CCNP Security Practice Test | Secure Mobility (SIMOS)

Which statements regarding the verification of DMVPN full-mesh routing and IKE peering are true? (Choose two)

A. Multiple IKE sessions are established.

B. Direct routes to other spokes exist from the spoke.

C. A single IKE session is created.

D. Spokes are reachable over the hub.

You need to implement NGE. Which options would be viable? (Choose three)

A. HMAC-MD5

B. AES-CBC

C. SHA-256

D. ECDH-384

E. AES-GCM

What are the characteristics of split tunneling on Cisco AnyConnect SSL VPN clients? (Choose two)

A. It uses access control for nontunneled destinations

B. It allows some traffic to bypass the tunnel

C. It increases performance

D. It allows all the traffic to bypass the VPN tunnel

What are the two aspects of effectively managing the VPN users and their access privileges in any remote access VPN design? (Choose two)

A. Authentication is achieved by using a user's organization group information and other attributes, such as endpoint security posture and time of day

B. A scalable and secure solution to authenticate users

C. Assignments allow an SSL VPN gateway to assign the user to a policy group

D. Decisions on what access privilege to grant to the users based on various user and security attributes

Which FlexVPN configuration block specifies an acceptable combination of security protocols and algorithms for the IPSec SA?

A. IKEv2 keyring

B. IPSec transform set

C. IPSec profile

D. IKEv2 proposal

When enabling smart tunnels in the clientless SSL VPN access, what kind of information can you specify? (Choose three)

A. Bookmarks for the security appliance to display

B. Application list entries

C. Smart tunnel session log off method

D. Auto sign-on server list entries

E. Port forwarding list entries

When troubleshooting a FlexVPN spoke configuration, which command is used to verify whether both spokes have a virtual-access interface present?

A. show ip nhrp traffic

B. show ip nhrp

C. show ip interface brief

D. show crypto session

What is the first required step in configuring a DMVPN spoke?

A. Configure an IPSec profile with an optional transform set

B. Create an mGRE tunnel interface

C. Generate or configure hub authentication credentials

D. Associate the IPSec profile with the mGRE interface

Review the output. Which type of VPN technology has been configured?

A. FlexVPN

B. DMVPN

C. IPSec VPN

D. GETVPN

During which phase of the SSL/TLS session establishment and key management does data transfer begin?

A. Phase 2: server certificate and key exchange

B. Phase 3: client certificate (if required) and key exchange

C. Phase 4: finish

D. Phase 1: establish client-server security capabilities

What are the benefits of the clientless remote access SSL VPN architecture? (Choose two)

A. It requires a special-purpose desktop VPN client software

B. It supports all IP applications

C. It can traverse most firewalls and NAT devices

D. It uses the native SSL encryption of a web browser to provide data confidentiality

You are configuring split tunneling on the Cisco ASA device via the CLI. You have created an access list named "STACL". Enter the command to specify this access list to be used for split tunneling.

Which statements regarding the use of parallel DTLS and TLS tunnels are true? (Choose two)

A. The SSL tunnel is used to negotiate and establish the DTLS tunnel.

B. The DTLS tunnel is used to negotiate and establish the SSL/TLS tunnel.

C. Enabling DPD allows for DTLS-to-TLS automatic fallback.

D. DTLS-to-TLS automatic fallback requires IKEv2.

What information should you consider when monitoring AnyConnect SSL VPNs on the client? (Choose two)

A. Use the Details button to display additional information

B. Split tunneling routes show the subnets that are reachable through tunnel

C. You can select the appropriate access method in ASDM monitoring

D. The monitoring options are in the AnyConnect GUI

You want to display NHRP next-hop server information. Which command should you use?

A. show dmvpn detail

B. show interface tunnel

C. show ip nhrp

D. show ip nhrp nhs detail

Which statements best describe dynamic access policies in Cisco clientless SSL VPNs? (Choose two)

A. They are available for remote access VPNs

B. They are manually generated by aggregating attributes from one or more DAP records

C. They are defined as a collection of access control attributes

D. They are generated and then applied to the user tunnel or session

Based on the output, what is the IP address of the local interface used to access the connected spoke network?

A. 192.0.10.1

B. 198.51.100.1

C. 203.0.133.1

D. 192.0.2.3

What is the role of the responder in IKEv2 DoS prevention? (Choose two)

A. Limiting the resources that it is willing to devote to new connections

B. Consuming CPU resources by doing the cryptography

C. Allocating no memory until the initiator has proven that it can receive messages at the address that it claims to be sending from

D. Consuming memory resources by remembering the state of the "half open" connections until they time out

Before deploying a basic site-to-site VPN, what information should you have? (Choose three)

A. ISAKMP policy

B. Transmission protection

C. Transform set

D. PSK

E. Basic peer authentication

When configuring a site-to-site VPN using the Cisco Adaptive Security Device Manager, which two options will require you to manually enable IKE on the required interface? (Choose two)

A. Site-to-Site VPN |�Connection Profiles

B. Site-to-Site VPN Wizard

C. Site-to-Site VPN || Interface Profiles

D. Site-to-Site VPN || Advanced

A user indicates that they are unable to access a file server share. You believe that you have misconfigured webtype ACLs.
What is the easiest method of verifying this?

