CCNP Security Practice Test | Secure Mobility (SIMOS)

Before deploying a basic site-to-site VPN, what information should you have? (Choose three)

A. ISAKMP policy

B. Transmission protection

C. Transform set

D. PSK

E. Basic peer authentication

Which two protocols are used for full client and clientless connections by Cisco VPNs? (Choose two)

A. SSL

B. Site-to-site

C. SHA

D. IPSec

Which component is responsible for group key and SA management in a GET VPN deployment?

A. Perfect Forward Secrecy

B. Group Member

C. Key Server

D. Group Domain of Interpretation

When configuring local VPN authorization, how can you configure the Group Policy with the required restrictions? (Choose two)

A. Define separate Group Policies for clientless and full tunnel users

B. Define one Group Policy for a set of users with similar privileges

C. Define one Group Policy for clientless and full tunnel users

D. Define separate Group Policies for a set of users with similar privileges

Which command would be used to verify the DMVPN NBMA address?

A. show ip nhrp nhs detail

B. show dmvpn detail

C. show ip nhrp

D. show interface tunnel

What improvements does IKEv2 provide to IKEv1? (Choose three)

A. Supports dynamically addressed peers with PKI-facilitated authentication

B. Built-in DPD

C. Supports PFS to ensure that a given IPSec SA key is not derived from another secret

D. Better rekeying and collision handling

E. Requires fewer round trips

When verifying and troubleshooting Cisco AnyConnect IPSec VPN, which tab of the AnyConnect Secure Mobility Client window allows you to confirm that the client has used IPSec/IKEv2 to connect by viewing the transport information?

A. Route Details

B. Firewall

C. Statistics

D. Message History

E. Preferences

Which statements best describe FlexVPN? (Choose two)

A. It is designed to provide interoperable, high-quality, and cryptographically based transmission security to IP traffic

B. It supports per-peer configurations of service parameters, such as QoS, firewall mechanisms, policies, and VRF-related settings

C. It offers a simple but modular framework that extensively uses the tunnel interface paradigm, while remaining compatible with legacy VPN implementations using crypto maps

D. It is used for performing mutual authentication and establishing and maintaining SAs

Which three methods are available on the Cisco ASA for revoking certificates? (Choose three)

A. Configuring DTLS

B. Configuring CRLs

C. Configuring ACLs

D. Configuring RADIUS

E. Configuring OCSP

Which set of commands will correctly configure the local authorization policy?

A. Router(config)#crypto ikev2 authorization policy policy1
Router(config-ikev2-author-policy)#pool flex-pool
Router(config-ikev2-author-policy)#def-domain brocadero.com
Router(config-ikev2-author-policy)#route set interface
Rout

B. Router(config-ikev2-profile)#virtual-template 1

C. Router(config)#crypto ipsec profile default
Router(ipsec-profile)#set ikev2-profile default

D. Router(config)#aaa new-model
Router(config)#aaa authorization network list1 local

Which tasks are the client generally responsible for in the SSL server authentication? (Choose three)

A. Sending a hello message informing of the preferred cipher suite

B. Sending a hello done message

C. Verifying the certificate to ensure it has been issued by a trusted CA

D. Generating random numbers to use as a shared session key

E. Starting the exchange by sending the client a hello message

You are testing an application plugin for a clientless SSL VPN session; however, it will not start. What should be done?

A. Verify that the browser's Java/ActiveX functions.

B. Verify that the smart tunnel agent starts.

C. Verify that the appropriate plugins are loaded.

D. Verify webtype ACLs.

Which of the following are potential issues when troubleshooting FlexVPN spoke-to-spoke shortcut switching? (Choose two)

A. Unsupported tunnel encapsulation modes

B. Incorrect spoke authorization

C. Failure of virtual template and virtual access interfaces on the hub

D. Inconsistent or missing NHRP configuration

Which command would be used to verify the number of encrypted and decrypted packets?

A. show crypto ipsec sa

B. show ip route

C. show interface ipsec tunnel

D. show interface tunnel

When configuring HA headended designs, at least how many tunnels should be configured on each branch?

A. One

B. Three

C. Four

D. Two

You need to verify the operation of a GRE tunnel. Assuming a routing protocol is configured, what can you do to accomplish this task? (Choose two)

A. Ping the inner tunnel IP address of the remote peer.

B. Observe keepalive messages from logs.

C. Review neighbor adjacencies.

D. Review NHRP statistics

What should you consider when configuring split tunneling in a Group Policy? (Choose two)

A. You can select the traffic that the clients will forward through the tunnel

B. By default, all traffic is forwarded through the tunnel using the exclude network list

C. It causes all the client traffic to go through the VPN tunnel

D. It permits the clients the direct access to external resources

You need to alter the effects of forwarding an HTTP applet proxy to the client. Which browser is required to complete this task?

