A network engineer is setting up a clientless SSLVPN on a Cisco ASA. Remote users must be able to access an internal webserver via the URL example.com. Which two steps accomplish this task? (Choose two.)

A. Configure a bookmark for the webserver.

B. Configure routing so that the user’s computer can reach the webserver.

C. Configure a DNS server that can resolve the webserver URL.

D. Configure a browser plugin on the Cisco ASA.

E. Configure routing so that the Cisco ASA can reach the webserver.

A user is experiencing delays on audio calls over a Cisco AnyConnect VPN. Which implementation step resolves this issue?

A. Change to 3DES Encryption.

B. Shorten the encryption key lifetime.

C. Install the Cisco AnyConnect 2.3 client for the user to download.

D. Enable DTLS.

Refer to the exhibit. An engineer is diagnosing an issue that occurred after a router at a branch site was assigned a new address. Based on the debugs, what must be done to resolve this issue?

A. Add the remote peer’s IP address to the server’s IKEv2 keyring.

B. Ensure that the correct preshared keys are set on both sides.

C. Ensure that the UDP 500 packets between devices are not dropped.

D. Add the remote peer’s identity to the server’s IKEv2 profile.

On an ASA with multiple connection profiles for different departments, what is the best design to ensure that AnyConnect users are assigned the correct connection profile based on their department and do not have the ability to choose a different connection profile?

A. group URL

B. group alias

C. dynamic access policy

D. certificate mapping

A network administrator wants the Cisco ASA to automatically start downloading the Cisco AnyConnect client without prompting the user to select between WebVPN or AnyConnect. Which command accomplishes this task?

A. anyconnect ssl df-bit-ignore enable

B. anyconnect ask none default anyconnect

C. anyconnect ask enable default anyconnect

D. anyconnect modules value default

Refer to the exhibit. What is a result of this configuration?

A. Spoke 1 fails the authentication because the authentication methods are incorrect.

B. Spoke 2 passes the authentication to the hub and successfully proceeds to phase 2.

C. Spoke 2 fails the authentication because the remote authentication method is incorrect.

D. Spoke 1 passes the authentication to the hub and successfully proceeds to phase 2.

An administrator is setting up a VPN on an ASA for users who need to access an internal RDP server. Due to security restrictions, the Microsoft RDP client is blocked from running on client workstations via Group Policy. Which VPN feature should be implemented by the administrator to allow these users to have access to the RDP server?

A. clientless proxy

B. smart tunneling

C. clientless plug-in

D. clientless rewriter

DRAG DROP -
Drag and drop the correct commands from the right onto the blanks within the code on the left to implement a design that allow for dynamic spoke-to-spoke communication. Not all commands are used.
Select and Place:
 

Refer to the exhibit. Cisco AnyConnect must be set up on a router to allow users to access internal servers 192.168.0.10 and 192.168.0.11. All other traffic should go out of the client's local NIC. Which command accomplishes this configuration?

A. svc split include 192.168.0.0 255.255.255.0

B. svc split exclude 192.168.0.0 255.255.255.0

C. svc split include acl CCNP

D. svc split exclude acl CCNP

An administrator is setting up AnyConnect for the first time for a few users. Currently, the router does not have access to a RADIUS server. Which AnyConnect protocol must be used to allow users to authenticate?

A. EAP-GTC

B. EAP-MSCHAPv2

C. EAP-MD5

D. EAP-AnyConnect

A network engineer is implementing a FlexVPN tunnel between two Cisco IOS routers. The FlexVPN tunnels will terminate on encrypted traffic on an interface configured with an IP MTU of 1500, and the company has a security policy to drop fragmented traffic coming into or leaving the network. The tunnel will be used to transfer TFTP data between users and internal servers. When the TFTP traffic is not traversing a VPN, it can have a maximum IP packet size of 1500. Assuming the encrypted payload will add 90 bytes, which configuration allows TFTP traffic to traverse the FlexVPN tunnel without being dropped?

A. Set the tunnel IP MTU to 1500.

B. Set the tunnel tcp adjust-mss to 1460.

C. Set the tunnel IP MTU to 1400.

D. Set the tunnel tcp adjust-mss to 1360.

A Cisco IOS router is reconfigured to connect to an additional DMVPN hub that is a part of a different DMVPN phase 3 cloud. After this change was made, users begin to experience problems accessing corporate resources over both tunnels. Before the additional tunnel was created, users could access resources over the first tunnel without any issues. Both tunnels terminate on the same interface of the router and use the same IPsec proposals. Which two actions resolve the issue without affecting spoke-to-spoke traffic in either DMVPN cloud? (Choose two.)

