CCNP Security Practice Test | Secure Mobility (SIMOS)

What steps are required to configure transmission protection? (Choose three)

A. Configure the IKE policy

B. Choose the transform set

C. Choose the VPN peer

D. Enable IKE for each interface

E. Choose traffic for the VPN

What are the descriptions that can be applied to a digital signature? (Choose two)

A. Digital signature algorithms provide integrity

B. They use a combination of a hash function and an asymmetric algorithm

C. They are a combination of an HMAC algorithm and a symmetric function

D. They use a public signing key and a private shared key

Identify the multiple client-side authentication options in clientless SSL VPN. (Choose three)

A. Certificate-based and one AAA authentication

B. Double AAA authentication (no certificate) with optional username reuse

C. Double AAA authentication (with certificate) with optional username reuse

D. Certificate-based and two AAA authentication

E. Certificate-based and one AAA authentication, where the username for AAA authentication can be extracted from the certificate subject field and hidden from users

Which commands can be used to restore the original IKEv2 Smart Defaults values? (Choose two)

A. default crypto ipsec transform-set

B. default crypto ikev2 proposal

C. no crypto ipsec transform-set default

D. no crypto ikev2 proposal default

The Cisco ASA requires a server identity certificate, which the appliance sends to remote SSL VPN clients in order for remote clients to authenticate the Cisco ASA. By default, the security appliance will create a self-signed X.509 certificate on each reboot, resulting in many client warnings when attempting SSL VPN access, as the certificate cannot be verified by any means.
How can you address this issue? (Choose two)

A. By creating a permanent self-signed certificate that is persistent across reboots, by having the remote users initially accessing the Cisco ASA over a trusted network, and by saving the identity certificate of the Cisco ASA.

B. By enrolling your Cisco ASA with an internal CA. Your clients can obtain the root certificate of the CA from this internal CA and then authenticate the identity of the certificate that is installed on the Cisco ASA.

C. By creating a permanent self-signed certificate that is persistent across reboots, and which you can save on the client, if the remote users have the option of initially accessing the Cisco ASA over a trusted network and saving the identity certificate of

D. By enrolling your Cisco ASA with an external CA. Your clients can obtain the root certificate of the CA from this external CA and then authenticate the identity of the certificate that is installed on the Cisco ASA.

When a clientless SSL VPN user successfully authenticates to the Cisco Adaptive Security Appliance, the user is presented with a web portal where they can access protected resources behind the Cisco ASA.
What types of applications can a user access by default? (Choose two)

A. File shares using CIFS and FTP

B. Internal web pages and web-based applications using HTTP and HTTPS

C. File shares using TFTP

D. Internal web pages and web-based applications using HTTP and NNTP

A tunnel is not forming between two spokes. Which of the following should you verify? (Choose two)

A. NHRP redirect is enabled on the hub

B. NHRP shortcut is enabled on the spoke

C. SA states on the hub and spoke

D. Connectivity between the hub and the spoke

Which FlexVPN configuration block specifies an acceptable combination of security protocols and algorithms for the IPSec SA?

A. IKEv2 keyring

B. IPSec transform set

C. IPSec profile

D. IKEv2 proposal

Which command can be used to prompt remote SSL VPN Client users to download the client and remain until the user responds?

A. svc ask enable default webvpn

B. svc ask enable default webvpn timeout value

C. svc ask enable

D. svc ask enable default svc timeout value

E. svc ask enable default svc

Which statements regarding the verification of DMVPN hub-and-spoke routing and IKE peering are true? (Choose two)

A. Multiple IKE sessions are established.

B. Routes are reachable over the spoke

C. A single IKE session is created.

D. Spokes are reachable over the hub.

Which specific components of the secure posture module provide an OS scan? (Choose two)

A. Prelogin policies

B. Cache Cleaner

C. Prelogin assessment

D. Integration with Dynamic Access Policies

Which statements regarding the verification of DMVPN full-mesh routing and IKE peering are true? (Choose two)

A. Multiple IKE sessions are established.

B. Direct routes to other spokes exist from the spoke.

C. A single IKE session is created.

D. Spokes are reachable over the hub.

A user indicates that they are unable to access a file server share. You believe that you have misconfigured webtype ACLs.
What is the easiest method of verifying this?