A. Safari

B. Google Chrome

C. Microsoft Internet Explorer

D. Mozilla Firefox

Which three characteristics are common amongst asymmetric algorithms? (Choose three)

A. Simpler key management

B. Key management can be an issue

C. Suitable for key exchange

D. Fast compared with symmetric algorithms

E. Suitable for real-time bulk encryption

F. Slow compared to symmetric algorithms

When modifying the default DAP, what should you keep in mind? (Choose two)

A. Default DAP has the lowest priority and cannot be deleted

B. Terminate action will act like the default deny statement in an ACL

C. A user connection can match only one DAP record

D. The security appliance does not have a default DAP record

Which functions applied to cryptographic keys deal with Key Management? (Choose five)

A. Revocation

B. Composition

C. Destructions

D. Arrangement

E. Generation

F. Verification

G. Mutability

H. Exchange

Why would you use the Cisco AnyConnect Start Before Logon feature? (Choose two)

A. It is best used when network connectivity depends on user login

B. It allows the client to start before the user logs in to Windows

C. It enables users to log in to Active Directory over a VPN connection

D. It lets you control the use of login scripts and password caching for Linux

When using clientless SSL VPNs, why might the client fail to authenticate to the server? (Choose two)

A. The client time falls outside the validity range of the server certificate

B. The subject FQDN in the server certificate is different from the FQDN in the VPN URL

C. The root CA certificate and the VPN server certificate are in the respective certificate stores

D. The SSL VPN is enabled on an appropriate VPN server interface and uses the same TCP port that the clients access

Which statement best describes the purpose of Cisco IPSec VTI?

A. It is designed to provide a mix of security services in IPv4 and IPv6

B. It ensures that a given IPSec SA key was not derived from another secret

C. It is designed to provide crypto-graphically based transmission security to IP traffic

D. It can be used to configure IPSec-based VPNs between site-to-site devices

Which Cisco IOS FlexVPN benefit provides three different models to implement it?

A. Failover redundancy

B. IP Multicast support

C. Transport network

D. Third-party compatibility

What should you keep in mind in a configuration scenario that uses the local CA function on the Cisco ASA CA user accounts? (Choose two)

A. A certificate-to-connection profile map that binds the user certificate to a connection profile must exist

B. The FQDN includes information like the organizational unit

C. Certificate-based authentication in the required connection profiles is enabled by default

D. Organizational units contain values that are frequently mapped in identity certificates

Which command was used to view the data presented in the output given below?

A. show crypto ipsec sa

B. show interfaces virtual-access

C. show crypto isakmp sa detail

D. show crypto ikev2 sa

Which option correctly defines the action that takes place when a DTLS-based VPN loses a packet?

A. The VPN endpoints will retransmit the dropped datagram.

B. The TCP stack of the application endpoints will retransmit the datagrams.

C. Both the VPN and the TCP stack of the application endpoint will retransmit the datagram.

D. The datagram is not retransmitted to reduce latency.

What are the prerequisites for the AnyConnect SSL VPN deployment? (Choose two)

A. Configure support for DTLS

B. Enable the SSL VPN function on the interface

C. Install the Cisco AnyConnect client software image on the Cisco ASA

D. Provision an identity server SSL/TLS certificate to the Cisco ASA

A tunnel is not forming between two spokes. Which of the following should you verify? (Choose two)

A. NHRP redirect is enabled on the hub

B. NHRP shortcut is enabled on the spoke

C. SA states on the hub and spoke

D. Connectivity between the hub and the spoke

What steps are required to configure transmission protection? (Choose three)

A. Configure the IKE policy

B. Choose the transform set

C. Choose the VPN peer

D. Enable IKE for each interface

E. Choose traffic for the VPN

Which items could prevent the encrypted and decrypted packet counters from increasing? (Choose two)

A. Routing

B. IPSec SAs

C. Keepalives

D. Neighbor adjacencies

During which phase of the SSL/TLS session establishment and key management does data transfer begin?

A. Phase 2: server certificate and key exchange

B. Phase 3: client certificate (if required) and key exchange

C. Phase 4: finish

D. Phase 1: establish client-server security capabilities

Which two protocols can be used for IPSec VTI encapsulation? (Choose two)

A. IKE

B. ISAKMP

C. AH

D. ESP

What command is used to enable authentication, authorization, and accounting?

What should you keep in mind when verifying the SSL VPN portal configuration and training users on how to use it? (Choose two)

A. All users can use the URL entry control to select URLs for protocols that are imported plugins enabled

B. Plugins can be launched in a new browser window

C. Users should use the parent browser navigation controls and not the plugin's controls

D. All bookmarks are listed by default

Which statement is true regarding a Cisco ASA security appliance and IPSec?

A. AH is not supported.

B. IKEv2 is supported but IKEv1 is not supported.

C. ISAKMP is supported but IKE is not supported.

D. ESP is not supported.

How is external authorization in AnyConnect SSL VPNs monitored? (Choose two)

A. You can view the downloaded ACL in the ASDM or CLI

B. The Cisco ISE authorization policy selects an authorization profile

C. ISE uses a connection profile to authenticate a user against the ASA

D. The authorization profile is based on the cisco-av-pair=ip:acl attribute

What are the three VPN connection technologies? (Choose three)

A. Full-tunnel client-based IPSec VPN

B. Clientless SSL VPN

C. Full-tunnel clientless LTO VPN

D. Full-tunnel client-based SSL VPN

What is the first troubleshooting step that should be taken when there is a clientless SSL VPN session establishment issue?

