CCNP Security Practice Test | Secure Mobility (SIMOS)

Which command was used to view the data presented in the output given below?

A. show crypto ipsec sa

B. show interfaces virtual-access

C. show crypto isakmp sa detail

D. show crypto ikev2 sa

Which application access method is available with Cisco clientless SSL VPNs and is recommended for Linux?

A. Port forwarding

B. Full-tunnel VPN

C. Smart tunnels

D. Application plugins

When enabling smart tunnels in the clientless SSL VPN access, what kind of information can you specify? (Choose three)

A. Bookmarks for the security appliance to display

B. Application list entries

C. Smart tunnel session log off method

D. Auto sign-on server list entries

E. Port forwarding list entries

What command can be used to verify whether the ASA device holds the proper license to activate HostScan?

A. show activation-key

B. show license

What would cause the req-failed field to be a number greater than zero on a spoke? (Choose two)

A. Matching network IDs

B. Next-hop server issue

C. SA keepalives failed

D. Authentication key mismatch

Refer to the output. Which statements regarding the output are true? (Choose two)

Refer to the output. Which statements regarding the output are true?

A. SAs have been negotiated.

B. Packet compression is non-operational.

C. The tunnel is operational.

D. The SA has expired.

How do both Cisco ASA and Cisco IOS routers facilitate resource and application access? (Choose two)

A. Thin-client connections

B. URL and CIFS file access

C. Application plugins

D. Smart tunnels

What does SSL/TLS provide? (Choose two)

A. Data integrity to ensure that data hasn't been modified in transit

B. Endpoint authentication on the server only

C. Support for native application clients

D. Encryption to ensure data is only readable by the intended recipient

Which PKI component is used to bind the name of an entity to its public key?

A. Trustpoint

B. Digital certificate

C. RA

D. Directory service

Which component is responsible for group key and SA management in a GET VPN deployment?

A. Perfect Forward Secrecy

B. Group Member

C. Key Server

D. Group Domain of Interpretation

Identify the features of TND. (Choose two)

A. It disconnects the tunnel if the user is in the trusted network

B. It is configured in the client profile

C. It can map and unmap network drives

D. It automatically starts user applications

What is the purpose of FlexVPN? (Choose two)

A. To provide encapsulation

B. To convert cleartext to ciphertext

C. To simplify deployment of VPNs

D. To address the complexity of multiple solutions

In a basic IKEv2 message exchange, with only the minimal four messages, which messages represent the IKE_SA_INIT phase and exchange IKEv2 proposals and key material information? (Choose two)

A. Third message

B. Fourth message

C. First message

D. Second message

Which troubleshooting command can be used to monitor an active view of AnyConnect client web browser SSL sessions?

A. debug webvpn util

B. debug webvpn html

C. debug webvpn url

D. debug webvpn svc

Identify the multiple client-side authentication options in clientless SSL VPN. (Choose three)

A. Certificate-based and one AAA authentication

B. Double AAA authentication (no certificate) with optional username reuse

C. Double AAA authentication (with certificate) with optional username reuse

D. Certificate-based and two AAA authentication

E. Certificate-based and one AAA authentication, where the username for AAA authentication can be extracted from the certificate subject field and hidden from users

Which Cisco ASA-supported application plugin supports the Citrix servers?

A. ICA

B. SSH

C. RDP

D. VNC

Which three characteristics are common amongst asymmetric algorithms? (Choose three)

A. Simpler key management

B. Key management can be an issue

C. Suitable for key exchange

D. Fast compared with symmetric algorithms

E. Suitable for real-time bulk encryption

F. Slow compared to symmetric algorithms

When using smart tunnel-based application access with SSL VPN, what happens directly after a user connects and authenticates to the SSL VPN portal?

A. The SSL VPN gateway establishes a TCP connection with the real target server and acts as a data relay between the two TCP sessions

B. A smart tunnel configuration downloads and executes the smart tunnel agent on the client system

C. The smart tunnel applet intercepts the TCP connection of the Lotus Sametime client to the real server and forwards the TCP connection to the existing SSL VPN session

D. The SSL VPN gateway extracts the TCP session from the SSL VPN session

Which option correctly defines the action that takes place when a DTLS-based VPN loses a packet?

A. The VPN endpoints will retransmit the dropped datagram.

B. The TCP stack of the application endpoints will retransmit the datagrams.

C. Both the VPN and the TCP stack of the application endpoint will retransmit the datagram.

D. The datagram is not retransmitted to reduce latency.

What limitations should you consider when using GRE tunneling? (Choose two)

A. There is no standard method to determine the end-to-end state of a GRE tunnel

B. Proprietary GRE keepalives are not supported

C. It provides limited cryptographic traffic protection

D. Tunnels can exhibit MTU and IP fragmentation-related issues

Which three statements regarding the FlexVPN Architecture are true? (Choose three)

A. It provides a modular framework.

B. It is a legacy technology.

C. It is backward compatible with IKEv1.

D. It provides a single configuration approach for all VPN types.

E. It provides features such as QoS.

Which set of commands will correctly configure the local authorization policy?

