Question 1

Which technology and VPN component allows a VPN headend to dynamically learn post NAT IP addresses of remote routers at different sites?
A) DMVPN with ISAKMP
B) GETVPN with ISAKMP
C) DMVPN with NHRP
D) GETVPN with NHRP

Accepted Answer

DMVPN with NHRP allows a VPN headend to dynamically learn post NAT IP addresses of remote routers at different sites. NHRP (Next Hop Resolution Protocol) is used in DMVPN to resolve the IP addresses of the next hop in a dynamic multipoint VPN setup.

Question 2

Refer to the exhibit. Which two conclusions should be drawn from the DMVPN phase 2 configuration? (Choose two.)
A) Next-hop-self is required.
B) EIGRP neighbor adjacency will fail.
C) EIGRP is used as the dynamic routing protocol.
D) EIGRP route redistribution is not allowed.
E) Spoke-to-spoke communication is allowed.

Accepted Answer

The answer of  Refer to the exhibit. Which two...

Question 3

Which two features are valid backup options for an IOS FlexVPN client? (Choose two.)
A) HSRP stateless failover
B) DNS-based hub resolution
C) reactivate primary peer
D) tunnel pivot
E) need distractor

Accepted Answer

The answer of Which two features are valid backup options...

Question 4

After a user configures a connection profile with a bookmark list and tests the clientless SSLVPN connection, all of the bookmarks are grayed out. What must be done to correct this behavior?
A) Apply the bookmark to the correct group policy.
B) Specify the correct port for the web server under the bookmark.
C) Configure a DNS server on the Cisco ASA and verify it has a record for the web server.
D) Verify HTTP/HTTPS connectivity between the Cisco ASA and the web server.

Accepted Answer

The answer of After a user configures a connection profile...

Question 5

Which Cisco AnyConnect component ensures that devices in a specific internal subnet are only accessible using port 443?
A) routing
B) WebACL
C) split tunnel
D) VPN filter

Accepted Answer

The answer of Which Cisco AnyConnect component ensures that devices...

Question 6

Which two types of SSO functionality are available on the Cisco ASA without any external SSO servers? (Choose two.)
A) SAML
B) NTLM
C) Kerberos
D) OAuth 2.0
E) HTTP Basic

Accepted Answer

The Cisco ASA supports NTLM and HTTP Basic SSO functionalities natively without requiring external SSO servers.

Question 7

While troubleshooting, an engineer finds that the show crypto isakmp sa command indicates that the last state of the tunnel is MM_KEY_EXCH. What is the next step that should be taken to resolve this issue?
A) Verify that the ISAKMP proposals match.
B) Ensure that UDP 500 is not being blocked between the devices.
C) Correct the peer's IP address on the crypto map.
D) Confirm that the pre-shared keys match on both devices.

Accepted Answer

The answer of While troubleshooting, an engineer finds that the...

Question 8

A network engineer must implement an SSLVPN Cisco AnyConnect solution that supports 500 concurrent users, ensures all traffic from the client passes through the ASA, and allows users to access all devices on the inside interface subnet (192.168.0.0/24). Assuming all other configuration is set up appropriately, which configuration implements this solution?
A) 
B) 
C) 
D)

Accepted Answer

The answer of A network engineer must implement an SSLVPN...

Question 9

Refer to the exhibit. Which type of VPN is used?
A) GETVPN
B) clientless SSL VPN
C) Cisco Easy VPN
D) Cisco AnyConnect SSL VPN

Accepted Answer

The answer of  Refer to the exhibit. Which type...

Question 10

Refer to the exhibit. The VPN tunnel between the FlexVPN spoke and FlexVPN hub 192.168.0.12 is failing. What should be done to correct this issue?
A) Add the address 192.168.0.12 255.255.255.255 command to the keyring configuration. Add the address 192.168.0.12 255.255.255.255 command to the keyring configuration.
B) Add the match fvrf any command to the IKEv2 policy. match fvrf any command to the IKEv2 policy.
C) Add the aaa authorization group psk list Flex_AAA Flex_Auth command to the IKEv2 profile configuration. aaa authorization group psk list Flex_AAA Flex_Auth command to the IKEv2 profile configuration.
D) Add the tunnel mode gre ip command to the tunnel configuration. tunnel mode gre ip command to the tunnel configuration.

