Cisco 300-209 Implementing Cisco Secure Mobility Solutions Online Training

1. Where must an engineer configure a preshared key for site-to-site VPN tunnel configured on a Cisco ASA?

2. You need to configure your company’s client VPN access to send antivirus client update traffic directly to a vendor’s cloud server. All other traffic must go to the corporate network.

Which feature do you configure?

3. Refer to the exhibit.

Which result of running the command is true?

4. Which two features are available in the Plus license for Cisco AnyConnect? (Choose two.)

5. Which VPN technology preserves IP headers and prevents overlay routing?

6. Which cryptographic method provides passphrase protection while importing or exporting keys?

7. Refer to the exhibit.

You are implementing DMVPN Phase 3 in an existing network that uses DMVPN Phase1. You configure NHRP, but the creation of the spoke-to-spoke tunnel fails.

Which action do you take to resolve the issue?

8. What is a functional difference between IKEv1 and IKEv2 on a router?

9. Which two descriptions of the characteristics of Cisco GET VPN are true? (Choose two.)

10. Refer to the exhibit.

You are implementing an IKEv1 IPsec tunnel between two Internet routers by using PSKs. After the configuration is complete, the IPsec VPN tunnel fails to negotiate.

What must be configured to resolve the issue?

11. Refer to the exhibit.

You implement a DMVPN Phase 3 full-mesh design. Spoke-to-spoke tunnels fail to establish successfully via the hub.

Which action do you take in the hub configuration to resolve the issue?

12. Refer to the exhibit.

You are implementing an IKEv2 IPsec tunnel between two Internet routers by using PSKs. After the configuration is complete, the IPsec VPN tunnel fails to negotiate. You enable debugging to troubleshoot the issue.Which action do you take to resolve the issue?

13. You must implement DMVPN Phase 3 by using EIGRP as the dynamic routing protocol for the tunnel overlay.

Which action do you take to allow EIGRP to advertise all routes between the hub and all the spokes?

14. When a Cisco ASA is configured for Active/Standby failover, what is replicated between the devices?

15. Refer to the exhibit.

Which VPN technology produces this configuration output?

16. When configuring a FlexVPN, which two components must be configured for IKEv2? (Choose two.)

17. Refer to the exhibit.

You configure Clientless SSL VPN on a Cisco ASA. Users from Company A cannot connect to the Clientless SSL VPN.

Which possible cause of the connection failure is most likely?

18. Refer to the exhibit.

You are configuring FlexVPN on a router. The tunnel fails to come up.

Which type of mismatch is the root cause of the failure?

19. When using Clientless SSL VPN on a Cisco ASA, which authentication method is required for single sign-on?

20. Which VPN solution enables you to publish applications to users by using bookmarks?

21. DRAG DROP

Drag and drop the descriptions from the left onto the correct IPsec tunnel types on the right.

22. Which command displays the NBMA IP addresses when DMVPN is configured with tunnel protection?

23. Refer to the exhibit.

You have a Clientless SSL VPN service on a Cisco ASA.

Which situation prevents the user from connecting?

24. Your company network security policy requires that all network traffic be tunneled to the corporate office. End users must be able to access local LAN resources when they connect to the corporate network.

Which two configurations do you implement in Cisco AnyConnect? (Choose two.)

25. Which two methods customize the installation of the Cisco AnyConnect client? (Choose two.)

26. DRAG DROP

Drag and drop the cryptographic algorithms for IPsec from the left onto the correct cryptographic processes on the right.

27. Which method dynamically advertises the network routes for remote tunnel endpoints?

28. Which benefit of ECC as compared to RSA is true?

29. Which description of how DTLS improves application performance is true?

30. Refer to the exhibit.

Which type of VPN is used in the configuration?

31. You are configuring a Cisco ASA for Clientless SSL VPN.

Which command do you run to prevent web browsing from the Cisco SSL VPN portal page?

32. Which encryption algorithm does Cisco recommend that you avoid?

33. What are two benefits of using DTLS when implementing a Cisco AnyConnect SSI VPN on a Cisco ASA or router? (Choose two.)

34. An engineer is troubleshooting an IPsec site-to-site tunnel and verifies that the tunnel status is MM_WAIT_MSG6.

What can be determined from this message?

35. Which cryptographic algorithm is used for data integrity?

36. An engineer is configuring a site-t-site VPM tunnel.

Which two IKV1 parameter must match on both peers? (Choose two.

