CCNP Security Practice Test | Secure Mobility (SIMOS)

What is required to enable a Cisco AnyConnect IPSec IKEv2 VPN deployment? (Choose two)

A. On the Cisco ASA, configure IKEv2 as the primary protocol.

B. In the client profile, configure IKEv2 as the primary protocol.

C. Deploy the IKEv2-enabled profile to the endpoint computer.

D. Ensure DTLS is enabled on the Cisco ASA's interfaces on which the appliance accepts connections.

Which of the protocols transmit data in plaintext and are susceptible to man-in-the-middle attacks? (Choose three)

A. Telnet

B. HTTP

C. HTTPS

D. FTP

What steps are required to configure transmission protection? (Choose three)

A. Configure the IKE policy

B. Choose the transform set

C. Choose the VPN peer

D. Enable IKE for each interface

E. Choose traffic for the VPN

Which statements best describe two-factor authentication? (Choose two)

A. It has a username prefill feature

B. ASA validates the certificate and then prompts for credentials

C. It is enabled in the Group Policy

D. You can combine machine certificate validation with user password authentication when using the username prefill feature

When configuring local VPN authorization, how can you configure the Group Policy with the required restrictions? (Choose two)

A. Define separate Group Policies for clientless and full tunnel users

B. Define one Group Policy for a set of users with similar privileges

C. Define one Group Policy for clientless and full tunnel users

D. Define separate Group Policies for a set of users with similar privileges

Which secure posture module component is a package that installs on the remote device after the user connects to the Cisco Adaptive Security Appliance and before the user logs in?

A. Integration with dynamic access policies

B. Prelogin assessment

C. Host scan

D. Prelogin policies

Which command is used to verify NHRP mapping information on a DMVPN?

A. show dmvpn detail

B. show ip route

C. show ip nhrp nhs detail

D. show ip nhrp

E. show interface tunnel

Which command is used to verify that the certificate has successfully been imported and that ECDSA is used?

A. show crypto isakmp sa

B. show crypto ipsec sa

C. show crypto key

D. show crypto pki certificates verbose

Which two site-to-site VPN technologies natively support IP Multicasts? (Choose two)

A. IPSec VPN

B. DMVPN

C. FlexVPN

D. GETVPN

What are the characteristics of symmetric algorithms? (Choose three)

A. Efficient, fast, and simple to accelerate in hardware

B. Typical key lengths are in thousands of bits

C. Examples are RSA and ECC

D. Suitable for real-time bulk encryption

E. Generally used for digital signatures or key exchanges

F. Examples are 3DES, RC4, SEAL, AES, and Blowfish

Your company is planning to implement HostScan to provide high availability. Clients run MAC OS X operating systems. What would prevent you from being able to use HostScan?

A. Only Windows operating systems are supported

B. Only Linux operating systems are supported

C. Expired digital certificates

D. Incorrect licensing

Which steps are required to configure basic peer authentication for point-to-point tunnels on the Cisco ASA? (Choose three)

A. Choose the transform set and VPN peer

B. Enable IKEv1, IKEv2, or both on an interface

C. Choose traffic for the VPN

D. Configure PSKs

E. Configure IKE policy

Which feature enables users to use native client applications without administrative rights?

A. Smart tunnels

B. Clientless SSL VPN Plugins

C. Authentication using External CA

D. AAA

You are configuring Cisco SSL VPN plugins. Once you have imported the plugins to the Cisco Adaptive Security Appliance.
What further actions can you take? (Choose two)

A. If you are using bookmarks, you can add protocols

B. You can confirm them in the SSL VPN portal

C. You can apply the bookmarks list using the import webvpn url-list command

D. You need to authorize plugin use in group policies

What should you keep in mind when using client authentication with an external CA? (Choose two)

A. The users must have the root certificate preinstalled in their browsers

B. The security appliance receives the root certificate of the external CA and enrolls with the CA to obtain its identity certificate

C. The enterprise can manage its own CA so users do not need to enroll with the CA to obtain their identity certificates

D. The entities use the self-signed root certificate to verify the authenticity of the peer certificate

Which specific components of the secure posture module provide an OS scan? (Choose two)

A. Prelogin policies

B. Cache Cleaner

C. Prelogin assessment

D. Integration with Dynamic Access Policies

Refer to the output. Which statements regarding the output are true? (Choose two)

Refer to the output. Which statements regarding the output are true?

A. SAs have been negotiated.

B. Packet compression is non-operational.

C. The tunnel is operational.

D. The SA has expired.

Which Cisco ASA application plugin allows for connections to WinFrame-based terminal services?

A. SSH

B. RDP2

C. VNC

D. ICA

E. RDP

You need to verify the operation of a GRE tunnel. Assuming a routing protocol is configured, what can you do to accomplish this task? (Choose two)

A. Ping the inner tunnel IP address of the remote peer.

B. Observe keepalive messages from logs.

C. Review neighbor adjacencies.

D. Review NHRP statistics

You are configuring basic Cisco AnyConnect SSL VPN on the Cisco ASA.
During which step in the process would you configure split tunneling?