A. Enable dead peer detection for both tunnels.

B. Use the same shared IPsec profile for both tunnels.

C. Configure the same NHRP network IDs for both tunnels.

D. Specify the tunnel destination in each tunnel.

E. Assign a unique tunnel key to each tunnel.

Which two protocols does DMVPN leverage to build dynamic VPNs to multiple destinations? (Choose two.)

A. IKEv2

B. NHRP

C. mGRE

D. mBGP

E. GDOI

In order to enable FlexVPN to use a AAA attribute list, which two tasks must be performed? (Choose two.)

A. Define the RADIUS server.

B. Verify that clients are using the correct authorization policy.

C. Define the AAA server.

D. Assign the list to an authorization policy.

E. Set the maximum segment size.

Refer to the exhibit. The network security engineer identified that the hub router cannot send traffic to the spoke router. Based on the provided output, which action resolves the issue?

A. Permit UDP ports 500 and 4500 between the hub and spoke.

B. Correct the next hop server IP address on the spoke router.

C. Ensure the preshared key on the hub-and-spoke router matches.

D. Adjust the ip nhrp network-id command on the hub router.

Refer to the exhibit. An IKEv2 site-to-site tunnel between an ASA and a remote peer is not building successfully. What will fix the problem based on the debug output?

A. Ensure crypto IPsec policy matches on both VPN devices.

B. Install the correct certificate to validate the peer.

C. Correct crypto access list on both VPN devices.

D. Specify the peer IP address in the tunnel group name.

A network engineer is installing Cisco AnyConnect on company laptops so that users can access corporate resources remotely. The VPN concentrator is a Cisco router running IOS-XE 16.9.1 code and configured as a FlexVPN server that uses local authentication and *$Cisc431089017$* as the key-id for the IKEv2 profile. Which two steps must be taken on the computer to allow a successful AnyConnect connection to the router? (Choose two.)

A. In the Cisco AnyConnect XML profile, set the IPsec Authentication method to EAP-AnyConnect.

B. In the Cisco AnyConnect XML profile, add the hostname and host address to the server list.

C. In the Cisco AnyConnect XML profile, set the user group field to DefaultAnyConnectClientGroup.

D. In the Cisco AnyConnect Local Policy, set the BypassDownloader option in the local to true.

E. In the Cisco AnyConnect Local Policy, add the router IP address to the Update Policy.

Over the weekend, an administrator upgraded the Cisco ASA image on the firewalls and noticed that users cannot connect to the headquarters site using Cisco AnyConnect. What is the solution for this issue?

A. Upgrade the Cisco AnyConnect client version to be compatible with the Cisco ASA software image.

B. Upgrade the Cisco AnyConnect Network Access module to be compatible with the Cisco ASA software image.

C. Upgrade the Cisco AnyConnect client driver to be compatible with the Cisco ASA software image.

D. Upgrade the Cisco AnyConnect Start Before Logon module to be compatible with the Cisco ASA software image.

Refer to the exhibit. A network engineer is configuring a remote access SSLVPN and is unable to complete the connection using local credentials. What must be done to remediate this problem?

A. Enable the client protocol in the Cisco AnyConnect profile.

B. Configure a AAA server group to authenticate the client.

C. Change the authentication method to local.

D. Configure the group policy to force local authentication.

Refer to the exhibit. Which type of VPN is being configured, based on the partial configuration snippet?

A. GET VPN with COOP key server

B. GET VPN with dual group member

C. FlexVPN load balancer

D. FlexVPN backup gateway

Which two statements about the Cisco ASA Clientless SSL VPN solution are true? (Choose two.)

A. When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the client uses the local DNS to perform FQDN resolution.

B. The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default.

C. A Cisco ASA can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions.

D. When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the ASA uses its configured DNS servers to perform FQDN resolution.

E. Clientless SSLVPN provides Layer 3 connectivity into the secured network.

Refer to the exhibit. Which two tunnel types produce the show crypto ipsec sa output seen in the exhibit? (Choose two.)

A. crypto map

B. DMVPN

C. GRE

D. FlexVPN

E. VTI

A network engineer must configure the Cisco ASA so that Cisco AnyConnect clients establishing an SSL VPN connection create an additional tunnel for real-time traffic that is sensitive to packet delays. If this additional tunnel experiences any issues, it must fall back to a TLS connection. Which two Cisco AnyConnect features must be configured to accomplish this task? (Choose two.)

