CCNP Security Practice Test | Secure Mobility (SIMOS)

What would cause the req-failed field to be a number greater than zero on a spoke? (Choose two)

A. Matching network IDs

B. Next-hop server issue

C. SA keepalives failed

D. Authentication key mismatch

Refer to the output. Which statements regarding the output are true? (Choose two)

Refer to the output. Which statements regarding the output are true?

A. IKE Phase 2 was successful.

B. IPSec SAs were successfully completed.

C. IKE proposals are mismatched.

D. Conflicting group and IP addresses exist.

Which command was used to view the data presented in the output given below?

A. show crypto ipsec sa

B. show interfaces virtual-access

C. show crypto isakmp sa detail

D. show crypto ikev2 sa

Which command is used to verify that the certificate has successfully been imported and that ECDSA is used?

A. show crypto isakmp sa

B. show crypto ipsec sa

C. show crypto key

D. show crypto pki certificates verbose

You want to display NHRP next-hop server information. Which command should you use?

A. show dmvpn detail

B. show interface tunnel

C. show ip nhrp

D. show ip nhrp nhs detail

When configuring a DMVPN spoke, which tasks follow configuring an NHRP client in the mGRE interface? (Choose two)

A. Configure an IPSec profile with an optional transform set

B. Associate the IPSec profile with the mGRE interface

C. Generate or configure hub authentication credentials

D. Configure an IP address, and IP fragmentation and TCP segmentation parameters on the mGRE interface

A DMVPN cloud topology can support either a hub-and-spoke or a spoke-to-spoke deployment model. What are characteristics of the hub-and-spoke model? (Choose two)

A. It provides a scalable configuration model for all involved devices

B. It requires each branch to be configured with an mGRE interface in which dynamic spoke-to-spoke tunnels are used for the spoke-to-spoke traffic

C. It provides scalable configuration to the hub router

D. It requires each branch to be configured with a point-to-point GRE interface to the hub

Which three statements regarding the FlexVPN Architecture are true? (Choose three)

A. It provides a modular framework.

B. It is a legacy technology.

C. It is backward compatible with IKEv1.

D. It provides a single configuration approach for all VPN types.

E. It provides features such as QoS.

What should you keep in mind when using client authentication with an external CA? (Choose two)

A. The users must have the root certificate preinstalled in their browsers

B. The security appliance receives the root certificate of the external CA and enrolls with the CA to obtain its identity certificate

C. The enterprise can manage its own CA so users do not need to enroll with the CA to obtain their identity certificates

D. The entities use the self-signed root certificate to verify the authenticity of the peer certificate

You are troubleshooting a failed clientless SSL VPN session establishment. Which two utilities can be used to query the DNS server to troubleshoot issues why the browser cannot resolve the SSL VPN portal's URL? (Choose two)

A. arp

B. dig

C. traceroute

D. ping

E. nslookup

You are testing an application plugin for a clientless SSL VPN session; however, it will not start. What should be done?

A. Verify that the browser's Java/ActiveX functions.

B. Verify that the smart tunnel agent starts.

C. Verify that the appropriate plugins are loaded.

D. Verify webtype ACLs.

When enabling smart tunnels in the clientless SSL VPN access, what kind of information can you specify? (Choose three)

A. Bookmarks for the security appliance to display

B. Application list entries

C. Smart tunnel session log off method

D. Auto sign-on server list entries

E. Port forwarding list entries

What are the three main modules, from a design standpoint, where you would use VPN technologies? (Choose three)

A. Enterprise Branch Edge

B. WAN Edge

C. Enterprise Internet Edge

D. Campus Edge

E. Virtual User Edge

F. Enforce Edge

When implementing a basic Cisco AnyConnect SSL VPN solution, what is used to specify whether all IP traffic is protected?

A. Local address pool

B. Self-signed certificate

C. Split tunneling

D. Local user database

What are the features of DTLS? (Choose two)

A. It provides a low-latency data path using TCP

B. It is based on the stream-oriented TLS protocol

C. It is defined in RFC 4345

D. It mitigates latency and bandwidth problems that are associated with some SSL-only connections

Which troubleshooting command can be used to monitor an active view of AnyConnect client web browser SSL sessions?

A. debug webvpn util

B. debug webvpn html

C. debug webvpn url

D. debug webvpn svc

Which two set of commands will correctly configure EIGRP on the hub in a full mesh DMVPN network? (Choose two)

A. router(config)# router interface tunnel 0
router(config-if)# no ip split-horizon eigrp 1

B. router(config)# router eigrp 1
router(config-router)# no auto-summary

C. router(config)# router interface tunnel 0
router(config-if)# no ip next-hop-self eigrp
router(config-if)# no ip split-horizon eigrp 1

D. router(config)# router interface tunnel0
router(config-if)# no ip next-hop-self eigrp 1

E. router(config)# no auto-summary

You are creating an IKEv2 policy. Which command will ensure that a packet has not been modified during transit?

