[2024年02月]更新の300-730試験事前練習テスト試験問題と解答CCNP Security学習ガイド
Implementing Secure Solutions with Virtual Private Networks認証サンプル解答
Cisco 300-730 試験は、仮想プライベートネットワーク (VPN) を使用したセキュアソリューションを実装する IT 専門家の能力を測定する認定試験です。この試験は、基本的なネットワークコンセプトを熟知し、VPN の知識を深めたい方を対象に設計されています。この試験は、暗号化、認証、アクセス制御などの VPN を安全にするための様々なセキュリティプロトコル、テクノロジー、ソリューションに焦点を当てています。
質問 # 53
A network engineer is setting up Cisco AnyConnect 4.9 on a Cisco ASA running ASA software 9.1. Cisco AnyConnect must connect to the Cisco ASA before the user logs on so that login scripts can work successfully. In addition, the VPN must connect without user intervention. Which two key steps accomplish this task? (Choose two.)
- A. Create a Cisco AnyConnect VPN profile with Start Before Logon set to true.
- B. Create a Network Access Manager profile with a client policy set to connect before user logon.
- C. Issue an identity certificate to the trusted root CA folder in the machine store.
- D. Create a Cisco Anyconnect VPN Management Tunnel profile.
- E. Create a Cisco AnyConnect VPN profile with Always On set to true.
正解：A、C
質問 # 54
Which two features are valid backup options for an IOS FlexVPN client? (Choose two.)
- A. DNS-based hub resolution
- B. HSRP stateless failover
- C. reactivate primary peer
- D. need distractor
- E. tunnel pivot
正解：A、C
質問 # 55
Refer to the exhibit.
Which type of Cisco VPN is shown for group Cisc012345678?
- A. GETVPN
- B. Cisco AnyConnect Client VPN
- C. Clientless SSLVPN
- D. DMVPN
正解：B
質問 # 56
Refer to the exhibit.
A network administrator is setting up a phone VPN on a Cisco ASA. The phone cannot connect and the error is presented in a debug on the Cisco ASA. Which action fixes this issue?
- A. Install the posture module on the Cisco ASA.
- B. Enable web-deploy of the posture module so that the module can be downloaded from the Cisco ASA to an IP phone.
- C. Configure the Cisco ASA to present an RSA certificate to the phone for authentication.
- D. Disable Cisco Secure Desktop under the connection profile VPNPhone.
正解：D
解説：
CSD and IP phones: Currently, IP phones do not support Cisco Secure Desktop (CSD) and do not connect when CSD is enabled for the tunnel group or globally in the ASA.
質問 # 57
A company needs to ensure only corporate issued laptops and devices are allowed to connect with the Cisco AnyConnect client. The solution should be applicable to multiple operating systems, including Windows, MacOS, and Linux, and should allow for remote remediation if a corporate issued device is stolen. Which solution should be used to accomplish these goals?
- A. Install and authenticate machine certificates on the corporate devices
- B. Install and authenticate user certificates on the corporate devices.
- C. Use a DAP file check on the system to determine the relationship with the corporate domain.
- D. Use a DAP registry check on the system to determine the relationship with the corporate domain.
正解：D
解説：
https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/asdm78/vpn/asdm-78-vpn-config/vpn-asdm-dap.html#ID-2184-00000017
質問 # 58
In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form. Which troubleshooting step solves the issue?
- A. Verify that the spoke receives redirect messages and sends resolution requests.
- B. Verify the spoke configuration to check if the NHRP redirect is enabled.
- C. Verify the hub configuration to check if the NHRP shortcut is enabled.
- D. Verify that the tunnel interface is contained within a VRF.
正解：A
解説：
Reference:
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn- dmvpn-15-mt-book/sec-conn-dmvpn-summ-maps.pdf
質問 # 59
An engineer is troubleshooting a new DMVPN setup on a Cisco IOS router. After the show crypto isakmp sa command is issued, a response is returned of "MM_NO_STATE." Why does this failure occur?
- A. The ISAKMP policy priority values are invalid.
- B. The Phase 1 policy does not match on both devices.
- C. Tunnel protection is not applied to the DMVPN tunnel.
- D. ESP traffic is being dropped.
正解：B
解説：
https://www.cisco.com/c/en/us/support/docs/security/dynamic-multipoint-vpn-dmvpn/111976-dmvpn-troubleshoot-00.html The MMNOSTATE failure occurs when the ISAKMP policy priority values are not configured correctly on both devices. The ISAKMP policy priority values are used to determine the order in which the ISAKMP policies are applied. If the priority values do not match between the two devices, the ISAKMP tunnel may not be established correctly, resulting in the MMNOSTATE failure. To resolve this issue, the engineer should ensure that the ISAKMP policy priority values are configured correctly on both the router and the peer.
質問 # 60
Which command is used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?
- A. show crypto identity
- B. show crypto ikev2 sa
- C. show crypto isakmp sa
- D. show crypto gkm
正解：B
解説：
Section: Troubleshooting using ASDM and CLI
Explanation/Reference: https://www.cisco.com/c/en/us/support/docs/security/flexvpn/116413-configure-flexvpn-00.pdf
質問 # 61 
Refer to the exhibit. Based on the debug output, which type of mismatch is preventing the VPN from coming up?