A. View the Cisco ASA's logging output.

B. View predefined bookmarks.

C. View output from the traceroute command.

D. View DNS group configuration.

What is required when establishing a connection using AnyConnect in Standalone mode? (Choose two)

A. A browser using HTTPS

B. Permanent installation of AnyConnect on the client

C. ASA URL address

D. Username and password

What information should you consider when monitoring AnyConnect SSL VPNs on the client? (Choose two)

A. Use the Details button to display additional information

B. Split tunneling routes show the subnets that are reachable through tunnel

C. You can select the appropriate access method in ASDM monitoring

D. The monitoring options are in the AnyConnect GUI

Which secure posture module component is a package that installs on the remote device after the user connects to the Cisco Adaptive Security Appliance and before the user logs in?

A. Integration with dynamic access policies

B. Prelogin assessment

C. Host scan

D. Prelogin policies

Which three operating systems support the AnyConnect 3.1 IPv6 feature? (Choose three)

A. Windows XP (32-bit)

B. Red Hat Enterprise Linux 6.4 (64-bit)

C. Windows 8.1 (64-bit)

D. Windows Vista (64-bit)

E. Mac OS X 10.6

What is ESP encapsulation designed to provide? (Choose four)

A. Confidentiality

B. Authenticity

C. Overhead

D. Payload

E. Anti replay

F. Integrity

What are the prerequisites for the AnyConnect SSL VPN deployment? (Choose two)

A. Configure support for DTLS

B. Enable the SSL VPN function on the interface

C. Install the Cisco AnyConnect client software image on the Cisco ASA

D. Provision an identity server SSL/TLS certificate to the Cisco ASA

All client traffic is utilizing the VPN tunnel. Clients accessing the Internet should have direct access to external data. What should be enabled?

A. AnyConnect SSL VPN

B. Identity NAT

C. SCEP

D. Split tunneling

Which three statements are true regarding the use of DART to troubleshoot AnyConnect VPN? (Choose three)

A. It works independently of any installed AnyConnect client software.

B. It is available as a standalone installation.

C. It is integrated into the AnyConnect client package.

D. It requires administrator privileges.

E. It is only available for Windows clients.

Which configuration will enable the hub router to provide IP addresses to spokes, in a hub-spoke configuration?

A. Crypto IKEv2 authorization policy

B. Crypto IKEv2 profile

C. Virtual template interface

D. Crypto ipsec profile

What should you keep in mind when using client authentication with an external CA? (Choose two)

A. The users must have the root certificate preinstalled in their browsers

B. The security appliance receives the root certificate of the external CA and enrolls with the CA to obtain its identity certificate

C. The enterprise can manage its own CA so users do not need to enroll with the CA to obtain their identity certificates

D. The entities use the self-signed root certificate to verify the authenticity of the peer certificate

How does the Cisco ASA enables a user to choose connection profiles? (Choose two)

A. By choosing a connection profile from a drop-down list and then successfully authenticating it against the profile to obtain network access

B. By connecting to a VPN group URL that is associated with the connection profile

C. By using a field in a digital certificate

D. By mapping the user to the default connection profile

You are testing an application plugin for a clientless SSL VPN session; however, it will not start. What should be done?

A. Verify that the browser's Java/ActiveX functions.

B. Verify that the smart tunnel agent starts.

C. Verify that the appropriate plugins are loaded.

D. Verify webtype ACLs.

Which step of configuring Cisco AnyConnect Start Before Logon involves making changes to the AnyConnect profile, and enabling the Cisco ASA to download the AnyConnect module for SBL?