A. ASA(config-ikev2-policy)#integrity md5

B. ASA(config-ikev2-policy)#hash sha

C. ASA(config-ikev2-policy)#group 5

D. ASA(config-ikev2-policy)#encryption aes-256

Which application access method is available with Cisco clientless SSL VPNs and is recommended for Linux?

A. Port forwarding

B. Full-tunnel VPN

C. Smart tunnels

D. Application plugins

Which three statements are true regarding the use of DART to troubleshoot AnyConnect VPN? (Choose three)

A. It works independently of any installed AnyConnect client software.

B. It is available as a standalone installation.

C. It is integrated into the AnyConnect client package.

D. It requires administrator privileges.

E. It is only available for Windows clients.

You need to verify the operation of a GRE tunnel. Assuming a routing protocol is configured, what can you do to accomplish this task? (Choose two)

A. Ping the inner tunnel IP address of the remote peer.

B. Observe keepalive messages from logs.

C. Review neighbor adjacencies.

D. Review NHRP statistics

Which command can be used to prompt remote SSL VPN Client users to download the client and remain until the user responds?

A. svc ask enable default webvpn

B. svc ask enable default webvpn timeout value

C. svc ask enable

D. svc ask enable default svc timeout value

E. svc ask enable default svc

What is required when establishing a connection using AnyConnect in Standalone mode? (Choose two)

A. A browser using HTTPS

B. Permanent installation of AnyConnect on the client

C. ASA URL address

D. Username and password

Which feature enables users to use native client applications without administrative rights?

A. Smart tunnels

B. Clientless SSL VPN Plugins

C. Authentication using External CA

D. AAA

What is the first required step in configuring a DMVPN spoke?

A. Configure an IPSec profile with an optional transform set

B. Create an mGRE tunnel interface

C. Generate or configure hub authentication credentials

D. Associate the IPSec profile with the mGRE interface

When configuring router-to-ASA FlexVPN, what match statement rules should you keep in mind? (Choose two)

A. An IKEv2 policy can match multiple FVRF statements

B. An IKEv2 policy can have only one match address local statement

C. An IKEv2 policy can have only one match FVRF statement

D. There is no precedence between match statements of different types

The output below contains logging messages of unsuccessful IKE Phase 1. What is the cause of this problem?

A. Key configuration errors

B. Different DH groups

C. Wrong version of IKE

D. Unacceptable SA proposals

Which three statements are true regarding clientless SSL VPN solutions? (Choose three)

A. They do not require any special software.

B. They can be used to access CIFS file shares.

C. They can use IPSec VPN connections.

D. They provide browser-based access to resources.

E. They cannot access applications that use static TCP ports.

Which command can be used to verify that DTLS is being used as the transport protocol for a Cisco AnyConnect VPN?

A. show version

B. show traffic

C. show ssh sessions

D. show vpn-sessiondb

What should you consider when defining an IP address pool? (Choose two)

A. By default, no assignment methods are enabled

B. IP addresses that are assigned to the VPN clients will be used as the inner AnyConnect IP addresses

C. The virtual VPN adapter is created during the VPN establishment phase in addition to any physical adapters on the client endpoint

D. The inner IP address is applied to the virtual VPN adapter on the server

Which functions applied to cryptographic keys deal with Key Management? (Choose five)

A. Revocation

B. Composition

C. Destructions

D. Arrangement

E. Generation

F. Verification

G. Mutability

H. Exchange

Refer to the output. Which statements regarding the output are true? (Choose two)

Refer to the output. Which statements regarding the output are true?

A. SAs have been negotiated.

B. Packet compression is non-operational.

C. The tunnel is operational.

D. The SA has expired.

What are the three fields in an X.509v3 certificate? (Choose three)

A. Serial Number

B. Validity Period

C. Owner Full Name

D. Version

E. Usage Order

When configuring a site-to-site VPN using the Cisco Adaptive Security Device Manager, which two options will require you to manually enable IKE on the required interface? (Choose two)

A. Site-to-Site VPN |�Connection Profiles

B. Site-to-Site VPN Wizard

C. Site-to-Site VPN || Interface Profiles

D. Site-to-Site VPN || Advanced

Review the output. Which statement is true concerning the output?

A. The HostScan extension can be activated.

B. The HostScan extension cannot be activated.

C. HostScan should be enabled on a branch device, not on an HQ.

D. There is not enough information to determine whether the HostScan extension can be activated.

Which two modes identify the phase one ISAKMP operation modes? (Choose two)

A. SA mode

B. Main mode

C. Aggressive mode

D. Transport mode

All client traffic is utilizing the VPN tunnel. Clients accessing the Internet should have direct access to external data. What should be enabled?

A. AnyConnect SSL VPN

B. Identity NAT

C. SCEP

D. Split tunneling

Which statements best describe FlexVPN? (Choose two)

A. It is designed to provide interoperable, high-quality, and cryptographically based transmission security to IP traffic

B. It supports per-peer configurations of service parameters, such as QoS, firewall mechanisms, policies, and VRF-related settings

C. It offers a simple but modular framework that extensively uses the tunnel interface paradigm, while remaining compatible with legacy VPN implementations using crypto maps

D. It is used for performing mutual authentication and establishing and maintaining SAs

Which site-to-site technology combines IKE/IKEv2, AH, and ESP into a security framework?

