Cisco 300-209 Implementing Cisco Secure Mobility Solutions Online Training

Exam4Training have all the questions that you need to help you study for the Cisco 300-209. They will give you the all the required material too so that you won’t have to struggle to get what you need. The Cisco 300-209 Implementing Cisco Secure Mobility Solutions Online Training contain the exam material and content gathered by Cisco professional experts.The updated and proficient CCNP Security 300-209 exam content ensures your success in 300-209 Implementing Cisco Secure Mobility Solutions Exam in the first attempt.

Page 1 of 7

1. Where must an engineer configure a preshared key for site-to-site VPN tunnel configured on a Cisco ASA?

crypto map

group policy

tunnel group

isakmp policy

2. You need to configure your company’s client VPN access to send antivirus client update traffic directly to a vendor’s cloud server. All other traffic must go to the corporate network.

Which feature do you configure?

split tunnel

smart tunnel

full tunnel

Split DNS

3. Refer to the exhibit.

Which result of running the command is true?

authenticates the IKEv2 peers in the 172.16.0.0/16 range by using the cisco123 key

secures all the certificates in the IKE exchange by using the cisco123 key

authenticates the IKEv1 peers in the 172.16.0.0/16 range by using the cisco123 key

authenticates the IP address of the 172.16.0.0/32 peer by using the cisco123 key

4. Which two features are available in the Plus license for Cisco AnyConnect? (Choose two.)

Suite B cryptography

IPsec IKEv2

Clientless SSL VPN

Network Access Manager

posture services

5. Which VPN technology preserves IP headers and prevents overlay routing?

site-to-site VPN

GET VPN

Cisco Easy VPN

DMVPN

6. Which cryptographic method provides passphrase protection while importing or exporting keys?

AES

RSA

Serpent

Blowfish

7. Refer to the exhibit.

You are implementing DMVPN Phase 3 in an existing network that uses DMVPN Phase1. You configure NHRP, but the creation of the spoke-to-spoke tunnel fails.

Which action do you take to resolve the issue?

Remove the multicast flag from the NHRP configuration.

Configure the tunnel of the hub by using point-to-point tunnel mode.

Configure the tunnel of the spoke by using mGRE tunnel mode.

Remove NHRP redirects from the hub configuration.

8. What is a functional difference between IKEv1 and IKEv2 on a router?

HSRP

RRI

DPD

Stateful Failover

9. Which two descriptions of the characteristics of Cisco GET VPN are true? (Choose two.)

provides a tunnelless transport mechanism

encrypts the data payload and IP header of a packet

requires that GRE tunnels exist between participating routers

uses a common set of traffic encryption keys shared by group members

uses VTIs to establish IPsec tunnels

10. Refer to the exhibit.

You are implementing an IKEv1 IPsec tunnel between two Internet routers by using PSKs. After the configuration is complete, the IPsec VPN tunnel fails to negotiate.

What must be configured to resolve the issue?

matching PSKs on both routers

matching ISAKMP policies on both routers

correct tunnel destinations on both routers

ISAKMP identity for both routers

Page 2 of 7

11. Refer to the exhibit.

You implement a DMVPN Phase 3 full-mesh design. Spoke-to-spoke tunnels fail to establish successfully via the hub.

Which action do you take in the hub configuration to resolve the issue?

Configure the hub to set itself as the next hop in the routing updates to the spokes.

Configure the hub tunnel as a point-to-point GRE tunnel interface.

Enable split horizon for EIGRP

Configure a loopback interface as the source of the tunnel interface

12. Refer to the exhibit.

You are implementing an IKEv2 IPsec tunnel between two Internet routers by using PSKs. After the configuration is complete, the IPsec VPN tunnel fails to negotiate. You enable debugging to troubleshoot the issue.Which action do you take to resolve the issue?

Verify the IKEv2 keyring address and PSK configuration on both routers.

Configure an IKEv2 authorization policy to authorize the peer router.

Configure the IKEv2 identity of each router by using an email address.

Modify the Diffie-Hellman key used in the IKEv2 policy.

13. You must implement DMVPN Phase 3 by using EIGRP as the dynamic routing protocol for the tunnel overlay.

Which action do you take to allow EIGRP to advertise all routes between the hub and all the spokes?

Summarize routes from the hub to the spokes.

Disable split-horizon for EIGRP on the hub.

Configure the hub to set itself as the next hop when advertising networks to the spoke.

Add a distribute list to permit the spoke subnets and deny all other networks.