- A. PFS
- B. lifetime
- C. preshared key
- D. interesting traffic
正解：B
解説：
Section: Troubleshooting using ASDM and CLI
Explanation:
If the responder's policy does not allow it to accept any part of the proposed Traffic Selectors, it responds with a TS_UNACCEPTABLE Notify message.
質問 # 62
Which technology is used to send multicast traffic over a site-to-site VPN?
- A. GRE over IPsec on FTD
- B. GRE tunnel on ASA
- C. GRE over IPsec on IOS router
- D. IPsec tunnel on FTD
正解：C
解説：
https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/216276-configure-route-based-site-to-site-vpn-t.html#anc6
質問 # 63
What uses an Elliptic Curve key exchange algorithm?
- A. ECDHE
- B. AES-GCM
- C. ECDSA
- D. SHA
正解：A
質問 # 64
Refer to the exhibit.
An engineer is troubleshooting a new GRE over IPsec tunnel. The tunnel is established but the engineer cannot ping from spoke 1 to spoke 2. Which type of traffic is being blocked?
- A. ESP packets from spoke1 to spoke2
- B. ISAKMP packets from spoke2 to spoke1
- C. ISAKMP packets from spoke1 to spoke2
- D. ESP packets from spoke2 to spoke1
正解：D
質問 # 65
Which technology works with IPsec stateful failover?
- A. HSRP
- B. VRRP
- C. GRE
- D. GLBR
正解：A
質問 # 66
A Cisco AnyConnect client establishes a SSL VPN connection with an ASA at the corporate office. An engineer must ensure that the client computer meets the enterprise security policy. Which feature can update the client to meet an enterprise security policy?
- A. Basic Host Scan
- B. Endpoint Assessment
- C. Cisco Secure Desktop
- D. Advanced Endpoint Assessment
正解：D
質問 # 67
An engineer has successfully established a Phase 1 and Phase 2 tunnel between two sites. Site A has internal subnet 192.168.0.0/24 and Site B has internal subnet 10.0.0.0/24. The engineer notices that no packets are decrypted at Site B. Pings to 192.168.0.1 from internal Site B devices make it to the Site B router, and the Site A router has incrementing encrypt and decrypt counters. What must be done to ensure bidirectional communication between both sites?
- A. Modify the routing at Site B so that traffic is sent to Site A.
- B. Configure the correct DH group on both devices.
- C. Enable PFS on the headend device.
- D. Allow protocol ESP or AH on the firewall in front of the Site B router.
正解：D
質問 # 68
Refer to the exhibit.
Which two conclusions should be drawn from the DMVPN phase 2 configuration? (Choose two.)
- A. Spoke-to-spoke communication is allowed.
- B. Next-hop-self is required.
- C. EIGRP neighbor adjacency will fail.
- D. EIGRP route redistribution is not allowed.
- E. EIGRP is used as the dynamic routing protocol.
正解：A、E
質問 # 69
What are two purposes of the key server in Cisco IOS GETVPN? (Choose two.)
- A. to maintain encryption policies
- B. to download encryption keys
- C. to distribute routing information
- D. to encrypt data traffic
- E. to authenticate group members
正解：A、E
解説：
https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Aug2014/CVD-GETVPNDesignGuide-AUG14.pdf
質問 # 70
Which command automatically initiates a smart tunnel when a user logs in to the WebVPN portal page?
- A. auto-upgrade
- B. auto-run
- C. auto-connect
- D. auto-start
正解：D
解説：
Section: Remote access VPNs
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/vpn/ asa_91_vpn_config/webvpn-configure-policy-group.html
質問 # 71
......
Cisco 300-730認定試験は、仮想プライベートネットワーク（VPN）を使用して安全なソリューションを実装する際に、ITプロフェッショナルの知識とスキルを評価するように設計されています。この認定は、ネットワークセキュリティエンジニア、ネットワーク管理者、およびVPNソリューションの展開と管理に関する専門知識を実証したい他のIT専門家に最適です。この試験では、VPN暗号化プロトコル、ネットワークセキュリティポリシー、VPNの問題のトラブルシューティングなど、幅広いトピックについて説明します。
Cisco 300-730試験は、仮想プライベートネットワークを使用した安全なソリューションの実装におけるITプロフェッショナルの知識とスキルをテストするために設計されています。この認定試験は、ネットワークエンジニア、セキュリティ管理者、システム管理者など、安全な仮想ネットワークの設計、実装、および維持を担当している方に適しています。試験は、VPN技術、安全なリモートアクセス、AAA（認証、承認、会計）、エンドポイントセキュリティなど、幅広いトピックをカバーしています。
Cisco試験練習テスト最高得点を獲得しよう：https://jp.fast2test.com/300-730-premium-file.html
検証済み材料にはここ300-730：https://drive.google.com/open?id=18_bzoqBYIMyzdnElLtA8hUcmkr8z-XFT