A. DMVPN

B. IPSec

C. FlexVPN

D. GET VPN

How do nonrepudiation methods provide cryptographic proof of a transaction? (Choose three)

A. The signature can be generated only by the private key owner

B. The hashing algorithm secures the key

C. Digital signatures are used

D. The signature is stored by the receiver as a proof

When troubleshooting a connectivity issue, what information can be obtained using the Route Details tab of the Cisco AnyConnect Secure Mobility Client?

A. The tunneling protocol that is in use

B. User configured settings

C. The networks that are reachable through the tunnel

D. Errors that occurred during a connection attempt

Using an SSL VPN full-tunnel solution, you want to have the Cisco ASA assign IP addresses that will allow you to identify which users are connecting to the VPN.
Which IP address assignment solution should be implemented?

A. Configure the IP addresses as part of the user account in the local user database and enable per-user IP addresses.

B. Use a DHCP server that the Cisco ASA security appliance queries to obtain an IP address for remote clients.

C. Use an IP address pool that is configured on the Cisco ASA and assign the pool to a default or custom group policy.

D. Use an IP address pool that is configured on the Cisco ASA and assign the pool to a default or custom connection profile.

When an SSL client is authenticated, in addition to the server, which additional exchanges are required? (Choose two)

A. After the server sends its certificate to the client, the server will request that the client sends its certificate in return

B. The server sends a change cipher specification message that tells the client that all subsequent messages from the server will use the negotiated security

C. The client sends a change cipher specification message that tells the server to activate the negotiated cipher suite

D. After the client sends the client key exchange, the client sends a certificate verify message

What should you consider when configuring split tunneling in a Group Policy? (Choose two)

A. You can select the traffic that the clients will forward through the tunnel

B. By default, all traffic is forwarded through the tunnel using the exclude network list

C. It causes all the client traffic to go through the VPN tunnel

D. It permits the clients the direct access to external resources

How is external authorization in AnyConnect SSL VPNs monitored? (Choose two)

A. You can view the downloaded ACL in the ASDM or CLI

B. The Cisco ISE authorization policy selects an authorization profile

C. ISE uses a connection profile to authenticate a user against the ASA

D. The authorization profile is based on the cisco-av-pair=ip:acl attribute

Identify the features of TND. (Choose two)

A. It disconnects the tunnel if the user is in the trusted network

B. It is configured in the client profile

C. It can map and unmap network drives

D. It automatically starts user applications

Which statement is true regarding a Cisco ASA security appliance and IPSec?

A. AH is not supported.

B. IKEv2 is supported but IKEv1 is not supported.

C. ISAKMP is supported but IKE is not supported.

D. ESP is not supported.

Which command would be used to verify the number of encrypted and decrypted packets?

A. show crypto ipsec sa

B. show ip route

C. show interface ipsec tunnel

D. show interface tunnel

Which three characteristics are common amongst asymmetric algorithms? (Choose three)

A. Simpler key management

B. Key management can be an issue

C. Suitable for key exchange

D. Fast compared with symmetric algorithms

E. Suitable for real-time bulk encryption

F. Slow compared to symmetric algorithms

What should you keep in mind when verifying the SSL VPN portal configuration and training users on how to use it? (Choose two)

A. All users can use the URL entry control to select URLs for protocols that are imported plugins enabled

B. Plugins can be launched in a new browser window

C. Users should use the parent browser navigation controls and not the plugin's controls

D. All bookmarks are listed by default

The Cisco ASA uses a hierarchical policy inheritance model.
Which user policies would have the highest priority using this model?

A. Group Policy attached to the connection profile

B. User profile

C. DfltGrpPolicy settings

D. DAP rules

E. Group Policy attached to the user profile

Which step of configuring Cisco AnyConnect Start Before Logon involves making changes to the AnyConnect profile, and enabling the Cisco ASA to download the AnyConnect module for SBL?

A. Enabling the PLAP capability in Windows

B. Adding the SBL components to Windows

C. Logging in to Windows using SBL

D. Configuring SBL in the client profile

Review the output. Which type of VPN technology has been configured?

A. FlexVPN

B. DMVPN

C. IPSec VPN

D. GETVPN

When verifying and troubleshooting Cisco AnyConnect IPSec VPN, which tab of the AnyConnect Secure Mobility Client window allows you to confirm that the client has used IPSec/IKEv2 to connect by viewing the transport information?

A. Route Details

B. Firewall

C. Statistics

D. Message History

E. Preferences

While calculating your results take a moment to complete our simple survey!

How likely is it that you would recommend LearnCisco.net
to a friend or colleague?

Why?

While calculating your results take a moment to complete our simple survey!

How likely is it that you would recommend LearnCisco.net to a friend or colleague?

Why?

How likely is it that you would recommend LearnCisco.net
to a friend or colleague?