A. Enabling the PLAP capability in Windows

B. Adding the SBL components to Windows

C. Logging in to Windows using SBL

D. Configuring SBL in the client profile

Which three statements are true regarding clientless SSL VPN solutions? (Choose three)

A. They do not require any special software.

B. They can be used to access CIFS file shares.

C. They can use IPSec VPN connections.

D. They provide browser-based access to resources.

E. They cannot access applications that use static TCP ports.

Which steps are required to configure basic peer authentication for point-to-point tunnels on the Cisco ASA? (Choose three)

A. Choose the transform set and VPN peer

B. Enable IKEv1, IKEv2, or both on an interface

C. Choose traffic for the VPN

D. Configure PSKs

E. Configure IKE policy

When troubleshooting a FlexVPN spoke configuration, which command is used to verify whether both spokes have a virtual-access interface present?

A. show ip nhrp traffic

B. show ip nhrp

C. show ip interface brief

D. show crypto session

Which information can be obtained using the ASDM when monitoring a Cisco AnyConnect VPN on a server? (Choose three)

A. Applied access rules

B. Applied group policy

C. Connection profile

D. Transport protocol

E. Botnet activity

When modifying the default DAP, what should you keep in mind? (Choose two)

A. Default DAP has the lowest priority and cannot be deleted

B. Terminate action will act like the default deny statement in an ACL

C. A user connection can match only one DAP record

D. The security appliance does not have a default DAP record

Which command would be used to verify the DMVPN NBMA address?

A. show ip nhrp nhs detail

B. show dmvpn detail

C. show ip nhrp

D. show interface tunnel

Which three characteristics are common amongst asymmetric algorithms? (Choose three)

A. Simpler key management

B. Key management can be an issue

C. Suitable for key exchange

D. Fast compared with symmetric algorithms

E. Suitable for real-time bulk encryption

F. Slow compared to symmetric algorithms

Which statement is true regarding a Cisco ASA security appliance and IPSec?

A. AH is not supported.

B. IKEv2 is supported but IKEv1 is not supported.

C. ISAKMP is supported but IKE is not supported.

D. ESP is not supported.

Which method of certificate enrollment using SCEP automates the enrollment of Cisco AnyConnect users?

A. Simple Certificate Enrollment Protocol Proxy

B. Direct Simple Certificate Enrollment Protocol

C. Manual

D. Microsoft Active Directory Certificate Services

What is the first troubleshooting step that should be taken when there is a clientless SSL VPN session establishment issue?

A. Verify user authentication

B. Verify clientless permissions

C. Verify that the SSL/TLS session establishes.

D. Verify user credentials

Which of the three tools are used with a VPN to combat man-in-the-middle attacks? (Choose three)

A. Packet integrity checking

B. Encryption

C. Device authentication

D. Sequence number randomizing

What are the three main modules, from a design standpoint, where you would use VPN technologies? (Choose three)

A. Enterprise Branch Edge

B. WAN Edge

C. Enterprise Internet Edge

D. Campus Edge

E. Virtual User Edge

F. Enforce Edge

What should you keep in mind in a configuration scenario that uses the local CA function on the Cisco ASA CA user accounts? (Choose two)

A. A certificate-to-connection profile map that binds the user certificate to a connection profile must exist

B. The FQDN includes information like the organizational unit

C. Certificate-based authentication in the required connection profiles is enabled by default

D. Organizational units contain values that are frequently mapped in identity certificates

What are the characteristics of symmetric algorithms? (Choose three)

A. Efficient, fast, and simple to accelerate in hardware

B. Typical key lengths are in thousands of bits

C. Examples are RSA and ECC

D. Suitable for real-time bulk encryption

E. Generally used for digital signatures or key exchanges

F. Examples are 3DES, RC4, SEAL, AES, and Blowfish

Which command is used to merge site-to-site IKEv1 with IKEv2 configuration?

A. migrate remote-access ikev2

B. crypto ikev2 remote-access trust-point

C. migrate remote-access ikev2 overwrite

D. migrate l2l ikev2

Which feature enables users to use native client applications without administrative rights?