A. Verify user authentication

B. Verify clientless permissions

C. Verify that the SSL/TLS session establishes.

D. Verify user credentials

Which secure posture module component is a package that installs on the remote device after the user connects to the Cisco Adaptive Security Appliance and before the user logs in?

A. Integration with dynamic access policies

B. Prelogin assessment

C. Host scan

D. Prelogin policies

Which troubleshooting command can be used to monitor an active view of AnyConnect client web browser SSL sessions?

A. debug webvpn util

B. debug webvpn html

C. debug webvpn url

D. debug webvpn svc

When configuring an IPSec profile to support IKEv2 and Cisco AnyConnect, what should you do immediately after enabling IKEv2 on the outside interface, choosing an interface certificate, and enabling Client Services?

A. Create an IKEv2 group

B. Connect and update the client profile

C. Create and edit a Cisco AnyConnect connection profile

D. Create and edit a client connection profile

What are the benefits of the clientless remote access SSL VPN architecture? (Choose two)

A. It requires a special-purpose desktop VPN client software

B. It supports all IP applications

C. It can traverse most firewalls and NAT devices

D. It uses the native SSL encryption of a web browser to provide data confidentiality

Review the output. Which statement is true concerning the output?

A. The HostScan extension can be activated.

B. The HostScan extension cannot be activated.

C. HostScan should be enabled on a branch device, not on an HQ.

D. There is not enough information to determine whether the HostScan extension can be activated.

What limitations should you consider when using GRE tunneling? (Choose two)

A. There is no standard method to determine the end-to-end state of a GRE tunnel

B. Proprietary GRE keepalives are not supported

C. It provides limited cryptographic traffic protection

D. Tunnels can exhibit MTU and IP fragmentation-related issues

Which statements best describe the NHRP client-server protocol? (Choose two)

A. It is designed to manage the transportation of multiprotocol and IP multicast traffic between two or more sites, which may only have IP connectivity

B. It creates a mapping for a tunnel IP address to the physical interface IP address for each spoke at the hub

C. It is typically used for simple point-to-point tunnels that emulate a point-to-point WAN link, or on spoke routers in hub-and-spoke VPNs

D. It is used by routers to determine the IP address of the next hop in IP tunneling networks

What should you consider when using a PKI obtained certificate for server authentication? (Choose two)

A. The appliance will create a self-signed certificate to sign certificates that are issued to clients

B. You can configure the Cisco ASA to obtain an identity certificate from the external PKI

C. The self-signed certificate authentication method is recommended

D. Clients should have a CA certificate that is installed locally

Which Cisco ASA application plugin allows for connections to WinFrame-based terminal services?

A. SSH

B. RDP2

C. VNC

D. ICA

E. RDP

Which command is used to verify that the certificate has successfully been imported and that ECDSA is used?

A. show crypto isakmp sa

B. show crypto ipsec sa

C. show crypto key

D. show crypto pki certificates verbose

Which attribute would you use to apply an ACE to a user session?

A. cisco-av-pair=ip:inacl

B. cisco-av-pair=inacl:ip

C. cisco-av-pair=inacl:webvpn

D. cisco-av-pair=webvpn:inacl

How does the Cisco ASA enables a user to choose connection profiles? (Choose two)

A. By choosing a connection profile from a drop-down list and then successfully authenticating it against the profile to obtain network access

B. By connecting to a VPN group URL that is associated with the connection profile

C. By using a field in a digital certificate

D. By mapping the user to the default connection profile

Which steps are required to configure basic peer authentication for point-to-point tunnels on the Cisco ASA? (Choose three)

A. Choose the transform set and VPN peer

B. Enable IKEv1, IKEv2, or both on an interface

C. Choose traffic for the VPN

D. Configure PSKs

E. Configure IKE policy

Which statements regarding the verification of DMVPN hub-and-spoke routing and IKE peering are true? (Choose two)

A. Multiple IKE sessions are established.

B. Routes are reachable over the spoke

C. A single IKE session is created.

D. Spokes are reachable over the hub.

When enabling smart tunnels in the clientless SSL VPN access, what kind of information can you specify? (Choose three)

A. Bookmarks for the security appliance to display

B. Application list entries

C. Smart tunnel session log off method

D. Auto sign-on server list entries

E. Port forwarding list entries

While calculating your results take a moment to complete our simple survey!

How likely is it that you would recommend LearnCisco.net
to a friend or colleague?

Why?

While calculating your results take a moment to complete our simple survey!

How likely is it that you would recommend LearnCisco.net to a friend or colleague?

Why?

How likely is it that you would recommend LearnCisco.net
to a friend or colleague?