must design a remote access solution to allow contractors to access internal servers. These contractors do not have permissions to install applications on their computers. Which VPN solution should be used in this design?

A) IKEv2 AnyConnect
B) Clientless
C) Port forwarding
D) SSL AnyConnect

Question 56

Which technology works with IPsec stateful failover?

A) GLBP
B) HSRP
C) GRE
D) VRRP

Question 57

Refer to the exhibit. Client 1 cannot communicate with client 2. Both clients are using Cisco AnyConnect and have established a successful SSL VPN connection to the hub ASA. Which command on the ASA is missing?

A) dns-server value 10.1.1.2
B) same-security-traffic permit intra-interface
C) same-security-traffic permit inter-interface
D) dns-server value 10.1.1.3

Question 58

What are two functions of ECDH and ECDSA? (Choose two.)

A) nonrepudiation
B) revocation
C) digital signature
D) key exchange
E) encryption

Question 59

Where is split tunneling defined for IKEv2 remote access clients on a Cisco router?

A) IKEv2 authorization policy
B) Group Policy
C) virtual template
D) webvpn context

Question 60

Refer to the exhibit. Which type of Cisco VPN is shown for group Cisc012345678?

A) Cisco AnyConnect Client VPN
B) DMVPN
C) Clientless SSLVPN
D) GETVPN

Question 61

Which technology and VPN component allows a VPN headend to dynamically learn post NAT IP addresses of remote routers at different sites?

A) DMVPN with ISAKMP
B) GETVPN with ISAKMP
C) DMVPN with NHRP
D) GETVPN with NHRP

Question 62

Refer to the exhibit. Which two conclusions should be drawn from the DMVPN phase 2 configuration? (Choose two.)

A) Next-hop-self is required.
B) EIGRP neighbor adjacency will fail.
C) EIGRP is used as the dynamic routing protocol.
D) EIGRP route redistribution is not allowed.
E) Spoke-to-spoke communication is allowed.

Question 63

Which two features are valid backup options for an IOS FlexVPN client? (Choose two.)

A) HSRP stateless failover
B) DNS-based hub resolution
C) reactivate primary peer
D) tunnel pivot
E) need distractor

Question 64

After a user configures a connection profile with a bookmark list and tests the clientless SSLVPN connection, all of the bookmarks are grayed out. What must be done to correct this behavior?

A) Apply the bookmark to the correct group policy.
B) Specify the correct port for the web server under the bookmark.
C) Configure a DNS server on the Cisco ASA and verify it has a record for the web server.
D) Verify HTTP/HTTPS connectivity between the Cisco ASA and the web server.

Question 65

Which Cisco AnyConnect component ensures that devices in a specific internal subnet are only accessible using port 443?

A) routing
B) WebACL
C) split tunnel
D) VPN filter

Question 66

Which two types of SSO functionality are available on the Cisco ASA without any external SSO servers? (Choose two.)

A) SAML
B) NTLM
C) Kerberos
D) OAuth 2.0
E) HTTP Basic

Question 67

While troubleshooting, an engineer finds that the show crypto isakmp sa command indicates that the last state of the tunnel is MM_KEY_EXCH. What is the next step that should be taken to resolve this issue?

A) Verify that the ISAKMP proposals match.
B) Ensure that UDP 500 is not being blocked between the devices.
C) Correct the peer's IP address on the crypto map.
D) Confirm that the pre-shared keys match on both devices.

Question 68

A network engineer must implement an SSLVPN Cisco AnyConnect solution that supports 500 concurrent users, ensures all traffic from the client passes through the ASA, and allows users to access all devices on the inside interface subnet (192.168.0.0/24). Assuming all other configuration is set up appropriately, which configuration implements this solution?

A)
B)
C)
D)

Question 69

Refer to the exhibit. Which type of VPN is used?

A) GETVPN
B) clientless SSL VPN
C) Cisco Easy VPN
D) Cisco AnyConnect SSL VPN

Question 70

Refer to the exhibit. The VPN tunnel between the FlexVPN spoke and FlexVPN hub 192.168.0.12 is failing. What should be done to correct this issue?

A) Add the address 192.168.0.12 255.255.255.255 command to the keyring configuration. Add the address 192.168.0.12 255.255.255.255 command to the keyring configuration.
B) Add the match fvrf any command to the IKEv2 policy. match fvrf any command to the IKEv2 policy.
C) Add the aaa authorization group psk list Flex_AAA Flex_Auth command to the IKEv2 profile configuration. aaa authorization group psk list Flex_AAA Flex_Auth command to the IKEv2 profile configuration.
D) Add the tunnel mode gre ip command to the tunnel configuration. tunnel mode gre ip command to the tunnel configuration.

Question 71

An engineer notices that while an employee is connected remotely, all traffic is being routed to the corporate network. Which split-tunnel policy allows a remote client to use their local provider for Internet access when working from home?

A) tunnelall
B) excludeall
C) tunnelspecified
D) excludespecified

Question 72

Refer to the exhibit. A network engineer is configuring a remote access SSLVPN and is unable to complete the connection using local credentials. What must be done to remediate this problem?

A) Enable the client protocol in the Cisco AnyConnect profile.
B) Configure a AAA server group to authenticate the client.
C) Change the authentication method to local.
D) Configure the group policy to force local authentication.

Question 73

A network engineer must design a clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was found that one website is not being rewritten correctly by the ASA. What is a potential solution for this issue while still allowing it to be a clientless VPN setup?

A) Set up a smart tunnel with the IP address of the web server.
B) Set up a NAT rule that translates the ASA public address to the web server private address on port 80.
C) Set up Cisco AnyConnect with a split tunnel that has the IP address of the web server.
D) Set up a WebACL to permit the IP address of the web server.

Question 74

Refer to the exhibit. Which type of VPN implementation is displayed?

A) IKEv1 cluster
B) IKEv2 backup gateway
C) IKEv2 load balancer
D) IKEv2 reconnect

Question 75

Refer to the exhibit. An IKEv2 site-to-site tunnel between an ASA and a remote peer is not building successfully. What will fix the problem based on the debug output?

A) Ensure crypto IPsec policy matches on both VPN devices.
B) Install the correct certificate to validate the peer.
C) Correct crypto access list on both VPN devices.
D) Specify the peer IP address in the tunnel group name.