Implementing Secure Solutions with Virtual Private Networks (SVPN) practice questions

1. Question 1 of 25

   Select 2

   A network engineer is setting up a clientless SSLVPN on a Cisco ASA. Remote users must be able to access an internal webserver via the URL example.com. Which two steps accomplish this task? (Choose two.)

   • AConfigure a bookmark for the webserver.
   • BConfigure routing so that the user's computer can reach the webserver.
   • CConfigure a DNS server that can resolve the webserver URL.
   • DConfigure a browser plugin on the Cisco ASA.
   • EConfigure routing so that the Cisco ASA can reach the webserver.

   Show answer

   Correct answer: C, E

   How others answered

   • CE56%
   • AC44%

   Only 56% agreed on this answer — treat it as contested rather than settled.

   Explanation

   The answer is "A and C". To enable remote users to access an internal web server via the URL example.com using clientless SSL VPN on a Cisco ASA, the correct steps are: Configure a bookmark for the web server: This step involves creating a bookmark entry for the internal web server (example.com) on the Cisco ASA. The bookmark provides a convenient link for users to access the specified web resource. Configure a DNS server that can resolve the web server URL: For clientless SSL VPN to work, the ASA needs to be able to resolve the internal web server's URL (example.com) to its corresponding IP address. Ensure that the ASA has access to a DNS server that can resolve the DNS queries for the specified URL. So, the correct steps are to configure a bookmark for the web server and configure a DNS server that can resolve the web server URL. This ensures that users can access the internal web server via the specified URL, and the DNS resolution is in place to translate the URL to the corresponding IP address.

   Adapted from community discussion by kylesam2017 · 2024-06-28 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

   1. K

      kylesam2017

      2024-06-28

      3 upvotes

      The answer is "A and C". To enable remote users to access an internal web server via the URL example.com using clientless SSL VPN on a Cisco ASA, the correct steps are: Configure a bookmark for the web server: This step involves creating a bookmark entry for the internal web server (example.com) on the Cisco ASA. The bookmark provides a convenient link for users to access the specified web resource. Configure a DNS server that can resolve the web server URL: For clientless SSL VPN to work, the ASA needs to be able to resolve the internal web server's URL (example.com) to its corresponding IP address. Ensure that the ASA has access to a DNS server that can resolve the DNS queries for the specified URL. So, the correct steps are to configure a bookmark for the web server and configure a DNS server that can resolve the web server URL. This ensures that users can access the internal web server via the specified URL, and the DNS resolution is in place to translate the URL to the corresponding IP address.

   2. L

      LegitimateBuilding6

      2023-11-26

      Selected C, E4 upvotes

      DNS is required, so C is your first answer. For the second answer, it's a tossup between A and E, since both are correct: - clientside: A (users will need that bookmark) - serverside: E since you need to route traffic from the ASA to the webserver.

   3. N

      Net4dd

      2023-08-21

      Selected C, E3 upvotes

      C is mandatory if we are using names, and E is required to guarantee basic L3 connectivity between ASA and the Server cause it will not necessarily be locally connected through L2. A is optional.

   4. M

      ms997

      2024-11-27

      3 upvotes

      correct A & C is the correct answer, i don't know why others selecting E & D, not related at all. E: not related as they didn't mention to any specific plug-in require (web traffic). D: not related at all. you need to Assign the bookmark to a VPN Profile. The routing setting not in VPN Profile.

2. Question 2 of 25

   Refer to the exhibit.

   

   Based on the configuration output, what is the VPN technology?

   • Asite-to-site
   • BDMVPN
   • CL2VPN
   • Dmulticast VPN

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   The correct answer is B. Look on pg. 139 of Table 5-2 on Official Cert Guide CCNP Security Virtual Private Networks SVPN 300-730. Why am I paying for this site if it doesn't have the correct answers?

   Adapted from community discussion by pfrank · 2024-07-24 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

   1. P

      pfrank

      2024-07-24

      4 upvotes

      The correct answer is B. Look on pg. 139 of Table 5-2 on Official Cert Guide CCNP Security Virtual Private Networks SVPN 300-730. Why am I paying for this site if it doesn't have the correct answers?