14. When a Cisco ASA is configured for Active/Standby failover, what is replicated between the devices?

HostScan images

Cisco AnyConnect profiles

VPN sessions

Cisco AnyConnect images

15. Refer to the exhibit.

Which VPN technology produces this configuration output?

DVTI

SVTI

DMVPN

FlexVPN

16. When configuring a FlexVPN, which two components must be configured for IKEv2? (Choose two.)

persistence

profile

proposal

preference

method

17. Refer to the exhibit.

You configure Clientless SSL VPN on a Cisco ASA. Users from Company A cannot connect to the Clientless SSL VPN.

Which possible cause of the connection failure is most likely?

The users have authentication issues

The users are behind the same NAT IP address

An ACL for DAP is blocking the users

The license limit is exceeded

18. Refer to the exhibit.

You are configuring FlexVPN on a router. The tunnel fails to come up.

Which type of mismatch is the root cause of the failure?

access list

peer ID

preshared key

transform proposal

19. When using Clientless SSL VPN on a Cisco ASA, which authentication method is required for single sign-on?

TACACS

LOCAL

RADIUS

SAML 2.0

20. Which VPN solution enables you to publish applications to users by using bookmarks?

IPsec client

SSL VPN full network access

Clientless SSL VPN

port forward

Page 3 of 7

21. DRAG DROP

Drag and drop the descriptions from the left onto the correct IPsec tunnel types on the right.

22. Which command displays the NBMA IP addresses when DMVPN is configured with tunnel protection?

show crypto session

show ip nhrp

show ip interface tunnel

show crypto socket

23. Refer to the exhibit.

You have a Clientless SSL VPN service on a Cisco ASA.

Which situation prevents the user from connecting?

The user has a non-Cisco VPN client

The user’s browser is incompatible

The user is behind a web proxy

The Clientless SSL VPN protocol is disabled

24. Your company network security policy requires that all network traffic be tunneled to the corporate office. End users must be able to access local LAN resources when they connect to the corporate network.

Which two configurations do you implement in Cisco AnyConnect? (Choose two.)

split-exclude tunneling

local LAN access

static routes

Client Bypass Protocol

tunnel all

25. Which two methods customize the installation of the Cisco AnyConnect client? (Choose two.)

installation profiles

command-line parameters

client profiles

resource profiles

installer transforms

26. DRAG DROP

Drag and drop the cryptographic algorithms for IPsec from the left onto the correct cryptographic processes on the right.

27. Which method dynamically advertises the network routes for remote tunnel endpoints?

dynamic routing

RRI

policy-based routing

CEF

28. Which benefit of ECC as compared to RSA is true?

requires multiple keys

supports Clientless SSL VPN

can provide higher security at a lower computational cost

can be used on Cisco ASA and Cisco IOS device

29. Which description of how DTLS improves application performance is true?

uses connection-oriented sessions

creates less overhead by using UDP

avoids bandwidth and latency issues

uses a flow control mechanism

30. Refer to the exhibit.

Which type of VPN is used in the configuration?

DMVPN

FlexVPN

SSL VPN

Cisco GET VPN

Page 4 of 7

31. You are configuring a Cisco ASA for Clientless SSL VPN.

Which command do you run to prevent web browsing from the Cisco SSL VPN portal page?

url-list disable

http server disable

http-proxy 0.0.0.0

url-entry disable

32. Which encryption algorithm does Cisco recommend that you avoid?

HMAC-SHA1

AES-CBC

DES

HMAC-MD5

33. What are two benefits of using DTLS when implementing a Cisco AnyConnect SSI VPN on a Cisco ASA or router? (Choose two.)

provides latency avoidance

has enhanced dead peer detection

uses TLS Only for the tunnel

provides greater security and integrity of the tunnel

establishes two simultaneous tunnels

34. An engineer is troubleshooting an IPsec site-to-site tunnel and verifies that the tunnel status is MM_WAIT_MSG6.

What can be determined from this message?

The PSK has not been confirmed by the responder.

The encryption policy has not been confirmed by the initiator.

The encryption policy has not been confirmed by the responder.