A. Configuring identity NAT for client access

B. Enabling Cisco AnyConnect SSL VPN on ASA

C. Edit the default connection profile or create a custom one

D. Edit the default Group Policy or create a custom one

How are clientless password-based users handled in SSL VPN authentication? (Choose two)

A. It is mandatory to use AAA authentication

B. If no profile is chosen, the Cisco ASA will assign them to the DefaultWEBVPNGroup connection profile

C. If no profile is chosen, the Cisco ASA will assign them to the DefaultRAGroup connection profile

D. They may be permitted to select a connection profile from the selection menu or group URL

Which step of configuring Cisco AnyConnect Start Before Logon involves making changes to the AnyConnect profile, and enabling the Cisco ASA to download the AnyConnect module for SBL?

A. Enabling the PLAP capability in Windows

B. Adding the SBL components to Windows

C. Logging in to Windows using SBL

D. Configuring SBL in the client profile

Which component encrypts and decrypts the traffic in a GET VPN deployment?

A. Group Member

B. Group Domain of Interpretation

C. Perfect Forward Secrecy

D. Key Server

When troubleshooting a connectivity issue, what can be used to verify that a Cisco AnyConnect connection is using IPSec/IKEv2?

A. IP Source Guard

B. Botnet Traffic Filter

C. HTTP Inspector

D. Cisco AnyConnect Secure Mobility Client Statistics tab

What improvements does IKEv2 provide to IKEv1? (Choose three)

A. Supports dynamically addressed peers with PKI-facilitated authentication

B. Built-in DPD

C. Supports PFS to ensure that a given IPSec SA key is not derived from another secret

D. Better rekeying and collision handling

E. Requires fewer round trips

When configuring an IPSec profile to support IKEv2 and Cisco AnyConnect, what should you do immediately after enabling IKEv2 on the outside interface, choosing an interface certificate, and enabling Client Services?

A. Create an IKEv2 group

B. Connect and update the client profile

C. Create and edit a Cisco AnyConnect connection profile

D. Create and edit a client connection profile

Using an SSL VPN full-tunnel solution, you want to have the Cisco ASA assign IP addresses that will allow you to identify which users are connecting to the VPN.
Which IP address assignment solution should be implemented?

A. Configure the IP addresses as part of the user account in the local user database and enable per-user IP addresses.

B. Use a DHCP server that the Cisco ASA security appliance queries to obtain an IP address for remote clients.

C. Use an IP address pool that is configured on the Cisco ASA and assign the pool to a default or custom group policy.

D. Use an IP address pool that is configured on the Cisco ASA and assign the pool to a default or custom connection profile.

Which tasks are the client generally responsible for in the SSL server authentication? (Choose three)

A. Sending a hello message informing of the preferred cipher suite

B. Sending a hello done message

C. Verifying the certificate to ensure it has been issued by a trusted CA

D. Generating random numbers to use as a shared session key

E. Starting the exchange by sending the client a hello message

Review the output. Which type of VPN technology is being verified?

A. IPSec SA

B. NHRP next-hop server information

C. EC key pairs

D. Clientless SSL VPN

When implementing a basic Cisco AnyConnect SSL VPN solution, what is used to specify whether all IP traffic is protected?

A. Local address pool

B. Self-signed certificate

C. Split tunneling

D. Local user database

You are troubleshooting a failed clientless SSL VPN session establishment. Which two utilities can be used to query the DNS server to troubleshoot issues why the browser cannot resolve the SSL VPN portal's URL? (Choose two)

A. arp

B. dig

C. traceroute

D. ping

E. nslookup

You are testing an application plugin for a clientless SSL VPN session; however, it will not start. What should be done?

A. Verify that the browser's Java/ActiveX functions.

B. Verify that the smart tunnel agent starts.

C. Verify that the appropriate plugins are loaded.

D. Verify webtype ACLs.

Which statement is true regarding a Cisco ASA security appliance and IPSec?

A. AH is not supported.

B. IKEv2 is supported but IKEv1 is not supported.

C. ISAKMP is supported but IKE is not supported.

D. ESP is not supported.

Which command is used to merge site-to-site IKEv1 with IKEv2 configuration?

A. migrate remote-access ikev2

B. crypto ikev2 remote-access trust-point

C. migrate remote-access ikev2 overwrite

D. migrate l2l ikev2

When verifying and troubleshooting Cisco AnyConnect IPSec VPN, which tab of the AnyConnect Secure Mobility Client window allows you to confirm that the client has used IPSec/IKEv2 to connect by viewing the transport information?

A. Route Details

B. Firewall

C. Statistics

D. Message History

E. Preferences

Which two VPN types are preferred for larger environments that are partially meshed? (Choose two)

A. Dynamic VTI-based

B. GET VPN

C. DMVPN

D. Static VTI-based

The output below contains logging messages of unsuccessful IKE Phase 1. What is the cause of this problem?

