パスできる300-730試験最速合格保証2023問題集！
300-730問題集完全版問題で試験学習ガイド
シスコ300-730認定試験でカバーされるトピックは、IPsec、SSL、DMVPN、FlexVPN、およびAnyConnectなどのさまざまなVPN技術、PKI、デジタル証明書、および暗号化などの安全な通信技術、アクセス制御およびセキュリティポリシーも試験範囲に含まれます。
シスコ300-730認定試験は、仮想プライベートネットワーク（VPN）を使用した安全なソリューションを実装するITプロフェッショナルの知識とスキルをテストするように設計されています。この試験は、システムエンジニア、ネットワーク管理者、セキュリティプロフェッショナルを含む、企業レベルのネットワークでVPNを使用したいと考えている個人向けに提供されています。
質問 # 88
Refer to the exhibit.
The network administrator must allow the Cisco AnyConnect Secure Mobility Client to securely access the corporate resources via IKEv2 and print locally. Traffic that is destined for the Internet must still be tunneled to the Cisco ASA. Which configuration does the administrator use to accomplish this goal?
- A. Tunnel all policy.
- B. Split include policy with a permit for 192.168.0.0/24.
- C. Split exclude policy with a permit for 0.0.0.0/32.
- D. Split exclude policy with a deny for 192.168.0.3/32.
正解：C
解説：
https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/70847-local-lan-pix-asa.html
質問 # 89
Refer to the exhibit.
Which type of VPN is used?
- A. Cisco AnyConnect SSL VPN
- B. GETVPN
- C. clientless SSL VPN
- D. Cisco Easy VPN
正解：D
解説：
https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/vpn/asa-97-vpn-config/vpn-easyvpn.html
質問 # 90
An engineer must configure remote desktop connectivity for offsite admins via clientless SSL VPN, configured on a Cisco ASA to Windows Vista workstations. Which two configurations provide the requested access? (Choose two.)
- A. RDP2 bookmark via the RDP2 plugin
- B. SSH bookmark via the SSH plugin
- C. Telnet bookmark via the Telnet plugin
- D. VNC bookmark via the VNC plugin
- E. Citrix bookmark via the ICA plugin
正解：A、D
解説：
https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/configuration/vpn/asa-98-vpn-config/webvpn-configure-gateway.html
質問 # 91
Which two changes must be made in order to migrate from DMVPN Phase 2 to Phase 3 when EIGRP is configured? (Choose two.)
- A. Add NHRP shortcuts on the hub.
- B. Add NHRP redirects on the spoke.
- C. Add NHRP redirects on the hub.
- D. Enable EIGRP next-hop-self on the hub.
- E. Disable EIGRP next-hop-self on the hub.
正解：C、E
質問 # 92
While troubleshooting, an engineer finds that the show crypto isakmp sa command indicates that the last state of the tunnel is MM_KEY_EXCH. What is the next step that should be taken to resolve this issue?
- A. Verify that the ISAKMP proposals match.
- B. Correct the peer's IP address on the crypto map.
- C. Ensure that UDP 500 is not being blocked between the devices.
- D. Confirm that the pre-shared keys match on both devices.
正解：B
質問 # 93
Refer to the exhibit.
- A. Trust the issuing CA for the ASA identity certificate on the user's PC.
- B. Enroll and import an SSL certificate with the CN value example.cisco.com on the ASA.
- C. Add the CN example.cisco.com to the AnyConnect XML certificate matching section.
- D. Add example.cisco.com to the server name list within the AnyConnect Local Policy.
- E. Enable certificate authentication under the connection profile.
正解：A、B
質問 # 94
A network engineer must design a clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was found that one website is not being rewritten correctly by the ASA.
What is a potential solution for this issue while still allowing it to be a clientless VPN setup?
- A. Set up Cisco AnyConnect with a split tunnel that has the IP address of the web server.
- B. Set up a NAT rule that translates the ASA public address to the web server private address on port 80.
- C. Set up a smart tunnel with the IP address of the web server.
- D. Set up a WebACL to permit the IP address of the web server.
正解：B
質問 # 95
Refer to the exhibit.
Cisco AnyConnect must be set up on a router to allow users to access internal servers 192.168.0.10 and 192.168.0.11. All other traffic should go out of the client's local NIC. Which command accomplishes this configuration?
- A. svc split exclude 192.168.0.0 255.255.255.0
- B. svc split include 192.168.0.0 255.255.255.0
- C. svc split exclude acl CCNP
- D. svc split include acl CCNP
正解：D
解説：
https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200533-AnyConnect-Configure-Basic-SSLVPN-for-I.html
質問 # 96 
Refer to the exhibit. Which type of mismatch is causing the problem with the IPsec VPN tunnel?
- A. preshared key
- B. crypto access list
- C. Phase 1 policy
- D. transform set
正解：A
解説：
Section: Troubleshooting using ASDM and CLI
Explanation/Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409- ipsec-debug-00.html#ike
質問 # 97
A Cisco AnyConnect client establishes a SSL VPN connection with an ASA at the corporate office. An engineer must ensure that the client computer meets the enterprise security policy. Which feature can update the client to meet an enterprise security policy?
- A. Advanced Endpoint Assessment
- B. Cisco Secure Desktop
- C. Endpoint Assessment
- D. Basic Host Scan
正解：A
質問 # 98
Refer to the exhibit.