A. Smart tunnels

B. Clientless SSL VPN Plugins

C. Authentication using External CA

D. AAA

Which type of certificate is required for clientless SSL VPN connections to the Cisco ASA?

A. Code signing

B. User

C. Web server

D. Wildcard

What is required to enable a Cisco AnyConnect IPSec IKEv2 VPN deployment? (Choose two)

A. On the Cisco ASA, configure IKEv2 as the primary protocol.

B. In the client profile, configure IKEv2 as the primary protocol.

C. Deploy the IKEv2-enabled profile to the endpoint computer.

D. Ensure DTLS is enabled on the Cisco ASA's interfaces on which the appliance accepts connections.

When configuring a DMVPN spoke, which tasks follow configuring an NHRP client in the mGRE interface? (Choose two)

A. Configure an IPSec profile with an optional transform set

B. Associate the IPSec profile with the mGRE interface

C. Generate or configure hub authentication credentials

D. Configure an IP address, and IP fragmentation and TCP segmentation parameters on the mGRE interface

In a basic IKEv2 message exchange, with only the minimal four messages, which messages represent the IKE_SA_INIT phase and exchange IKEv2 proposals and key material information? (Choose two)

A. Third message

B. Fourth message

C. First message

D. Second message

Which three pieces of information are required for the client side of a challenge/response authentication using HMAC? (Choose three)

A. Hash function

B. Random number generator

C. Password

D. Challenge data

E. User DB

When implementing a basic Cisco AnyConnect SSL VPN solution, what is used to specify whether all IP traffic is protected?

A. Local address pool

B. Self-signed certificate

C. Split tunneling

D. Local user database

When an SSL client is authenticated, in addition to the server, which additional exchanges are required? (Choose two)

A. After the server sends its certificate to the client, the server will request that the client sends its certificate in return

B. The server sends a change cipher specification message that tells the client that all subsequent messages from the server will use the negotiated security

C. The client sends a change cipher specification message that tells the server to activate the negotiated cipher suite

D. After the client sends the client key exchange, the client sends a certificate verify message

You need to implement NGE. Which options would be viable? (Choose three)

A. HMAC-MD5

B. AES-CBC

C. SHA-256

D. ECDH-384

E. AES-GCM

Which component encrypts and decrypts the traffic in a GET VPN deployment?

A. Group Member

B. Group Domain of Interpretation

C. Perfect Forward Secrecy

D. Key Server

Which two site-to-site VPN technologies natively support IP Multicasts? (Choose two)

A. IPSec VPN

B. DMVPN

C. FlexVPN

D. GETVPN

Which three methods are available on the Cisco ASA for revoking certificates? (Choose three)

A. Configuring DTLS

B. Configuring CRLs

C. Configuring ACLs

D. Configuring RADIUS

E. Configuring OCSP

Which statements best describe FlexVPN? (Choose two)

A. It is designed to provide interoperable, high-quality, and cryptographically based transmission security to IP traffic

B. It supports per-peer configurations of service parameters, such as QoS, firewall mechanisms, policies, and VRF-related settings

C. It offers a simple but modular framework that extensively uses the tunnel interface paradigm, while remaining compatible with legacy VPN implementations using crypto maps

D. It is used for performing mutual authentication and establishing and maintaining SAs

During which phase of the SSL/TLS session establishment and key management does data transfer begin?

A. Phase 2: server certificate and key exchange

B. Phase 3: client certificate (if required) and key exchange

C. Phase 4: finish

D. Phase 1: establish client-server security capabilities

While calculating your results take a moment to complete our simple survey!

How likely is it that you would recommend LearnCisco.net
to a friend or colleague?

Why?

While calculating your results take a moment to complete our simple survey!

How likely is it that you would recommend LearnCisco.net to a friend or colleague?

Why?

How likely is it that you would recommend LearnCisco.net
to a friend or colleague?