   2. S

      shadow2020

      2024-07-09

      2 upvotes

      Naa, not correct. here is a snippet from Cisco to configure DMVPN ====================== interface Tunnel0 ip address 192.168.1.1 255.255.255.0 no ip redirects ip mtu 1440 ip nhrp authentication cisco123 <--- here ip nhrp map multicast dynamic ip nhrp network-id 1 no ip split-horizon eigrp 90 no ip next-hop-self eigrp 90 tunnel source FastEthernet0/0 tunnel mode gre multipoint tunnel key 0 tunnel protection ipsec profile cisco

   3. N

      netizen937

      2023-08-24

      Selected B1 upvote

      Do not see any of the telltale markers of L2VPN: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/14122-24.html#configs Or for multicast VPN: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipmulti_mvpn/configuration/xe-16/imc-mvpn-xe-16-book/imc-cfg-mc-vpn.html NHRP does indicate DMVPN. "Site-to-site" is too broad. Agree with Net4dd, it is DMVPN.

   4. M

      mjuarez20

      2024-05-18

      Selected B1 upvote

      DMVPN commands are there... It could be FlexVPN because Flex VPN could also use tunnels and NHRP but it is not an option here.

3. Question 3 of 25

   

   Refer to the exhibit. Which value must be configured in the User Group field when the Cisco AnyConnect Profile is created to connect to an ASA headend with IPsec as the primary protocol?

   • Aaddress-pool
   • Bgroup-alias
   • Cgroup-policy
   • Dtunnel-group

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect41/administration/guide/b_AnyConnect_Administrator_Guide_4-1/ configure-vpn.html

   Adapted from community discussion by nospampls · 2022-05-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

   1. N

      nospampls

      2022-05-04

      2 upvotes

      User Group—Specify a user group. The user group is used in conjunction with Host Address to form a group-based URL. If you specify the Primary Protocol as IPsec, the User Group must be the exact name of the connection profile (tunnel group). For SSL, the user group is the group-url of the connection profile. https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/administration/guide/b_AnyConnect_Administrator_Guide_4-0/anyconnect-profile-editor.html#ID-1430-0000026c

   2. N

      Net4dd

      2023-02-22

      Selected D1 upvote

      Tunnel Group is correct https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/113692-technote-anyconnect-00.html

   3. E

      emaurri

      2024-10-13

      1 upvote

      D. https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect410/administration/guide/b-anyconnect-admin-guide-4-10/anyconnect-profile-editor.html#:~:text=the%20connection%20profile-,(tunnel%20group,-).%20For%20SSL%2C%20the

   4. N

      NullNull88

      2022-10-09

      1 upvote

      The value must match the tunnel-group value exactly (case sensitive).

4. Question 4 of 25

   

   Refer to the exhibit. What is configured as a result of this command set?

   • AFlexVPN client profile for IPv6
   • BFlexVPN server to authorize groups by using an IPv6 external AAA
   • CFlexVPN server for an IPv6 dVTI session
   • DFlexVPN server to authenticate IPv6 peers by using EAP

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   Correct answer is C. The configuration snippet is an identical match to the server configuration when you look it up. Not the client.

   Adapted from community discussion by cisco_guy · 2021-01-15 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

   1. C

      cisco_guy

      2021-01-15

      6 upvotes

      Correct answer is C. The configuration snippet is an identical match to the server configuration when you look it up. Not the client.

   2. S

      shiznity2k

      2021-02-24

      4 upvotes

      C is the correct answer, this is FLEXVPN server configuration

   3. M

      mazinhoo

      2022-07-26

      Selected C2 upvotes

      C , under authorization policy there is IPv6 pool to assign IPs to client.

   4. M

      marges

      2023-07-18

      1 upvote

      Answer C is correct. This output shows an FlexVPN server for an IPv6 dynamic Virtual Tunnel Interfaces (dVTI) session. this output comes from here: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/xe-16-11/sec-flex-vpn-xe-16-11-book/sec-cfg-flex-serv.html#GUID-DB69AED1-1068-4700-B837-5F2967CCD9D2

5. Question 5 of 25

   A user is trying to log in to a Cisco ASA using the clientless SSLVPN feature and receives the error message "clientless (browser) SSLVPN access is not allowed". Which step should the Cisco ASA administrator take to resolve this issue?