The customer can establish a Cisco AnyConnect connection without using an XML profile. When the host "ikev2" is selected in the AnyConnect drop down, the connection fails. What is the cause of this issue?
- A. Primary protocol should be SSL.
- B. The IP address is incorrect.
- C. The HostName is incorrect.
- D. UserGroup must match connection profile.
正解：D
質問 # 99
Refer to the exhibit.
All internal clients behind the ASA are port address translated to the public outside interface that has an IP address of 3.3.3.3. Client 1 and client 2 have established successful SSL VPN connections to the ASA.
What must be implemented so that "3.3.3.3" is returned from a browser search on the IP address?
- A. Exclude Network List Below under Group Policy
- B. Tunnel Network List Below under Group Policy
- C. Tunnel All Networks under Group Policy
- D. Same-security-traffic permit inter-interface under Group Policy
正解：B
解説：
To ensure that "3.3.3.3" is returned from a browser search on the IP address, you must configure the ASA with the Tunnel Network List Below option under the Group Policy. This allows all internal clients behind the ASA to be port address translated to the public outside interface with the IP address of 3.3.3.3. This will ensure that the correct IP address is returned from a browser search.
質問 # 100
Refer to the exhibit.
The IKEv2 site-to-site VPN tunnel between two routers is down. Based on the debug output, which type of mismatch is the problem?
- A. ikev2 proposal
- B. peer identity
- C. preshared key
- D. transform set
正解：B
質問 # 101
In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form. Which troubleshooting step solves the issue?
- A. Verify the spoke configuration to check if the NHRP redirect is enabled.
- B. Verify that the spoke receives redirect messages and sends resolution requests.
- C. Verify that the tunnel interface is contained within a VRF.
- D. Verify the hub configuration to check if the NHRP shortcut is enabled.
正解：B
解説：
Reference:
On receiving the redirect, Spoke1 initiates a resolution request for Host2 over the point-to-point tunnel interface (the same interface over which it received the redirect). The resolution request traverses the routed path (Spoke1-hub-spoke2). On receiving the resolution request, Spoke2 determines that it is the exit point and needs to respond to the resolution request. https://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-2mt/sec-flex-spoke.html
質問 # 102
Which command is used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?
- A. show crypto ikev2 sa
- B. show crypto isakmp sa
- C. show crypto identity
- D. show crypto gkm
正解：A
質問 # 103
Which two commands help determine why the NHRP registration process is not being completed even after the IPsec tunnel is up? (Choose two.)
- A. show crypto ipsec sa
- B. show ip nhrp traffic
- C. show dmvpn detail
- D. show ip traffic
- E. show crypto isakmp sa
正解：B、E
解説：
https://www.cisco.com/c/en/us/support/docs/security/dynamic-multipoint-vpn-dmvpn/111976-dmvpn-troubleshoot-00.html
質問 # 104
Refer to the exhibit.
The customer must launch Cisco AnyConnect in the RDP machine. Which IOS configuration accomplishes this task?
- A. Option B
- B. Option A
- C. Option C
- D. Option D
正解：C
解説：
Reference:
https://community.cisco.com/t5/vpn/starting-anyconnect-vpn-through-rdp-session-on-cisco-891/td- p/2128284
質問 # 105
Refer to the exhibit.
Client 1 cannot communicate with client 2. Both clients are using Cisco AnyConnect and have established a successful SSL VPN connection to the hub ASA.
Which command on the ASA is missing?
- A. same-security-traffic permit intra-interface
- B. dns-server value 10.1.1.3
- C. dns-server value 10.1.1.2
- D. same-security-traffic permit inter-interface
正解：A
質問 # 106
Which requirement is needed to use local authentication for Cisco AnyConnect Secure Mobility Clients that connect to a FlexVPN server?
- A. EAP query-identity
- B. EAP-AnyConnect
- C. AnyConnect profile
- D. use of certificates instead of username and password
正解：C
解説：
Reference:
https://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2- Remote-Access.html
質問 # 107
A DMVPN spoke is configured with IKEv1 to secure the tunnel. Despite having a configuration similar to other working spokes, the tunnel is not coming up. Packet captures on the spoke show packets leaving the spoke router, but not making it to the hub router. Which solution resolves this issue?
- A. Configure the spoke and hub to use the same IKE version.
- B. Ensure that devices between the hub and spoke are not blocking ESP traffic.
- C. Ensure that devices between the hub and spoke are not blocking GRE traffic.
- D. Enable the tunnel interface with the no shutdown command.
正解：B
質問 # 108
An engineer is using DMVPN to provide secure connectivity between a data center and remote sites. Which two routing protocols should be used between the routers? (Choose two.)
- A. OSPF
- B. BGP
- C. EIGRP
- D. IS-IS
- E. RIPv2
正解：B、C
質問 # 109
......
シスコ300-730認定試験は、ネットワークセキュリティと仮想プライベートネットワーク（VPN）に特化したITプロフェッショナルを対象に設計されています。この試験は、Ciscoの技術を使用してVPNを使用した安全なソリューションを実装する候補者の知識とスキルを測定します。試験は、安全な通信、アクセス制御、セキュリティポリシーなど、様々なトピックをカバーしています。
CCNP Security無料認定試験資料は177問：https://jp.fast2test.com/300-730-premium-file.html
リアルな300-730は100%カバーリアル試験問題を試そう：https://drive.google.com/open?id=18_bzoqBYIMyzdnElLtA8hUcmkr8z-XFT