試験問題集で300-730練習で無料最新のCisco練習テスト [Q21-Q41]

試験問題集で300-730練習で無料最新のCisco練習テスト

300-730試験問題、リアル300-730練習問題集

質問 # 21
Which method dynamically installs the network routes for remote tunnel endpoints?

A. CEF
B. policy-based routing
C. reverse route injection
D. route filtering

正解：C

解説：
Reverse route injection (RRI) is a method that dynamically installs the network routes for remote tunnel endpoints. The RRI feature allows the router to automatically learn the routes for the remote networks and automatically install these routes into the routing table. This eliminates the need for the administrator to manually configure and maintain the routes for the remote networks. This feature is commonly used in VPN environments, where the router at the VPN endpoint needs to learn the routes for the remote networks behind the other VPN endpoint. The other options such as policy-based routing, CEF, and route filtering are not used to dynamically install the network routes for remote tunnel endpoints Reference:

質問 # 22
Refer to the exhibit.

An SSL client is connecting to an ASA headend. The session fails with the message "Connection attempt has timed out. Please verify Internet connectivity." Based on how the packet is processed, which phase is causing the failure?

A. phase 4: ACCESS-LIST
B. phase 3: UN-NAT
C. phase 9: rpf-check
D. phase 5: NAT

正解：B

質問 # 23
A user at a company HQ is having trouble accessing a network share at a branch site that is connected with a L2L IPsec VPN. While troubleshooting, a network security engineer runs a packet tracer on the Cisco ASA to simulate the user traffic and discovers that the encryption counter is increasing but the decryption counter is not. What must be configured to correct this issue?

A. Adjust the preshared key on the remote peer to allow traffic to flow over the tunnel.
B. Adjust the peer IP address on the remote peer to direct traffic back to the ASA.
C. Adjust the routing on the remote peer device to direct traffic back over the tunnel.
D. Adjust the transform set to allow bidirectional traffic.

正解：C

質問 # 24
Refer to the exhibit.

What is a result of this configuration?

A. Spoke 1 fails the authentication because the authentication methods are incorrect.
B. Spoke 2 passes the authentication to the hub and successfully proceeds to phase 2.
C. Spoke 2 fails the authentication because the remote authentication method is incorrect.
D. Spoke 1 passes the authentication to the hub and successfully proceeds to phase 2.

正解：A

質問 # 25
An engineer is troubleshooting a new DMVPN setup on a Cisco IOS router. After the show crypto isakmp sa command is issued, a response is returned of "MM_NO_STATE." Why does this failure occur?

A. Tunnel protection is not applied to the DMVPN tunnel.
B. ESP traffic is being dropped.
C. The ISAKMP policy priority values are invalid.
D. The Phase 1 policy does not match on both devices.

正解：B

質問 # 26
Which two features provide headend resiliency for Cisco AnyConnect clients? (Choose two.)

A. AnyConnect Auto Reconnect
B. AnyConnect Network Access Manager
C. ASA failover
D. AnyConnect Backup Servers
E. AnyConnect Always On

正解：C、D

質問 # 27
Cisco AnyConnect clients need to transfer large files over the VPN sessions. Which protocol provides the best throughput?

A. DTLS
B. L2TP
C. SSL/TLS
D. IPsec IKEv1

正解：A

解説：
Section: Secure Communications Architectures

質問 # 28
A user is experiencing delays on audio calls over a Cisco AnyConnect VPN. Which implementation step resolves this issue?

A. Change to 3DES Encryption.
B. Enable DTLS.
C. Install the Cisco AnyConnect 2.3 client for the user to download.
D. Shorten the encryption key lifetime.

正解：B

質問 # 29
Cisco AnyConnect clients need to transfer large files over the VPN sessions. Which protocol provides the best throughput?

A. DTLS
B. L2TP
C. SSL/TLS
D. IPsec IKEv1

正解：A

質問 # 30
Which two changes must be made in order to migrate from DMVPN Phase 2 to Phase 3 when EIGRP is configured? (Choose two.)

A. Add NHRP redirects on the hub.
B. Enable EIGRP next-hop-self on the hub.
C. Add NHRP redirects on the spoke.
D. Add NHRP shortcuts on the hub.
E. Disable EIGRP next-hop-self on the hub.

正解：A、E

質問 # 31
Where is split tunneling defined for IKEv2 remote access clients on a Cisco router?

A. IKEv2 authorization policy
B. virtual template
C. Group Policy
D. webvpn context

正解：A

解説：
https://www.cisco.com/c/en/us/support/docs/routers/3600-series-multiservice-platforms/91193-rtr-ipsec-internet-connect.html

質問 # 32
A DMVPN spoke is configured with IKEv1 to secure the tunnel. Despite having a configuration similar to other working spokes, the tunnel is not coming up. Packet captures on the spoke show packets leaving the spoke router, but not making it to the hub router. Which solution resolves this issue?

A. Ensure that devices between the hub and spoke are not blocking GRE traffic.
B. Enable the tunnel interface with the no shutdown command.
C. Ensure that devices between the hub and spoke are not blocking ESP traffic.
D. Configure the spoke and hub to use the same IKE version.

正解：C

質問 # 33
Refer to the exhibit.

Which value must be configured in the User Group field when the Cisco AnyConnect Profile is created to connect to an ASA headend with IPsec as the primary protocol?

A. address-pool
B. group-alias
C. tunnel-group
D. group-policy

正解：C

質問 # 34
When a FlexVPN is configured, which two components must be configured for IKEv2? (Choose two.)

A. profile
B. persistence
C. proposal
D. method
E. preference

正解：A、C

質問 # 35
An organization wants to distribute remote access VPN load across 12 VPN headend locations supporting 25,000 simultaneous users. Which load balancing method meets this requirement?

A. one VPN profile per site
B. DNS-based load balancing
C. equal cost, multipath load balancing
D. AnyConnect native load balancing

正解：B

質問 # 36
Refer to the exhibit.

Given the output of the show ip route command, which remote access VPN technology is in use?

A. Dynamic Crypto Map
B. DMVPN
C. FlexVPN
D. Reverse Route Injection

正解：C

解説：
https://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-2mt/sec-flex-spoke.html

質問 # 37
What are two advantages of using GETVPN to traverse over the network between corporate offices? (Choose two.)

A. It has QoS support.
B. It supports a hub-and-spoke topology.
C. It supports multicast.
D. It has unique session keys for improved security.
E. It is a highly scalable any to any mesh topology.

正解：C、E

質問 # 38
Which two statements about the Cisco ASA Clientless SSL VPN solution are true? (Choose two.)

A. Clientless SSLVPN provides Layer 3 connectivity into the secured network.
B. When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the ASA uses its configured DNS servers to perform FQDN resolution.
C. When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the client uses the local DNS to perform FQDN resolution.
D. The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default.
E. A Cisco ASA can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions.

正解：B、E

質問 # 39
Which benefit of FlexVPN is a limitation of DMVPN using IKEv1?

A. NHRP authentication provides enhanced security.
B. Dynamic routing protocols can be configured.
C. IKE implementation can install routes in routing table.
D. GRE encapsulation allows for forwarding of non-IP traffic.

正解：C

質問 # 40
Refer to the exhibit.

An IKEv2 site-to-site tunnel between an ASA and a remote peer is not building successfully. What will fix the problem based on the debug output?