   • AEnable the clientless VPN protocol on the group policy.
   • BValidate that the correct license is in use on the ASA for WebVPN.
   • CIncrease the number of simultaneous logins allowed on the group policy.
   • DVerify that a user account exists in the local AAA database for the user.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   I think the correct answer is B, for answer A we get different error message "WebVPN session terminated: Client type not supported". There are 2 types of SSL VPN license: 1) AnyConnect Essential license - only supports AnyConnect client connections 2) AnyConnect Premium license (user base license) - supports all flavours of SSL VPN, including: clientless SSL VPN, AnyConnect client VPN, and all the advanced features of SSL VPN.

   Adapted from community discussion by mazinhoo · 2023-07-19 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • cisco.com documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

   1. M

      mazinhoo

      2023-07-19

      Selected B6 upvotes

      I think the correct answer is B, for answer A we get different error message "WebVPN session terminated: Client type not supported". There are 2 types of SSL VPN license: 1) AnyConnect Essential license - only supports AnyConnect client connections 2) AnyConnect Premium license (user base license) - supports all flavours of SSL VPN, including: clientless SSL VPN, AnyConnect client VPN, and all the advanced features of SSL VPN.

   2. K

      kylesam2017

      2024-07-01

      1 upvote

      The correct answer seems to "A". To resolve the error message "clientless (browser) SSLVPN access is not allowed" on a Cisco ASA, the administrator should take the following step: Enable the clientless VPN protocol on the group policy. This error suggests that the clientless SSLVPN access is not allowed, and enabling the clientless VPN protocol on the group policy is the appropriate action to permit users to connect using the clientless SSLVPN feature. Here's a brief explanation of the options: Enable the clientless VPN protocol on the group policy: This step allows the ASA to use clientless SSLVPN for users associated with that specific group policy. Validate that the correct license is in use on the ASA for WebVPN: While licensing is crucial for certain features, the specific error message provided indicates a configuration issue related to clientless SSLVPN access. Validating the license is a good practice, but the immediate resolution for this particular error is typically related to the configuration. Ensure that the group policy associated with the user allows clientless SSLVPN access, and verify the relevant settings to enable clientless SSLVPN on the Cisco ASA.

   3. N

      Net4dd

      2023-08-22

      Selected B3 upvotes

      B is correct. https://community.cisco.com/t5/vpn/clientless-vpn-clientless-browser-ssl-vpn-access-is-not-allowed/td-p/1569690

   4. M

      marges

      2024-02-06

      2 upvotes

      correct answer is B: The message "Clientless (browser) SSL VPN access is not allowed." appears in the browser after an unsuccessful login attempt. The AnyConnect Premium license is not installed on the ASA or it is not in use as shown by "Premium AnyConnect license is not enabled on the ASA." Solution: Enable the Premium AnyConnect license with these commands: ASA(config)# webvpn ASA(config-webvpn)# no anyconnect-essentials

6. Question 6 of 25

   A Cisco AnyConnect client establishes a SSL VPN connection with an ASA at the corporate office. An engineer must ensure that the client computer meets the enterprise security policy. Which feature can update the client to meet an enterprise security policy?

   • AEndpoint Assessment
   • BCisco Secure Desktop
   • CBasic Host Scan
   • DAdvanced Endpoint Assessment

   Show answer

   Correct answer: D

   Explanation

   Correct answer is A. The Advanced Endpoint Assessment focuses on AV and remediation. Endpoint Assessment focus on the security policy checks of the local system, which examines or assesses the system.

   Adapted from community discussion by cisco_guy · 2022-01-15 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

   1. C

      cisco_guy

      2022-01-15

      3 upvotes

      Correct answer is A. The Advanced Endpoint Assessment focuses on AV and remediation. Endpoint Assessment focus on the security policy checks of the local system, which examines or assesses the system.