A. View the Cisco ASA's logging output.

B. View predefined bookmarks.

C. View output from the traceroute command.

D. View DNS group configuration.

Which of the protocols transmit data in plaintext and are susceptible to man-in-the-middle attacks? (Choose three)

A. Telnet

B. HTTP

C. HTTPS

D. FTP

What is ESP encapsulation designed to provide? (Choose four)

A. Confidentiality

B. Authenticity

C. Overhead

D. Payload

E. Anti replay

F. Integrity

Which Cisco IOS FlexVPN benefit provides three different models to implement it?

A. Failover redundancy

B. IP Multicast support

C. Transport network

D. Third-party compatibility

Which statements best describe the NHRP client-server protocol? (Choose two)

A. It is designed to manage the transportation of multiprotocol and IP multicast traffic between two or more sites, which may only have IP connectivity

B. It creates a mapping for a tunnel IP address to the physical interface IP address for each spoke at the hub

C. It is typically used for simple point-to-point tunnels that emulate a point-to-point WAN link, or on spoke routers in hub-and-spoke VPNs

D. It is used by routers to determine the IP address of the next hop in IP tunneling networks

Which attribute would you use to apply an ACE to a user session?

A. cisco-av-pair=ip:inacl

B. cisco-av-pair=inacl:ip

C. cisco-av-pair=inacl:webvpn

D. cisco-av-pair=webvpn:inacl

When configuring router-to-ASA FlexVPN, what match statement rules should you keep in mind? (Choose two)

A. An IKEv2 policy can match multiple FVRF statements

B. An IKEv2 policy can have only one match address local statement

C. An IKEv2 policy can have only one match FVRF statement

D. There is no precedence between match statements of different types

When a clientless SSL VPN user successfully authenticates to the Cisco Adaptive Security Appliance, the user is presented with a web portal where they can access protected resources behind the Cisco ASA.
What types of applications can a user access by default? (Choose two)

A. File shares using CIFS and FTP

B. Internal web pages and web-based applications using HTTP and HTTPS

C. File shares using TFTP

D. Internal web pages and web-based applications using HTTP and NNTP

When using double or triple authentication for Cisco AnyConnect SSL VPN users, what combinations are possible? (Choose three)

A. RSA/SDI + LDAP authentication

B. LDAP authentication + RADIUS

C. RSA/SDI + RADIUS

D. Certificates + RADIUS + RSA/SDI

E. Certificates + RADIUS

What are the features of DTLS? (Choose two)

A. It provides a low-latency data path using TCP

B. It is based on the stream-oriented TLS protocol

C. It is defined in RFC 4345

D. It mitigates latency and bandwidth problems that are associated with some SSL-only connections

Which three statements are true regarding the use of DART to troubleshoot AnyConnect VPN? (Choose three)

A. It works independently of any installed AnyConnect client software.

B. It is available as a standalone installation.

C. It is integrated into the AnyConnect client package.

D. It requires administrator privileges.

E. It is only available for Windows clients.

When troubleshooting a connectivity issue, what information can be obtained using the Route Details tab of the Cisco AnyConnect Secure Mobility Client?

A. The tunneling protocol that is in use

B. User configured settings

C. The networks that are reachable through the tunnel

D. Errors that occurred during a connection attempt

Refer to the output. To what is this message referring?

A. Mismatched IKE proposals

B. Mismatched IKE versions

C. Key configuration errors

D. Conflicting peer addresses

What should you keep in mind when using client authentication with an external CA? (Choose two)

A. The users must have the root certificate preinstalled in their browsers

B. The security appliance receives the root certificate of the external CA and enrolls with the CA to obtain its identity certificate

C. The enterprise can manage its own CA so users do not need to enroll with the CA to obtain their identity certificates

D. The entities use the self-signed root certificate to verify the authenticity of the peer certificate

In a basic IKEv2 message exchange, with only the minimal four messages, which messages represent the IKE_SA_INIT phase and exchange IKEv2 proposals and key material information? (Choose two)

A. Third message

B. Fourth message

C. First message

D. Second message

Which two modes identify the phase one ISAKMP operation modes? (Choose two)

A. SA mode

B. Main mode

C. Aggressive mode

D. Transport mode

The output below contains logging messages of unsuccessful IKE Phase 1. What is the cause of this problem?

A. Key configuration errors

B. Different DH groups

C. Wrong version of IKE

D. Unacceptable SA proposals

What are the three VPN connection technologies? (Choose three)

A. Full-tunnel client-based IPSec VPN

B. Clientless SSL VPN

C. Full-tunnel clientless LTO VPN

D. Full-tunnel client-based SSL VPN

Which statements best describe the handshake phase of SSL connections? (Choose two)

A. SSL encrypts the data traffic and ensures data confidentiality and integrity

B. It typically uses RSA as the public key algorithm

C. It ensures authentication of the server and, optionally, of the client

D. Data integrity is achieved using message digest algorithms such as MD5 and SHA-1

Identify the multiple client-side authentication options in clientless SSL VPN. (Choose three)

A. Certificate-based and one AAA authentication

B. Double AAA authentication (no certificate) with optional username reuse

C. Double AAA authentication (with certificate) with optional username reuse

D. Certificate-based and two AAA authentication

E. Certificate-based and one AAA authentication, where the username for AAA authentication can be extracted from the certificate subject field and hidden from users

Which application access method is available with Cisco clientless SSL VPNs and is recommended for Linux?

