Question 1

Refer to the exhibit. The VPN tunnel between the FlexVPN spoke and FlexVPN hub 192.168.0.12 is failing. What should be done to correct this issue?

Accepted Answer

A)  Add the address 192.168.0.12 255.255.255.255 command to the keyring configuration. Add the address 192.168.0.12 255.255.255.255 command to the keyring configuration. 
B)  Add the match fvrf any command to the IKEv2 policy. match fvrf any command to the IKEv2 policy. 
C)  Add the aaa authorization group psk list Flex_AAA Flex_Auth command to the IKEv2 profile configuration. aaa authorization group psk list Flex_AAA Flex_Auth command to the IKEv2 profile configuration. 
D)  Add the tunnel mode gre ip command to the tunnel configuration. tunnel mode gre ip command to the tunnel configuration. 
A)  Add the address 192.168.0.12 255.255.255.255 command to the keyring configuration. Add the address 192.168.0.12 255.255.255.255 command to the keyring configuration. 
B)  Add the match fvrf any command to the IKEv2 policy. match fvrf any command to the IKEv2 policy. 
C)  Add the aaa authorization group psk list Flex_AAA Flex_Auth command to the IKEv2 profile configuration. aaa authorization group psk list Flex_AAA Flex_Auth command to the IKEv2 profile configuration. 
D)  Add the tunnel mode gre ip command to the tunnel configuration. tunnel mode gre ip command to the tunnel configuration.

Question 2

Refer to the exhibit. All internal clients behind the ASA are port address translated to the public outside interface that has an IP address of 3.3.3.3. Client 1 and client 2 have established successful SSL VPN connections to the ASA. What must be implemented so that "3.3.3.3" is returned from a browser search on the IP address?

Accepted Answer

A)  Same-security-traffic permit inter-interface under Group Policy 
B)  Exclude Network List Below under Group Policy 
C)  Tunnel All Networks under Group Policy 
D)  Tunnel Network List Below under Group Policy 
A)  Same-security-traffic permit inter-interface under Group Policy 
B)  Exclude Network List Below under Group Policy 
C)  Tunnel All Networks under Group Policy 
D)  Tunnel Network List Below under Group Policy

Question 3

Refer to the exhibit. An engineer is troubleshooting a new GRE over IPsec tunnel. The tunnel is established but the engineer cannot ping from spoke 1 to spoke 2. Which type of traffic is being blocked?

Accepted Answer

A)  ESP packets from spoke2 to spoke1 
B)  ISAKMP packets from spoke2 to spoke1 
C)  ESP packets from spoke1 to spoke2 
D)  ISAKMP packets from spoke1 to spoke2 
A)  ESP packets from spoke2 to spoke1 
B)  ISAKMP packets from spoke2 to spoke1 
C)  ESP packets from spoke1 to spoke2 
D)  ISAKMP packets from spoke1 to spoke2

Question 4

Where is split tunneling defined for IKEv2 remote access clients on a Cisco router?

Accepted Answer

A)  IKEv2 authorization policy 
B)  Group Policy 
C)  virtual template 
D)  webvpn context 
A)  IKEv2 authorization policy 
B)  Group Policy 
C)  virtual template 
D)  webvpn context

Question 5

Refer to the exhibit. Which type of VPN implementation is displayed?

Accepted Answer

A)  IKEv1 cluster 
B)  IKEv2 backup gateway 
C)  IKEv2 load balancer 
D)  IKEv2 reconnect 
A)  IKEv1 cluster 
B)  IKEv2 backup gateway 
C)  IKEv2 load balancer 
D)  IKEv2 reconnect

Question 6

Refer to the exhibit. Which value must be configured in the User Group field when the Cisco AnyConnect Profile is created to connect to an ASA headend with IPsec as the primary protocol?

Accepted Answer

A)  address-pool 
B)  group-alias 
C)  group-policy 
D)  tunnel-group 
A)  address-pool 
B)  group-alias 
C)  group-policy 
D)  tunnel-group

Question 7

Which two types of SSO functionality are available on the Cisco ASA without any external SSO servers? (Choose two.)

Accepted Answer

A)  SAML 
B)  NTLM 
C)  Kerberos 
D)  OAuth 2.0 
E)  HTTP Basic 
A)  SAML 
B)  NTLM 
C)  Kerberos 
D)  OAuth 2.0 
E)  HTTP Basic

Question 8

Refer to the exhibit. Which type of VPN is used?

Accepted Answer

A)  GETVPN 
B)  clientless SSL VPN 
C)  Cisco Easy VPN 
D)  Cisco AnyConnect SSL VPN 
A)  GETVPN 
B)  clientless SSL VPN 
C)  Cisco Easy VPN 
D)  Cisco AnyConnect SSL VPN

Question 9

Which two statements about the Cisco ASA Clientless SSL VPN solution are true? (Choose two.)