   2. N

      nospampls

      2023-03-18

      2 upvotes

      i think its D https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect46/administration/guide/b_AnyConnect_Administrator_Guide_4-6/configure-posture.html#ID-1407-0000004e

   3. A

      ahadmin

      2022-02-07

      2 upvotes

      The question states 'which feature can >update< the client' - updating means - do some changes on the client. Only Advanced Endpoint Assessment can do that .. So i think answer A is correct.

   4. S

      san111

      2024-07-07

      1 upvote

      I'll go with D "If the end user disables antivirus or personal firewall after successfully establishing the VPN connection, our Advanced Endpoint Assessment feature attempts to re-enable that application within approximately 60 seconds." https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/administration/guide/b_AnyConnect_Administrator_Guide_4-0/configure-posture.html#ID-1407-00000047

7. Question 7 of 25

   When troubleshooting FlexVPN spoke-to-spoke tunnels, what should be verified first?

   • ANHRP redirect is enabled on the hub.
   • BThe spokes have sent a resolution request.
   • CNHRP cache entries exist on the spoke.
   • DNHO routes exist on the spokes.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   Spoke to spoke tunnel is not created - Traffic must flow from spoke to spoke via the hub to initiate a spoke to spoke tunnel. 1. Verify the hub configuration to check if NHRP redirect is enabled. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-mt/sec-flex-vpn-15-mt-book/sec-flex-spoke.html#reference_BDAD3107D7EB4AC898CA745ED5B3E063

   Adapted from community discussion by pfrank · 2024-02-06 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • cisco.com documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

   1. J

      JKPippers

      2023-11-13

      4 upvotes

      The answer is correct. The Next Hop Resolution Protocol (NHRP) redirect is not a strict requirement for FlexVPN spoke-to-spoke tunnels to function. NHRP redirect is typically used in DMVPN (Dynamic Multipoint Virtual Private Network) deployments to optimize the routing of traffic between spoke-to-spoke connections by allowing the hub to inform spokes about more efficient paths In a FlexVPN deployment, spokes send resolution requests to the hub for spoke-to-spoke communication. These resolution requests are typically related to Next Hop Resolution Protocol (NHRP) operations. NHRP is used in FlexVPN to dynamically map the public IP addresses of spokes to their private IP addresses, facilitating spoke-to-spoke communication without having to route all traffic through the hub.

   2. N

      Net4dd

      2023-02-22

      Selected A4 upvotes

      A is correct, according to Cisco's Tips: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-mt/sec-flex-vpn-15-mt-book/sec-flex-spoke.html

   3. P

      pfrank

      2024-02-06

      Selected A3 upvotes

      Spoke to spoke tunnel is not created - Traffic must flow from spoke to spoke via the hub to initiate a spoke to spoke tunnel. 1. Verify the hub configuration to check if NHRP redirect is enabled. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-mt/sec-flex-vpn-15-mt-book/sec-flex-spoke.html#reference_BDAD3107D7EB4AC898CA745ED5B3E063

   4. A

      Acnaris

      2023-09-21

      Selected A2 upvotes

      https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-mt/sec-flex-vpn-15-mt-book/sec-flex-spoke.html

8. Question 8 of 25

   Users are getting untrusted server warnings when they connect to the URL https://asa.lab from their browsers. This URL resolves to 192.168.10.10, which is the IP address for a Cisco ASA configured for a clientless VPN. The VPN was recently set up and issued a certificate from an internal CA server. Users can connect to the VPN by ignoring the message, however, when users access other webservers that use certificates issued by the same internal CA server, they do not experience this issue. Which action resolves this issue?