Accepted Answer

The answer of  Refer to the exhibit. The VPN...

Question 11

An engineer notices that while an employee is connected remotely, all traffic is being routed to the corporate network. Which split-tunnel policy allows a remote client to use their local provider for Internet access when working from home?
A) tunnelall
B) excludeall
C) tunnelspecified
D) excludespecified

Accepted Answer

The answer of An engineer notices that while an employee...

Question 12

Refer to the exhibit. A network engineer is configuring a remote access SSLVPN and is unable to complete the connection using local credentials. What must be done to remediate this problem?
A) Enable the client protocol in the Cisco AnyConnect profile.
B) Configure a AAA server group to authenticate the client.
C) Change the authentication method to local.
D) Configure the group policy to force local authentication.

Accepted Answer

The answer of  Refer to the exhibit. A network...

Question 13

A network engineer must design a clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was found that one website is not being rewritten correctly by the ASA. What is a potential solution for this issue while still allowing it to be a clientless VPN setup?
A) Set up a smart tunnel with the IP address of the web server.
B) Set up a NAT rule that translates the ASA public address to the web server private address on port 80.
C) Set up Cisco AnyConnect with a split tunnel that has the IP address of the web server.
D) Set up a WebACL to permit the IP address of the web server.

Accepted Answer

A smart tunnel can be used to provide access to specific applications that are not correctly rewritten by the ASA in a clientless VPN setup.

Question 14

Refer to the exhibit. Which type of VPN implementation is displayed?
A) IKEv1 cluster
B) IKEv2 backup gateway
C) IKEv2 load balancer
D) IKEv2 reconnect

Accepted Answer

The answer of  Refer to the exhibit. Which type...

Question 15

Refer to the exhibit. An IKEv2 site-to-site tunnel between an ASA and a remote peer is not building successfully. What will fix the problem based on the debug output?
A) Ensure crypto IPsec policy matches on both VPN devices.
B) Install the correct certificate to validate the peer.
C) Correct crypto access list on both VPN devices.
D) Specify the peer IP address in the tunnel group name.

Accepted Answer

The answer of  Refer to the exhibit. An IKEv2...

Exam 27: Automating Cisco Security Solutions (SAUTO)

Which technology and VPN component allows a VPN headend to dynamically learn post NAT IP addresses of remote routers at different sites?

Refer to the exhibit. Which two conclusions should be drawn from the DMVPN phase 2 configuration? (Choose two.)

Which two features are valid backup options for an IOS FlexVPN client? (Choose two.)

After a user configures a connection profile with a bookmark list and tests the clientless SSLVPN connection, all of the bookmarks are grayed out. What must be done to correct this behavior?

Which Cisco AnyConnect component ensures that devices in a specific internal subnet are only accessible using port 443?

Which two types of SSO functionality are available on the Cisco ASA without any external SSO servers? (Choose two.)

While troubleshooting, an engineer finds that the show crypto isakmp sa command indicates that the last state of the tunnel is MM_KEY_EXCH. What is the next step that should be taken to resolve this issue?

Refer to the exhibit. Which type of VPN is used?

Refer to the exhibit. The VPN tunnel between the FlexVPN spoke and FlexVPN hub 192.168.0.12 is failing. What should be done to correct this issue?

An engineer notices that while an employee is connected remotely, all traffic is being routed to the corporate network. Which split-tunnel policy allows a remote client to use their local provider for Internet access when working from home?

Refer to the exhibit. A network engineer is configuring a remote access SSLVPN and is unable to complete the connection using local credentials. What must be done to remediate this problem?

Refer to the exhibit. Which type of VPN implementation is displayed?

Refer to the exhibit. An IKEv2 site-to-site tunnel between an ASA and a remote peer is not building successfully. What will fix the problem based on the debug output?