The PSk has not been confirmed by the initiator

35. Which cryptographic algorithm is used for data integrity?

SHA-256

ECDH-384

ECDSA-256

RSA-3072

36. An engineer is configuring a site-t-site VPM tunnel.

Which two IKV1 parameter must match on both peers? (Choose two.

encryption algorithm

access lists

encryption domains

QoS

hashing method

37. A network engineer is troubleshooting a VPN configured on an ASA and has found Phase 1 is not completing.

Which configured parameter must match for the IKE Phase 1 tunnel to get successfully negotiated/

SA lifetime

idle timeout

transform-set

DH group

38. An engineer must set up a site-to-site VPN implementation with an any-to-any topology that provides secures routing across the router backbone.

Which VPN technology allows a shared IPsec SA to be used?

FilexVPN

IPsec VPN

GET VPN

DMVPN

39. An engineer must configure HET VPN transverse over the network between corporate offices.

Which two options are key advantages to choosing GET VPN EssaVPN? (Choose two.)

GET VPN has unique session keys for improved security.

GET VPN supports multicast.

GET VPN supports a hub and-spoke topology.

GET VPN QoS support.

GET VPN is highly scalable any to an mesh topology

40. What does DAK l stand for?

Device and Report Tool

Diagnostic AnyConnect Reporting Tool

Diagnostics and Reporting Tool

Delivery and Reporting Tool

Page 5 of 7

41. When you confrere an access list on the external interface of a FlexVPN hub. which step is optional?

allowing IP protocol 50

allowing ICMP protocol

allowing UDP port 500

allowing UDP port 4500

42. Within a PKI system, which option is a trusted entity?

registration authority

root certificate

certificate authority

RSA authentication server

43. What are two features of Cisco GET VPN? (Choose two.)

allows for optimal routing

uses public Internet

provides encryption for MP_S

provides point-to-point IPsec SA

uses MGRE

44. A company's remote locations connect to data centers via MPLS.

A new request requires that unicast traffic that exist the remote location be encrypted.

Which no tunneled technology can be used to satisfy this requirement?

SSL

GET VPN

DMVPN

EzVPN

45. Why must a network engineer avoid usage of the default X509 certificate when implementing clientless SSLVPN on an ASA?

The certificate is too weak to provide adequate security.

The certificate is regenerated at each reboot.

The certificate must be managed by the local C

The default

509 certificate is not supported for SSLVP

46. A customer requires site-to-site VPNs to connect third-party business partners and has purchased two ASAs. The customer requests an active/active configuration.

Which model is needed to support an active/active solution?

NAT context

single context

multiple context

PAT context.

47. From the CLI of a Cisco ASA 5520, which command shows specific information about current clientless and Cisco Anyconnect SSL VPN users only?

show crypto ikve1 sa detail

show vpn-sessiondb remote

show vpn-sessiondb

show von-sessiondb detail

48. Which option is one of the difference between FlexVPN and DMVPN?

flexvpn uses ikev2 and dmvpn can use ikev1 or ikev2

dmvpn can use ikev1 and ikev2 where flexvpn only uses ikev1

flexvpn can use ikev1 and ikev2 where dmvpn uses only ikev2

dmvp uses ikev1 and flexvpn use ikev3

49. Which two attributes can be matched from the identity of the remote peer when using IKEv2 Name Manager? (Choose two.)

fqdn

hostname

IP address

kerberos

50. Which command will allow a referenced ASA interface to become accessible across a site-to-site VPN?

access-list 101 extended permit ICMP any any

crypto map vpn 10 match address 101

crypto map vpn interface inside

management-access <interface name>

Page 6 of 7

51. An engineer is configuring SSL VPN to provide access to a corporate network for remote users.

Traffic destined to the enterprise IP range should go over the tunnel and all other traffic should go directly to the internet.

Which feature should be configured?

dual-horning

hairpinning

split-tunnel

U-turning

52. Which option is the main difference between GET VPN and DMVPN?

AES encryption support

dynamic spoke-to-spoke tunnel communications

Next Hop Resolution Protocol

Group Domain of Interpretation protocol

53. An engineer is configuring IPsec VPN and wants to choose an authentication protocol that is reliable supports ACK and sequence.

Which protocol accomplishes this goal?

ESP

AES-192

IKEv1

AES-256

54. While attempting to establish a site-to-site VPN, the engineer notices that phase 1 of the VPN tunnel fails. The engineer wants to run a capture to confirm that the outside interface is receiving phase 1information from the thirdparty peer address.

Which command must be run on the ASA to verify this information?

capture capin interface outride match ipsec any any

capture capin interface outride match gre any any

capture capin interface outside match ah any any

capture capin interface outside match udp any eq 500 any eq 500

capture capin interface outside match Udp any eq 123 any eq 121

55. An engineer notices that while an employee is connected remotely, all traffic is being routed to the corporate network.