   • AImport the CA that signed the certificate into the machine trusted root CA store.
   • BReissue the certificate with asa.lab in the subject alternative name field.
   • CImport the CA that signed the certificate into the user trusted root CA store.
   • DReissue the certificate with 192.168.10.10 in the subject common name field.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   "B" is the correct answer here. Reissue the certificate with asa.lab in the Subject Alternative Name (SAN) field. Here's the reasoning: Subject Alternative Name (SAN): The SAN field in the certificate is used to specify additional host names for which the certificate is valid. If users are accessing the Cisco ASA via the URL https://asa.lab, the SAN field should include "asa.lab" to match the URL. This ensures that the certificate is valid for the specific host name users are using to access the VPN. Importing CA into Trusted Root CA Store: While importing the CA certificate into the user's trusted root CA store is a valid action in some scenarios, it might not directly address the issue with untrusted server warnings for the specific URL. Importing the CA certificate may be more relevant when users are experiencing issues with the CA chain and the trust of the CA itself. In this case, updating the certificate with the correct Subject Alternative Name (asa.lab) would be the more targeted and appropriate action to resolve the issue related to accessing the VPN URL.

   Adapted from community discussion by kylesam2017 · 2024-06-26 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Cisco documentation

   View community discussion3

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

   1. K

      kylesam2017

      2024-06-26

      3 upvotes

      "B" is the correct answer here. Reissue the certificate with asa.lab in the Subject Alternative Name (SAN) field. Here's the reasoning: Subject Alternative Name (SAN): The SAN field in the certificate is used to specify additional host names for which the certificate is valid. If users are accessing the Cisco ASA via the URL https://asa.lab, the SAN field should include "asa.lab" to match the URL. This ensures that the certificate is valid for the specific host name users are using to access the VPN. Importing CA into Trusted Root CA Store: While importing the CA certificate into the user's trusted root CA store is a valid action in some scenarios, it might not directly address the issue with untrusted server warnings for the specific URL. Importing the CA certificate may be more relevant when users are experiencing issues with the CA chain and the trust of the CA itself. In this case, updating the certificate with the correct Subject Alternative Name (asa.lab) would be the more targeted and appropriate action to resolve the issue related to accessing the VPN URL.

   2. N

      Net4dd

      2023-08-22

      Selected B4 upvotes

      B should be the correct answer. https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/200339-Configure-ASA-SSL-Digital-Certificate-I.html

   3. N

      Net4dd

      2023-08-22

      3 upvotes

      A and C do not apply cause the users already have access to the Internal Web Servers: https://learn.microsoft.com/en-us/windows-hardware/drivers/install/local-machine-and-current-user-certificate-stores

9. Question 9 of 25

   Cisco AnyConnect Secure Mobility Client has been configured to use IKEv2 for one group of users and SSL for another group. When the administrator configures a new AnyConnect release on the Cisco ASA, the IKEv2 users cannot download it automatically when they connect. What might be the problem?

   • AThe XML profile is not configured correctly for the affected users.
   • BThe new client image does not use the same major release as the current one.
   • CClient services are not enabled.
   • DClient software updates are not supported with IKEv2.

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   "D" seems to be the correct answer here. The problem that might prevent IKEv2 users from automatically downloading a new AnyConnect release when they connect to the Cisco ASA is that client software updates are not supported with IKEv2. Client software updates are a feature that allows the Cisco ASA to push new AnyConnect software releases to the connected clients automatically. However, this feature is only supported for SSL VPN connections and not for IKEv2 VPN connections. As per the given scenario, where IKEv2 is being used for one group of users and SSL for another group, the IKEv2 users will not have the capability to automatically download a new AnyConnect release when they connect. This is because client software updates are specifically designed for SSL VPN connections and are not supported with IKEv2. Therefore, the problem lies in the fact that client software updates are not supported with IKEv2, rather than the client services not being enabled.

   Adapted from community discussion by kylesam2017 · 2024-07-03 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • cisco.com documentation
   • cisco.com documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

   1. K

      kylesam2017

      2024-07-03

      2 upvotes

      "D" seems to be the correct answer here. The problem that might prevent IKEv2 users from automatically downloading a new AnyConnect release when they connect to the Cisco ASA is that client software updates are not supported with IKEv2. Client software updates are a feature that allows the Cisco ASA to push new AnyConnect software releases to the connected clients automatically. However, this feature is only supported for SSL VPN connections and not for IKEv2 VPN connections. As per the given scenario, where IKEv2 is being used for one group of users and SSL for another group, the IKEv2 users will not have the capability to automatically download a new AnyConnect release when they connect. This is because client software updates are specifically designed for SSL VPN connections and are not supported with IKEv2. Therefore, the problem lies in the fact that client software updates are not supported with IKEv2, rather than the client services not being enabled.

