Cisco 300-730 SVPN Exam Questions Instant Access

Question 1

A network engineer has almost finished setting up a clientless VPN that allows remote users to access internal HTTP servers. Users must enter their username and password twice: once on the clientless VPN web portal and again to log in to internal HTTP servers. The Cisco ASA and the HTTP servers use the same Active Directory server to authenticate users. Which next step must be taken to allow users to enter their password only once?

AUse LDAPS and add password management to the clientless tunnel group.

BConfigure auto-sign-on using NTLM authentication.

CSet up the Cisco ASA to authenticate users via a SAML 2.0 IDP.

DCreate smart tunnels for the HTTP servers.

Answer : B

https://www.cisco.com/c/en/us/support/docs/security-vpn/webvpn-ssl-vpn/119417-config-asa-00.html#anc17

Question 2

Cisco AnyConnect clients need to transfer large files over the VPN sessions. Which protocol provides the best throughput?

ASSL/TLS

BL2TP

CDTLS

DIPsec IKEv1

Answer : C

Question 3

A user is experiencing delays on audio calls over a Cisco AnyConnect VPN. Which implementation step resolves this issue?

AChange to 3DES Encryption.

BShorten the encryption key lifetime.

CInstall the Cisco AnyConnect 2.3 client for the user to download.

DEnable DTLS.

Answer : D

Question 4

Which benefit of FlexVPN is a limitation of DMVPN using IKEv1?

AGRE encapsulation allows for forwarding of non-IP traffic.

BIKE implementation can install routes in routing table.

CNHRP authentication provides enhanced security.

DDynamic routing protocols can be configured.

Answer : B

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-mt/sec-flex-vpn-15-mt-book/sec-flex-spoke.html

Question 5

Which command identifies a Cisco AnyConnect profile that was uploaded to the flash of an IOS router?

Asvc import profile SSL_profile flash:simos-profile.xml

Banyconnect profile SSL_profile flash:simos-profile.xml

Ccrypto vpn anyconnect profile SSL_profile flash:simos-profile.xml

Dwebvpn import profile SSL_profile flash:simos-profile.xml

Answer : C

Question 6

Refer to the exhibit.

An engineer has configured a spoke to connect to a FlexVPN hub. The tunnel is up, but pings fail when the engineer attempts to reach host 192.168.200.10 behind the spoke, and traffic is sourced from host 192.168.100.3, which is behind the FlexVPN server. Based on packet captures, the engineer discovers that host 192.168.200.10 receives the icmp echo and sends an icmp reply that makes it to the inside interface of the spoke. Based on the output in the exhibit captured on the spoke by the engineer, which action resolves this issue?

AAdd the aaa authorization group cert list default default command to the spoke ikev2 profile.

BAdd the route set remote ipv4 192.168.200.0 255.255.255.0 command to the hub authorization policy.

CAdd the aaa authorization group cert list default default command to the hub ikev2 profile.

DAdd the route set remote ipv4 192.168.100.0 255.255.255.0 command to the spoke authorization policy.

Answer : D

The problem is that the spoke does not have a route to the host 192.168.100.3, which is behind the FlexVPN server. The spoke only has a default route to the tunnel interface, which points to the FlexVPN hub. Therefore, when the spoke receives the icmp reply from host 192.168.200.10, it does not know how to forward it to host 192.168.100.3.

One way to solve this problem is to add a route to the host 192.168.100.3 on the spoke using the route set remote ipv4 command in the authorization policy on the spoke. This command allows the FlexVPN server to push a route to the FlexVPN client during IKEv2 authorization. For example:

crypto ikev2 authorization policy default route set remote ipv4 192.168.100.0 255.255.255.0

This way, the spoke will have a more specific route to host 192.168.100.3 via the tunnel interface, and will be able to forward the icmp reply correctly.

Question 7

On a FlexVPN hub-and-spoke topology where spoke-to-spoke tunnels are not allowed, which command is needed for the hub to be able to terminate FlexVPN tunnels?

Ainterface virtual-access

Bip nhrp redirect

Cinterface tunnel

Dinterface virtual-template

Answer : D

On a FlexVPN hub-and-spoke topology where spoke-to-spoke tunnels are not allowed, the command that is needed for the hub to be able to terminate FlexVPN tunnels is interface virtual-template. The interface virtual-template command is used to configure a virtual template interface which provides a secure tunnel for FlexVPN connections. The other commands listed - interface virtual-access, ip nhrp redirect, and interface tunnel - are not related to FlexVPN and are not used to terminate FlexVPN tunnels.

Cisco Implementing Secure Solutions with Virtual Private Networks 300-730 SVPN Exam Questions