Which split-tunnel policy allows remote client to use their local provider for Internet access when working from home?

No policy allows that type of configuration

tunnelspecified

excludespecified

tunnelall

56. Mobile work force client are using Cisco Encryption for AnyConnect for remote access to the corporate network. In a attempt to save bandwidth on the internet circuit, those working remotely are permitted use to their local connectivity for internet use white still connect to the corporate network.

Which feature allows distinct destination to be encryption on the remote client?

DART

Split Tuning

NAT Exempt

Kerberos

57. What is the name of the transform set being used on the ISR?

Default

ESP-AESESP-SHA-HMAC

SP-AES-256-MD5-TRANS

TSET

58. Which two components are required a Cisco IOS-based PKI solution?

preshared key

NTP

RADIUS server

certificate authority

FT/HTTP server

59. An engineer is configuring high availability for crypto-map-based site-to-site VPNs on Cisco devices.

Which protocol must be used?

VRRP

BFD

ESP

HSRP

60. A customer has two ASAs configured in high availability and is experiencing connection drops that require re-establishment each time failover occurs.

Which type of failover has been implemented?

Stateless

routed

transparent

stateful

Page 7 of 7

61. In a new DMVPN deployment, phase 1 completes successfully.

However, phase2 experiences issues.

Which troubleshooting step is valid in this situation?

Temporarily remove encryption to check if the GRE tunnel is working.

Verify IP routing between the external IPs of the two peers is correct.

Remove NHRP configuration and reset the tunnels.

Ensure that the nodes use the same authentication method.

62. An engineer is configuring clientless SSL VPN. The finance department has a database server that only they should access, but the sales department can currently access it. The finance and the sales departments are configured as separate group-policies.

Which option must be added to the configuration to make sure the users in the sales department cannot access the finance department server?

Web type ACL

Port forwarding

Tunnel group lock

VPN filter ACL

63. Refer to the Exhibit:

Which result of this command is true?

It displays the RSA public keys of the rooter

Makes the router generate a certificate signing request

It Specifies self-signed enrollment for a trust point

Generates an RSA key called TRIAL FOUR

64. Refer to the Exhibit:

Users at each end of this VPN tunnel cannot communicate with each other.

Which cause of this behavior is true?

The Diffie-Hellman groups configured are different.

The pre shared key does not match.

Phase 1 is not completed and troubleshooting is required.

The issue occurs in phase 2 of the tunnel.

65. An engineer is defining ECC variables and has set the input_mode set to B.

Which statement is true?

DTMF voice is accepted

Get Digits are written to the CED

Mixed mode input is not accepted

An ASR is not being used

66. Refer to the Exhibit:

An engineer must implement DMVPN phase 2 and two conclusions can be made from the configuration? (Choose two.)

Spoke-to-spoke communication is allowed.

Next-hop-self is required.

EIGRP neighbor adjacency will fail.

EIGRP route redistribution is not allowed

EIGRP used as the dynamic routing protocol.

67. An engineer wants to ensure that Diffie-Helman keys are re-generated upon a pahse-2 rekey.

What option can be configured to allow this?

Aggressive mode

Dead-peer detection

Main mode

Perfect-forward secrecy

68. Which two options are features of Cisco GET VPN? (Choose two.)

Allows for optimal routing

provides point to point IPsec SA

Provides encryption for MPLS

uses public Internet

uses MORE

69. Refer to the exhibit:

Which statement about this output is true?

Identity between endpoints is verified using a certificate authority

The tunnel is not functional because NAT-T is not configured.

This router has sent the first packet to establish the Flex VPN tunnel

The remote device encrypts IKEv2 packets using key “282FE"0B3B5C99A2B”.

70. Refer to the Exhibit:

A network security engineer is troubleshooting intermittent connectivity issues across a tunnel. Based on the output from the show crypto ipsec sa command, which cause is most likely?

ISAKMP and/or IP sec may be bouncing up and down.

The security association lifetimes are set to default values.

Return traffic is not coming back from the other end of the tunnel.

Traffic may flow in only one direction across this tunnel.

Latest 300-209 Dumps Valid Version with 394 Q&As

Latest And Valid Q&A | 90 Days Free Update | Once Fail, Full Refund

Get Valid 300-209 Exam

Latest 300-209 Dumps Valid Version with 394 Q&As

Leave a Reply Cancel reply