A. Key configuration errors

B. Different DH groups

C. Wrong version of IKE

D. Unacceptable SA proposals

When configuring router-to-ASA FlexVPN, what match statement rules should you keep in mind? (Choose two)

A. An IKEv2 policy can match multiple FVRF statements

B. An IKEv2 policy can have only one match address local statement

C. An IKEv2 policy can have only one match FVRF statement

D. There is no precedence between match statements of different types

What would cause the req-failed field to be a number greater than zero on a spoke? (Choose two)

A. Matching network IDs

B. Next-hop server issue

C. SA keepalives failed

D. Authentication key mismatch

A user indicates that they are unable to access a file server share. You believe that you have misconfigured webtype ACLs.
What is the easiest method of verifying this?

A. View the Cisco ASA's logging output.

B. View predefined bookmarks.

C. View output from the traceroute command.

D. View DNS group configuration.

Review the output. Which statement is true concerning the output?

A. The HostScan extension can be activated.

B. The HostScan extension cannot be activated.

C. HostScan should be enabled on a branch device, not on an HQ.

D. There is not enough information to determine whether the HostScan extension can be activated.

Before deploying a basic site-to-site VPN, what information should you have? (Choose three)

A. ISAKMP policy

B. Transmission protection

C. Transform set

D. PSK

E. Basic peer authentication

How is external authorization in AnyConnect SSL VPNs monitored? (Choose two)

A. You can view the downloaded ACL in the ASDM or CLI

B. The Cisco ISE authorization policy selects an authorization profile

C. ISE uses a connection profile to authenticate a user against the ASA

D. The authorization profile is based on the cisco-av-pair=ip:acl attribute

Which statements best describe shortcut switching? (Choose two)

A. DMVPN provides a scalable configuration model for all involved devices

B. Each spoke router must be configured with a point-to-point interface to the hub

C. All traffic between spoke networks must flow through the hub router

D. Each branch must be configured with a tunnel interface in which dynamic Spoke-to-Spoke tunnels are used for the spoke-to-spoke traffic

Which FlexVPN configuration block specifies an acceptable combination of security protocols and algorithms for the IPSec SA?

A. IKEv2 keyring

B. IPSec transform set

C. IPSec profile

D. IKEv2 proposal

What should you keep in mind in a configuration scenario that uses the local CA function on the Cisco ASA CA user accounts? (Choose two)

A. A certificate-to-connection profile map that binds the user certificate to a connection profile must exist

B. The FQDN includes information like the organizational unit

C. Certificate-based authentication in the required connection profiles is enabled by default

D. Organizational units contain values that are frequently mapped in identity certificates

What common clientless SSL VPN issue involves troubleshooting by analyzing the integration with an external server such as Cisco Identity Services Engine?

A. A clientless SSL VPN is not enabled on the interface

B. Mismatch between one supported SSL cipher and another supported SSL cipher

C. Mismatch between client-side and server-side SSL ports

D. Authentication, when offloaded to external databases

What are the three VPN connection technologies? (Choose three)

A. Full-tunnel client-based IPSec VPN

B. Clientless SSL VPN

C. Full-tunnel clientless LTO VPN

D. Full-tunnel client-based SSL VPN

Which of the three tools are used with a VPN to combat man-in-the-middle attacks? (Choose three)

A. Packet integrity checking

B. Encryption

C. Device authentication

D. Sequence number randomizing

You are configuring split tunneling on the Cisco ASA device via the CLI. You have created an access list named "STACL". Enter the command to specify this access list to be used for split tunneling.

All client traffic is utilizing the VPN tunnel. Clients accessing the Internet should have direct access to external data. What should be enabled?

A. AnyConnect SSL VPN

B. Identity NAT

C. SCEP

D. Split tunneling

What should you consider when defining an IP address pool? (Choose two)

A. By default, no assignment methods are enabled

B. IP addresses that are assigned to the VPN clients will be used as the inner AnyConnect IP addresses

C. The virtual VPN adapter is created during the VPN establishment phase in addition to any physical adapters on the client endpoint

D. The inner IP address is applied to the virtual VPN adapter on the server

Which two statements regarding the version of IKE used with FlexVPN are true? (Choose two)

A. It uses stateless cookies.

B. It can only be used with IPSec.

C. It operates over UDP port 4500.

D. It supports NAT traversal over UDP port 500.

E. Each peer maintains its own local policy.

Which statements best describe FlexVPN? (Choose two)

A. It is designed to provide interoperable, high-quality, and cryptographically based transmission security to IP traffic

B. It supports per-peer configurations of service parameters, such as QoS, firewall mechanisms, policies, and VRF-related settings

C. It offers a simple but modular framework that extensively uses the tunnel interface paradigm, while remaining compatible with legacy VPN implementations using crypto maps

D. It is used for performing mutual authentication and establishing and maintaining SAs

While calculating your results take a moment to complete our simple survey!

How likely is it that you would recommend LearnCisco.net
to a friend or colleague?

Why?

While calculating your results take a moment to complete our simple survey!

How likely is it that you would recommend LearnCisco.net to a friend or colleague?

Why?

How likely is it that you would recommend LearnCisco.net
to a friend or colleague?