A. Router(config)#crypto ikev2 authorization policy policy1
Router(config-ikev2-author-policy)#pool flex-pool
Router(config-ikev2-author-policy)#def-domain brocadero.com
Router(config-ikev2-author-policy)#route set interface
Rout

B. Router(config-ikev2-profile)#virtual-template 1

C. Router(config)#crypto ipsec profile default
Router(ipsec-profile)#set ikev2-profile default

D. Router(config)#aaa new-model
Router(config)#aaa authorization network list1 local

Which statements best describe dynamic point-to-point VTI tunnels? (Choose two)

A. They simplify the configuration complexity of the VPN hub router

B. They are used to provision hubs in hub-and-spoke VPNs

C. It requires a static mapping of IPSec sessions to a physical interface

D. On the spoke, a dynamic VTI is used to provision its tunnel to the hub

Which statements best describe two-factor authentication? (Choose two)

A. It has a username prefill feature

B. ASA validates the certificate and then prompts for credentials

C. It is enabled in the Group Policy

D. You can combine machine certificate validation with user password authentication when using the username prefill feature

Which of the following are potential issues when troubleshooting FlexVPN spoke-to-spoke shortcut switching? (Choose two)

A. Unsupported tunnel encapsulation modes

B. Incorrect spoke authorization

C. Failure of virtual template and virtual access interfaces on the hub

D. Inconsistent or missing NHRP configuration

Which specific components of the secure posture module provide an OS scan? (Choose two)

A. Prelogin policies

B. Cache Cleaner

C. Prelogin assessment

D. Integration with Dynamic Access Policies

What steps are required to configure transmission protection? (Choose three)

A. Configure the IKE policy

B. Choose the transform set

C. Choose the VPN peer

D. Enable IKE for each interface

E. Choose traffic for the VPN

Which command would be used to verify the number of encrypted and decrypted packets?

A. show crypto ipsec sa

B. show ip route

C. show interface ipsec tunnel

D. show interface tunnel

You need to alter the effects of forwarding an HTTP applet proxy to the client. Which browser is required to complete this task?

A. Safari

B. Google Chrome

C. Microsoft Internet Explorer

D. Mozilla Firefox

When a clientless SSL VPN user successfully authenticates to the Cisco Adaptive Security Appliance, the user is presented with a web portal where they can access protected resources behind the Cisco ASA.
What types of applications can a user access by default? (Choose two)

A. File shares using CIFS and FTP

B. Internal web pages and web-based applications using HTTP and HTTPS

C. File shares using TFTP

D. Internal web pages and web-based applications using HTTP and NNTP

Which secure posture module component is a package that installs on the remote device after the user connects to the Cisco Adaptive Security Appliance and before the user logs in?

A. Integration with dynamic access policies

B. Prelogin assessment

C. Host scan

D. Prelogin policies

Which two set of commands will correctly configure EIGRP on the hub in a full mesh DMVPN network? (Choose two)

A. router(config)# router interface tunnel 0
router(config-if)# no ip split-horizon eigrp 1

B. router(config)# router eigrp 1
router(config-router)# no auto-summary

C. router(config)# router interface tunnel 0
router(config-if)# no ip next-hop-self eigrp
router(config-if)# no ip split-horizon eigrp 1

D. router(config)# router interface tunnel0
router(config-if)# no ip next-hop-self eigrp 1

E. router(config)# no auto-summary

What are the benefits of the clientless remote access SSL VPN architecture? (Choose two)

A. It requires a special-purpose desktop VPN client software

B. It supports all IP applications

C. It can traverse most firewalls and NAT devices

D. It uses the native SSL encryption of a web browser to provide data confidentiality

You are configuring basic Cisco AnyConnect SSL VPN on the Cisco ASA.
During which step in the process would you configure split tunneling?

A. Configuring identity NAT for client access

B. Enabling Cisco AnyConnect SSL VPN on ASA

C. Edit the default connection profile or create a custom one

D. Edit the default Group Policy or create a custom one

Which statements regarding the verification of DMVPN hub-and-spoke routing and IKE peering are true? (Choose two)

A. Multiple IKE sessions are established.

B. Routes are reachable over the spoke

C. A single IKE session is created.

D. Spokes are reachable over the hub.

Which three pieces of information are required for the client side of a challenge/response authentication using HMAC? (Choose three)

A. Hash function

B. Random number generator

C. Password

D. Challenge data

E. User DB

Which site-to-site technology combines IKE/IKEv2, AH, and ESP into a security framework?

A. DMVPN

B. IPSec

C. FlexVPN

D. GET VPN

Which IPSec encryption mode is the most secure?