A. DTLS

B. DSCP Preservation

C. DPD

D. SSL Rekey

E. OMTU

An engineer is implementing the FlexVPN solution on a Cisco IOS router. The router must only terminate VPN requests and must not initiate them. Additionally, the interface must support VPNs from other routers and Cisco AnyConnect connections. Which interface type must be configured to meet these requirements?

A. point-to-point GRE tunnel interface

B. multipoint GRE tunnel interface

C. static virtual tunnel interface

D. virtual template interface

A company is setting up a dynamic crypto map on the Cisco ASA at the headquarters to accept connections from the branch offices. There will be no IP subnet overlap between the branch offices, but the engineer does not know which encryption domains will be requested by the branch offices. Additionally, the company security policy states that routing protocol traffic should not leave the HQ network. Which solution should be used to route traffic back to the branches from the Cisco ASA with minimal administrative effort?

A. Configure Reverse Route Injection on the dynamic crypto map.

B. Configure a default route with the tunneled keyword on all branch routers.

C. Configure static routes for remote subnets.

D. Configure snapshot routing with EIGRP to send out of band routing updates.

A network engineer must design a remote access solution to allow contractors to access internal servers. These contractors do not have permissions to install applications on their computers. Which VPN solution should be used in this design?

A. IKEv2 AnyConnect

B. Clientless

C. Port forwarding

D. SSL AnyConnect

Refer to the exhibit. DMVPN spoke-to-spoke traffic works, but it passes through the hub, and never sends direct spoke-to-spoke traffic. Based on the tunnel interface configuration shown, what must be configured on the hub to solve the issue?

A. Enable NHRP redirect.

B. Enable split horizon.

C. Enable IP redirects.

D. Enable NHRP shortcut.

Refer to the exhibit. Which type of VPN implementation is displayed?

A. IKEv1 cluster

B. IKEv2 backup gateway

C. IKEv2 load balancer

D. IKEv2 reconnect

While troubleshooting, an engineer finds that the show crypto isakmp sa command indicates that the last state of the tunnel is MM_KEY_EXCH. What is the next step that should be taken to resolve this issue?

A. Verify that the ISAKMP proposals match.

B. Ensure that UDP 500 is not being blocked between the devices.

C. Correct the peer’s IP address on the crypto map.

D. Confirm that the pre-shared keys match on both devices.

Refer to the exhibit. The DMVPN tunnel is dropping randomly and no tunnel protection is configured. Which spoke configuration mitigates tunnel drops?
A.
 
B.
 
C.
 
D.
 

Which VPN does VPN load balancing on the ASA support?

A. VTI

B. IPsec site-to-site tunnels

C. L2TP over IPsec

D. Cisco AnyConnect

Which feature allows a DMVPN Phase 3 spoke to switch to an alternate hub when the primary hub is unreachable?

A. multicast PIM

B. backup NHS

C. per-tunnel jitter probes

D. NHRP shortcut

Cisco AnyConnect Secure Mobility Client has been configured to use IKEv2 for one group of users and SSL for another group. When the administrator configures a new AnyConnect release on the Cisco ASA, the IKEv2 users cannot download it automatically when they connect. What might be the problem?

A. The XML profile is not configured correctly for the affected users.

B. The new client image does not use the same major release as the current one.

C. Client services are not enabled.

D. Client software updates are not supported with IKEv2.

A user at a company HQ is having trouble accessing a network share at a branch site that is connected with a L2L IPsec VPN. While troubleshooting, a network security engineer runs a packet tracer on the Cisco ASA to simulate the user traffic and discovers that the encryption counter is increasing but the decryption counter is not. What must be configured to correct this issue?

A. Adjust the routing on the remote peer device to direct traffic back over the tunnel.

B. Adjust the preshared key on the remote peer to allow traffic to flow over the tunnel.

C. Adjust the transform set to allow bidirectional traffic.

D. Adjust the peer IP address on the remote peer to direct traffic back to the ASA.

What are two differences between ECC and RSA? (Choose two.)

A. Key generation in ECC is slower and more CPU intensive than RSA.

B. ECC can have the same security as RSA but with a shorter key size.

C. ECC cannot have the same security as RSA, even with an increased key size.

D. Key generation in ECC is faster and less CPU intensive than RSA.

E. ECC lags in performance when compared with RSA.

An engineer is troubleshooting a new DMVPN setup on a Cisco IOS router. After the show crypto isakmp sa command is issued, a response is returned of
"MM_NO_STATE." Why does this failure occur?