A. Port forwarding

B. Full-tunnel VPN

C. Smart tunnels

D. Application plugins

Refer to the output. Which statements regarding the output are true? (Choose two)

Refer to the output. Which statements regarding the output are true?

A. IKE Phase 2 was successful.

B. IPSec SAs were successfully completed.

C. IKE proposals are mismatched.

D. Conflicting group and IP addresses exist.

What improvements does IKEv2 provide to IKEv1? (Choose three)

A. Supports dynamically addressed peers with PKI-facilitated authentication

B. Built-in DPD

C. Supports PFS to ensure that a given IPSec SA key is not derived from another secret

D. Better rekeying and collision handling

E. Requires fewer round trips

You are configuring DMVPN on a spoke router. The configurations in the output given below have been made on the router.
Which command or set of commands will complete the next step in the configuration on the spoke router?

You are configuring DMVPN on a spoke router. The configurations in the output given below have been made on the router.<br />Which command or set of commands will complete the next step in the configuration on the spoke router?

A. Router1(config-if)#tunnel protection ipsec profile MYIPSECPROFILE

B. Router1(config-if)#ip nhrp network-id 1
Router1(config-if)#ip nhrp authentication HdRtKqX5ZdYaZQjSYPqb
Router1(config-if)#ip nhrp nhs 10.1.1.1
Router1(config-if)#ip nhrp map multicast 172.17.0.1
Router1(config-if)#ip nhrp map

C. Router1(config)#interface Tunnel 0
Router1(config-if)#tunnel mode gre multipoint
Router1(config-if)#tunnel source GigabitEthernet0/0
Router1(config-if)#tunnel key 12345

D. Router1(config-if)#ip address 10.1.1.2 255.255.0.0
Router1(config-if)#ip mtu 1400

How is external authorization in AnyConnect SSL VPNs monitored? (Choose two)

A. You can view the downloaded ACL in the ASDM or CLI

B. The Cisco ISE authorization policy selects an authorization profile

C. ISE uses a connection profile to authenticate a user against the ASA

D. The authorization profile is based on the cisco-av-pair=ip:acl attribute

When using clientless SSL VPNs, why might the client fail to authenticate to the server? (Choose two)

A. The client time falls outside the validity range of the server certificate

B. The subject FQDN in the server certificate is different from the FQDN in the VPN URL

C. The root CA certificate and the VPN server certificate are in the respective certificate stores

D. The SSL VPN is enabled on an appropriate VPN server interface and uses the same TCP port that the clients access

You have configured Cisco ASA to allow users to choose a connection profile when connecting to the full-tunnel IKEv2 VPN.
What will occur if the user does not select a connection profile?

A. Users will not be authenticated.

B. Users are assigned to the DefaultRAGroup connection profile.

C. Users are assigned to the DefaultWEBVPNGroup connection profile.

D. Users are assigned to the DefaultL2LGroup connection profile.

Which statements best describe dynamic point-to-point VTI tunnels? (Choose two)

A. They simplify the configuration complexity of the VPN hub router

B. They are used to provision hubs in hub-and-spoke VPNs

C. It requires a static mapping of IPSec sessions to a physical interface

D. On the spoke, a dynamic VTI is used to provision its tunnel to the hub

Which statements best describe FlexVPN? (Choose two)

A. It is designed to provide interoperable, high-quality, and cryptographically based transmission security to IP traffic

B. It supports per-peer configurations of service parameters, such as QoS, firewall mechanisms, policies, and VRF-related settings

C. It offers a simple but modular framework that extensively uses the tunnel interface paradigm, while remaining compatible with legacy VPN implementations using crypto maps

D. It is used for performing mutual authentication and establishing and maintaining SAs

Which two site-to-site VPN technologies natively support IP Multicasts? (Choose two)

A. IPSec VPN

B. DMVPN

C. FlexVPN

D. GETVPN

Which command was used to view the data presented in the output given below?

A. show crypto ipsec sa

B. show interfaces virtual-access

C. show crypto isakmp sa detail

D. show crypto ikev2 sa

What should you consider when defining an IP address pool? (Choose two)

A. By default, no assignment methods are enabled

B. IP addresses that are assigned to the VPN clients will be used as the inner AnyConnect IP addresses

C. The virtual VPN adapter is created during the VPN establishment phase in addition to any physical adapters on the client endpoint

D. The inner IP address is applied to the virtual VPN adapter on the server

While calculating your results take a moment to complete our simple survey!

How likely is it that you would recommend LearnCisco.net
to a friend or colleague?

Why?

While calculating your results take a moment to complete our simple survey!

How likely is it that you would recommend LearnCisco.net to a friend or colleague?

Why?

How likely is it that you would recommend LearnCisco.net
to a friend or colleague?