37. A network engineer is troubleshooting a VPN configured on an ASA and has found Phase 1 is not completing.

Which configured parameter must match for the IKE Phase 1 tunnel to get successfully negotiated/

38. An engineer must set up a site-to-site VPN implementation with an any-to-any topology that provides secures routing across the router backbone.

Which VPN technology allows a shared IPsec SA to be used?

39. An engineer must configure HET VPN transverse over the network between corporate offices.

Which two options are key advantages to choosing GET VPN EssaVPN? (Choose two.)

40. What does DAK l stand for?

41. When you confrere an access list on the external interface of a FlexVPN hub. which step is optional?

42. Within a PKI system, which option is a trusted entity?

43. What are two features of Cisco GET VPN? (Choose two.)

44. A company's remote locations connect to data centers via MPLS.

A new request requires that unicast traffic that exist the remote location be encrypted.

Which no tunneled technology can be used to satisfy this requirement?

45. Why must a network engineer avoid usage of the default X509 certificate when implementing clientless SSLVPN on an ASA?

46. A customer requires site-to-site VPNs to connect third-party business partners and has purchased two ASAs. The customer requests an active/active configuration.

Which model is needed to support an active/active solution?

47. From the CLI of a Cisco ASA 5520, which command shows specific information about current clientless and Cisco Anyconnect SSL VPN users only?

48. Which option is one of the difference between FlexVPN and DMVPN?

49. Which two attributes can be matched from the identity of the remote peer when using IKEv2 Name Manager? (Choose two.)

50. Which command will allow a referenced ASA interface to become accessible across a site-to-site VPN?

51. An engineer is configuring SSL VPN to provide access to a corporate network for remote users.

Traffic destined to the enterprise IP range should go over the tunnel and all other traffic should go directly to the internet.

Which feature should be configured?

52. Which option is the main difference between GET VPN and DMVPN?

53. An engineer is configuring IPsec VPN and wants to choose an authentication protocol that is reliable supports ACK and sequence.

Which protocol accomplishes this goal?

54. While attempting to establish a site-to-site VPN, the engineer notices that phase 1 of the VPN tunnel fails. The engineer wants to run a capture to confirm that the outside interface is receiving phase 1information from the thirdparty peer address.

Which command must be run on the ASA to verify this information?

55. An engineer notices that while an employee is connected remotely, all traffic is being routed to the corporate network.

Which split-tunnel policy allows remote client to use their local provider for Internet access when working from home?

56. Mobile work force client are using Cisco Encryption for AnyConnect for remote access to the corporate network. In a attempt to save bandwidth on the internet circuit, those working remotely are permitted use to their local connectivity for internet use white still connect to the corporate network.

Which feature allows distinct destination to be encryption on the remote client?

57. What is the name of the transform set being used on the ISR?

58. Which two components are required a Cisco IOS-based PKI solution?

59. An engineer is configuring high availability for crypto-map-based site-to-site VPNs on Cisco devices.

Which protocol must be used?

60. A customer has two ASAs configured in high availability and is experiencing connection drops that require re-establishment each time failover occurs.

Which type of failover has been implemented?

61. In a new DMVPN deployment, phase 1 completes successfully.

However, phase2 experiences issues.

Which troubleshooting step is valid in this situation?

62. An engineer is configuring clientless SSL VPN. The finance department has a database server that only they should access, but the sales department can currently access it. The finance and the sales departments are configured as separate group-policies.

Which option must be added to the configuration to make sure the users in the sales department cannot access the finance department server?

63. Refer to the Exhibit:

Which result of this command is true?

64. Refer to the Exhibit:

Users at each end of this VPN tunnel cannot communicate with each other.

Which cause of this behavior is true?

65. An engineer is defining ECC variables and has set the input_mode set to B.

Which statement is true?

66. Refer to the Exhibit:

An engineer must implement DMVPN phase 2 and two conclusions can be made from the configuration? (Choose two.)

67. An engineer wants to ensure that Diffie-Helman keys are re-generated upon a pahse-2 rekey.

What option can be configured to allow this?

68. Which two options are features of Cisco GET VPN? (Choose two.)

69. Refer to the exhibit:

Which statement about this output is true?

70. Refer to the Exhibit:

A network security engineer is troubleshooting intermittent connectivity issues across a tunnel. Based on the output from the show crypto ipsec sa command, which cause is most likely?