A. The ISAKMP policy priority values are invalid.

B. ESP traffic is being dropped.

C. The Phase 1 policy does not match on both devices.

D. Tunnel protection is not applied to the DMVPN tunnel.

Refer to the exhibit.
 
VPN tunnels between a spoke and two DMVPN hubs are not coming up. The network administrator has verified that the encryption, hashing, and DH group proposals for Phase 1 and Phase 2 match on both ends. What is the solution to this issue?

A. Ensure bidirectional UDP 500/4500 traffic.

B. Increase the isakmp phase 1 lifetime.

C. Add NAT statements for VPN traffic.

D. Enable shared tunnel protection.

Refer to the exhibit. What is configured as a result of this command set?

A. FlexVPN client profile for IPv6

B. FlexVPN server to authorize groups by using an IPv6 external AAA

C. FlexVPN server for an IPv6 dVTI session

D. FlexVPN server to authenticate IPv6 peers by using EAP

Under which section must a bookmark or URL list be configured on a Cisco ASA to be available for clientless SSLVPN users?

A. tunnel-group (general-attributes)

B. tunnel-group (webvpn-attributes)

C. webvpn (group-policy)

D. webvpn (global configuration)

An engineer has configured Cisco AnyConnect VPN using IKEv2 on a Cisco IOS router. The user cannot connect in the Cisco AnyConnect client, but receives an alert message "Use a browser to gain access." Which action does the engineer take to resolve this issue?

A. Reset user login credentials.

B. Correct the URL address.

C. Connect using HTTPS.

D. Disable the HTTP server.

When troubleshooting FlexVPN spoke-to-spoke tunnels, what should be verified first?

A. NHRP redirect is enabled on the hub.

B. The spokes have sent a resolution request.

C. NHRP cache entries exist on the spoke.

D. NHO routes exist on the spokes.

Which parameter is initially used to elect the primary key server from a group of key servers?

A. code version

B. highest IP address

C. highest-priority value

D. lowest IP address

Which command shows the smart default configuration for an IPsec profile?

A. show run all crypto ipsec profile

B. ipsec profile does not have any smart default configuration

C. show smart-defaults ipsec profile

D. show crypto ipsec profile default

Which command is used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?

A. show crypto ikev2 sa

B. show crypto isakmp sa

C. show crypto gkm

D. show crypto identity

An administrator is deciding which authentication protocol should be implemented for their upcoming Cisco AnyConnect deployment. A list of the security requirements from upper management are: the ability to force AnyConnect users to use complex passwords such as C1$c0451035084!, warn users a few days before their password expires, and allow users to change their password during a remote access session. Which authentication protocol must be used to meet these requirements?

A. LDAPS

B. RADIUS

C. Kerberos

D. TACACS+

Refer to the exhibit.
 
An IPsec Cisco AnyConnect client is failing to connect and generates these debugs every time a connection to an IOS headend is attempted. Which action resolves this issue?

A. Correct the DH group setting.

B. Correct the PFS setting.

C. Correct the integrity setting.

D. Correct the encryption setting.

Refer to the exhibit. Client 1 cannot communicate with client 2. Both clients are using Cisco AnyConnect and have established a successful SSL VPN connection to the hub ASA. Which command on the ASA is missing?

A. dns-server value 10.1.1.2

B. same-security-traffic permit intra-interface

C. same-security-traffic permit inter-interface

D. dns-server value 10.1.1.3

What is a characteristic of GETVPN?

A. An ACL that defines interesting traffic must be configured and applied to the crypto map.

B. Quick mode is used to create an IPsec SA.

C. The remote peer for the IPsec session is configured as part of the crypto map.

D. All peers have one IPsec SPI for inbound and outbound communication.

Which technology works with IPsec stateful failover?

A. GLBP

B. HSRP

C. GRE

D. VRRP

A network engineer must design a clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was found that one website is not being rewritten correctly by the ASA. What is a potential solution for this issue while still allowing it to be a clientless VPN setup?

A. Set up a smart tunnel with the IP address of the web server.

B. Set up a NAT rule that translates the ASA public address to the web server private address on port 80.

C. Set up Cisco AnyConnect with a split tunnel that has the IP address of the web server.

D. Set up a WebACL to permit the IP address of the web server.