Accepted Answer

A)  When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the client uses the local DNS to perform FQDN resolution. 
B)  The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default. The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default. 
C)  A Cisco ASA can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions. 
D)  When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the ASA uses its configured DNS servers to perform FQDN resolution. 
E)  Clientless SSLVPN provides Layer 3 connectivity into the secured network. 
A)  When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the client uses the local DNS to perform FQDN resolution. 
B)  The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default. The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default. 
C)  A Cisco ASA can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions. 
D)  When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the ASA uses its configured DNS servers to perform FQDN resolution. 
E)  Clientless SSLVPN provides Layer 3 connectivity into the secured network.

Question 10

Which command automatically initiates a smart tunnel when a user logs in to the WebVPN portal page?

Accepted Answer

A)  auto-upgrade 
B)  auto-connect 
C)  auto-start 
D)  auto-run 
A)  auto-upgrade 
B)  auto-connect 
C)  auto-start 
D)  auto-run

Question 11

Refer to the exhibit. An SSL client is connecting to an ASA headend. The session fails with the message "Connection attempt has timed out. Please verify Internet connectivity." Based on how the packet is processed, which phase is causing the failure?

Accepted Answer

A)  phase 9: rpf-check 
B)  phase 5: NAT 
C)  phase 4: ACCESS-LIST 
D)  phase 3: UN-NAT 
A)  phase 9: rpf-check 
B)  phase 5: NAT 
C)  phase 4: ACCESS-LIST 
D)  phase 3: UN-NAT

Question 12

Which technology and VPN component allows a VPN headend to dynamically learn post NAT IP addresses of remote routers at different sites?

Accepted Answer

A)  DMVPN with ISAKMP 
B)  GETVPN with ISAKMP 
C)  DMVPN with NHRP 
D)  GETVPN with NHRP 
A)  DMVPN with ISAKMP 
B)  GETVPN with ISAKMP 
C)  DMVPN with NHRP 
D)  GETVPN with NHRP

Question 13

Refer to the exhibit. Which type of mismatch is causing the problem with the IPsec VPN tunnel?

Accepted Answer

A)  crypto access list 
B)  Phase 1 policy 
C)  transform set 
D)  preshared key 
A)  crypto access list 
B)  Phase 1 policy 
C)  transform set 
D)  preshared key

Question 14

Which parameter must match on all routers in a DMVPN Phase 3 cloud?

Accepted Answer

A)  GRE tunnel key 
B)  NHRP network ID 
C)  tunnel VRF 
D)  EIGRP split-horizon setting 
A)  GRE tunnel key 
B)  NHRP network ID 
C)  tunnel VRF 
D)  EIGRP split-horizon setting

Question 15

Refer to the exhibit. Which type of Cisco VPN is shown for group Cisc012345678?

Accepted Answer

A)  Cisco AnyConnect Client VPN 
B)  DMVPN 
C)  Clientless SSLVPN 
D)  GETVPN 
A)  Cisco AnyConnect Client VPN 
B)  DMVPN 
C)  Clientless SSLVPN 
D)  GETVPN

Question 16

What uses an Elliptic Curve key exchange algorithm?

Accepted Answer

A)  ECDSA 
B)  ECDHE 
C)  AES-GCM 
D)  SHA 
A)  ECDSA 
B)  ECDHE 
C)  AES-GCM 
D)  SHA

Question 17

Which requirement is needed to use local authentication for Cisco AnyConnect Secure Mobility Clients that connect to a FlexVPN server?

Accepted Answer

A)  use of certificates instead of username and password 
B)  EAP-AnyConnect 
C)  EAP query-identity 
D)  AnyConnect profile 
A)  use of certificates instead of username and password 
B)  EAP-AnyConnect 
C)  EAP query-identity 
D)  AnyConnect profile

Question 18

What are two functions of ECDH and ECDSA? (Choose two.)

Accepted Answer

A)  nonrepudiation 
B)  revocation 
C)  digital signature 
D)  key exchange 
E)  encryption 
A)  nonrepudiation 
B)  revocation 
C)  digital signature 
D)  key exchange 
E)  encryption

Question 19

While troubleshooting, an engineer finds that the show crypto isakmp sa command indicates that the last state of the tunnel is MM_KEY_EXCH. What is the next step that should be taken to resolve this issue?

Accepted Answer

A)  Verify that the ISAKMP proposals match. 
B)  Ensure that UDP 500 is not being blocked between the devices. 
C)  Correct the peer's IP address on the crypto map. 
D)  Confirm that the pre-shared keys match on both devices. 
A)  Verify that the ISAKMP proposals match. 
B)  Ensure that UDP 500 is not being blocked between the devices. 
C)  Correct the peer's IP address on the crypto map. 
D)  Confirm that the pre-shared keys match on both devices.

Question 20

Refer to the exhibit. Based on the debug output, which type of mismatch is preventing the VPN from coming up?

Accepted Answer

A)  interesting traffic 
B)  lifetime 
C)  preshared key 
D)  PFS 
A)  interesting traffic 
B)  lifetime 
C)  preshared key 
D)  PFS

Exam 27: Automating Cisco Security Solutions (SAUTO)

Refer to the exhibit. The VPN tunnel between the FlexVPN spoke and FlexVPN hub 192.168.0.12 is failing. What should be done to correct this issue?