A. Tunnel mode

B. Main mode

C. Aggressive mode

D. Transport mode

Which statements best describe dynamic access policies in Cisco clientless SSL VPNs? (Choose two)

A. They are available for remote access VPNs

B. They are manually generated by aggregating attributes from one or more DAP records

C. They are defined as a collection of access control attributes

D. They are generated and then applied to the user tunnel or session

Which statements best describe the NHRP client-server protocol? (Choose two)

A. It is designed to manage the transportation of multiprotocol and IP multicast traffic between two or more sites, which may only have IP connectivity

B. It creates a mapping for a tunnel IP address to the physical interface IP address for each spoke at the hub

C. It is typically used for simple point-to-point tunnels that emulate a point-to-point WAN link, or on spoke routers in hub-and-spoke VPNs

D. It is used by routers to determine the IP address of the next hop in IP tunneling networks

Which statements regarding the verification of DMVPN full-mesh routing and IKE peering are true? (Choose two)

A. Multiple IKE sessions are established.

B. Direct routes to other spokes exist from the spoke.

C. A single IKE session is created.

D. Spokes are reachable over the hub.

What information should you consider when monitoring AnyConnect SSL VPNs on the client? (Choose two)

A. Use the Details button to display additional information

B. Split tunneling routes show the subnets that are reachable through tunnel

C. You can select the appropriate access method in ASDM monitoring

D. The monitoring options are in the AnyConnect GUI

Which command can be used to disconnect all AnyConnect VPN clients using a web browser from the ASA?

A. vpnclient disconnect

B. vpn-session-timeout

C. vpn-sessiondb logoff svc

D. vpn-sessiondb logoff webvpn

The output below contains logging messages of unsuccessful IKE Phase 1. What is the cause of this problem?

A. Key configuration errors

B. Different DH groups

C. Wrong version of IKE

D. Unacceptable SA proposals

Which items could prevent the encrypted and decrypted packet counters from increasing? (Choose two)

A. Routing

B. IPSec SAs

C. Keepalives

D. Neighbor adjacencies

What is required to enable a Cisco AnyConnect IPSec IKEv2 VPN deployment? (Choose two)

A. On the Cisco ASA, configure IKEv2 as the primary protocol.

B. In the client profile, configure IKEv2 as the primary protocol.

C. Deploy the IKEv2-enabled profile to the endpoint computer.

D. Ensure DTLS is enabled on the Cisco ASA's interfaces on which the appliance accepts connections.

What common clientless SSL VPN issue involves troubleshooting by analyzing the integration with an external server such as Cisco Identity Services Engine?

A. A clientless SSL VPN is not enabled on the interface

B. Mismatch between one supported SSL cipher and another supported SSL cipher

C. Mismatch between client-side and server-side SSL ports

D. Authentication, when offloaded to external databases

Which statements best describe FlexVPN? (Choose two)

A. It is designed to provide interoperable, high-quality, and cryptographically based transmission security to IP traffic

B. It supports per-peer configurations of service parameters, such as QoS, firewall mechanisms, policies, and VRF-related settings

C. It offers a simple but modular framework that extensively uses the tunnel interface paradigm, while remaining compatible with legacy VPN implementations using crypto maps

D. It is used for performing mutual authentication and establishing and maintaining SAs

Which information is used to determine whether a tunnel negotiated via Phase 2 is operating?

A. Inbound ESP SA

B. IKE state

C. Encrypted and decrypted packets

D. Local and remote Crypto endpoints

Refer to the output. Which statements regarding the output are true? (Choose two)

Refer to the output. Which statements regarding the output are true?

A. IKE Phase 2 was successful.

B. IPSec SAs were successfully completed.

C. IKE proposals are mismatched.

D. Conflicting group and IP addresses exist.

Using an SSL VPN full-tunnel solution, you want to have the Cisco ASA assign IP addresses that will allow you to identify which users are connecting to the VPN.
Which IP address assignment solution should be implemented?

A. Configure the IP addresses as part of the user account in the local user database and enable per-user IP addresses.

B. Use a DHCP server that the Cisco ASA security appliance queries to obtain an IP address for remote clients.

C. Use an IP address pool that is configured on the Cisco ASA and assign the pool to a default or custom group policy.

D. Use an IP address pool that is configured on the Cisco ASA and assign the pool to a default or custom connection profile.

A tunnel is not forming between two spokes. Which of the following should you verify? (Choose two)

A. NHRP redirect is enabled on the hub

B. NHRP shortcut is enabled on the spoke

C. SA states on the hub and spoke

D. Connectivity between the hub and the spoke

Based on the output, what is the IP address of the local interface used to access the connected spoke network?

A. 192.0.10.1

B. 198.51.100.1

C. 203.0.133.1

D. 192.0.2.3

While calculating your results take a moment to complete our simple survey!

How likely is it that you would recommend LearnCisco.net
to a friend or colleague?

Why?

While calculating your results take a moment to complete our simple survey!

How likely is it that you would recommend LearnCisco.net to a friend or colleague?

Why?

How likely is it that you would recommend LearnCisco.net
to a friend or colleague?