Refer to the exhibit. An engineer is troubleshooting a new GRE over IPsec tunnel. The tunnel is established but the engineer cannot ping from spoke 1 to spoke 2. Which type of traffic is being blocked?

Where is split tunneling defined for IKEv2 remote access clients on a Cisco router?

Refer to the exhibit. Which type of VPN implementation is displayed?

Refer to the exhibit. Which value must be configured in the User Group field when the Cisco AnyConnect Profile is created to connect to an ASA headend with IPsec as the primary protocol?

Which two types of SSO functionality are available on the Cisco ASA without any external SSO servers? (Choose two.)

Refer to the exhibit. Which type of VPN is used?

Which two statements about the Cisco ASA Clientless SSL VPN solution are true? (Choose two.)

Which command automatically initiates a smart tunnel when a user logs in to the WebVPN portal page?

Refer to the exhibit. An SSL client is connecting to an ASA headend. The session fails with the message "Connection attempt has timed out. Please verify Internet connectivity." Based on how the packet is processed, which phase is causing the failure?

Which technology and VPN component allows a VPN headend to dynamically learn post NAT IP addresses of remote routers at different sites?

Refer to the exhibit. Which type of mismatch is causing the problem with the IPsec VPN tunnel?

Which parameter must match on all routers in a DMVPN Phase 3 cloud?

Refer to the exhibit. Which type of Cisco VPN is shown for group Cisc012345678?

What uses an Elliptic Curve key exchange algorithm?

Which requirement is needed to use local authentication for Cisco AnyConnect Secure Mobility Clients that connect to a FlexVPN server?

What are two functions of ECDH and ECDSA? (Choose two.)

While troubleshooting, an engineer finds that the show crypto isakmp sa command indicates that the last state of the tunnel is MM_KEY_EXCH. What is the next step that should be taken to resolve this issue?

Refer to the exhibit. Based on the debug output, which type of mismatch is preventing the VPN from coming up?

Supporting Cisco Data Center System Devices (DCTECH)

Cisco Certified Technician Routing & Switching (RSTECH)

Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Cisco Certified Network Associate (CCNA)

Managing Industrial Networks with Cisco Networking Technologies (IMINS)

DevNet Associate (DEVASC)

Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Implementing Cisco Enterprise Advanced Routing and Services (ENARSI)

Implementing Cisco SD-WAN Solutions (ENSDWI)

Designing Cisco Enterprise Networks (ENSLD)

Designing Cisco Enterprise Wireless Networks (300-425 ENWLSD)

Implementing Cisco Enterprise Wireless Networks (300-430 ENWLSI)

Automating Cisco Enterprise Solutions (ENAUTO)

Implementing Cisco Service Provider Advanced Routing Solutions (SPRI)

Implementing Cisco Service Provider VPN Services (SPVI)

Designing Cisco Data Center Infrastructure (DCID)

Troubleshooting Cisco Data Center Infrastructure (DCIT)

Implementing Cisco Application Centric Infrastructure (DCACI)

Configuring Cisco MDS 9000 Series Switches (DCSAN)

Implementing Cisco Application Centric Infrastructure - Advanced

Automating Cisco Data Center Solutions (DCAUTO)

Securing Networks with Cisco Firepower (300-710 SNCF)

Implementing and Configuring Cisco Identity Services Engine (300-715 SISE)

Securing Email with Cisco Email Security Appliance (300-720 SESA)

Securing the Web with Cisco Web Security Appliance (300-725 SWSA)

Implementing Secure Solutions with Virtual Private Networks (SVPN 300-730)

Implementing Cisco Collaboration Applications (CLICA)

Implementing Cisco Advanced Call Control and Mobility Services (CLASSM)

Implementing Cisco Collaboration Cloud and Edge Solutions

Implementing Cisco Collaboration Conferencing

Automating Cisco Collaboration Solutions (CLAUTO)

Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS)

Developing Solutions Using Cisco IoT and Edge Platforms (DEVIOT)

Developing Applications for Cisco Webex and Webex Devices (DEVWBX)

Performing CyberOps Using Core Security Technologies (CBRCOR)

Implementing Cisco Enterprise Network Core Technologies (ENCOR)

Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR)

Implementing and Operating Cisco Data Center Core Technologies (DCCOR)

Implementing and Operating Cisco Security Core Technologies

Implementing Cisco Collaboration Core Technologies (CLCOR)

Developing Applications using Cisco Core Platforms and APIs (DEVCOR)

CCDE Design Written

Deploying Cisco Unified Contact Center Express

Cisco Meraki Solutions Specialist

Securing Cisco Networks with Sourcefire FireAMP Endpoints

Designing Cisco Unified Contact Center Enterprise (UCCED)

Implementing and Supporting Cisco Unified Contact Center Enterprise (UCCEIS)

Cisco Collaboration SaaS Authorization Exam

Cisco Security Architecture for System Engineers

Adopting The Cisco Business Architecture Approach (DTBAA)

Cisco Customer Success Manager (CSM)

Mastering The Cisco Business Architecture Discipline (DTBAD)

Filters