   2. S

      starletka

      2024-07-11

      Selected C2 upvotes

      crypto ikev2 enable outside client-services port 443 which means when we enable client services they are done over port 443 ( ergo SSL) although client services which I found only mention Group policy updates and not full software updates, so im a bit split

   3. J

      JKPippers

      2024-04-30

      1 upvote

      Answer correct is A Answer A suggests that the XML profile may not be configured correctly for the affected users. The XML profile is a configuration file that can be used to customize the behavior of the AnyConnect client. It is possible that the XML profile for the IKEv2 users is not configured to allow automatic updates, or that it is pointing to an incorrect location for the new client image. https://community.cisco.com/t5/vpn/anyconnect-with-ikev2/td-p/2478375

   4. B

      brian7857ffs45

      2023-08-05

      Selected C1 upvote

      On ASDM, under connection profile -> access interfaces -> IPSEC (IKEv2) Access : you can check or uncheck the boxes for "allow access" and "enable client access"

10. Question 10 of 25

    Which Diffie Hellman group should be used when ECDH is required in a VPN configuration?

    • A24
    • B19
    • C16
    • D15

    Show answer

    Correct answer: B

    How others answered

    • B56%
    • A44%

    Only 56% agreed on this answer — treat it as contested rather than settled.

    Explanation

    "B" is correct. Explanation: In the context of VPN configurations, especially when using ECDH (Elliptic Curve Diffie-Hellman), the specific Diffie-Hellman (DH) group numbers may vary depending on the implementation or device. However, in common VPN standards like IKEv2 (Internet Key Exchange version 2), the Diffie-Hellman group numbers for ECDH are standardized. For ECDH, the Diffie-Hellman group number is typically represented as "Group 19" or "Group 256." The number 19 corresponds to the elliptic curve group called ECP-256, which uses a 256-bit key. Therefore, the correct choice for ECDH in a VPN configuration is often referred to as Group 19 or Group 256. Both representations can be used interchangeably. Always refer to your specific VPN device documentation or configuration settings to ensure compatibility and accurate representation of the Diffie-Hellman group when implementing ECDH in your VPN setup.

    Adapted from community discussion by kylesam2017 · 2023-12-26 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. K

       kylesam2017

       2023-12-26

       4 upvotes

       "B" is correct. Explanation: In the context of VPN configurations, especially when using ECDH (Elliptic Curve Diffie-Hellman), the specific Diffie-Hellman (DH) group numbers may vary depending on the implementation or device. However, in common VPN standards like IKEv2 (Internet Key Exchange version 2), the Diffie-Hellman group numbers for ECDH are standardized. For ECDH, the Diffie-Hellman group number is typically represented as "Group 19" or "Group 256." The number 19 corresponds to the elliptic curve group called ECP-256, which uses a 256-bit key. Therefore, the correct choice for ECDH in a VPN configuration is often referred to as Group 19 or Group 256. Both representations can be used interchangeably. Always refer to your specific VPN device documentation or configuration settings to ensure compatibility and accurate representation of the Diffie-Hellman group when implementing ECDH in your VPN setup.

    2. P

       pfrank

       2024-02-08

       Selected B4 upvotes

       To implement the NSA Suite B cryptography specification, use IKEv2 and select one of the elliptic curve Diffie-Hellman (ECDH) options: 19, 20, or 21.

    3. A

       Ahmadpbi

       2025-03-22

       Selected B1 upvote

       When using Elliptic Curve Diffie-Hellman (ECDH), the following groups are commonly used: DH Group 19 → 256-bit ECDH (NIST P-256) DH Group 20 → 384-bit ECDH (NIST P-384) DH Group 21 → 521-bit ECDH (NIST P-521) Among the given options, Group 19 (256-bit ECDH) is the correct choice when ECDH is required in a VPN configuration. If ECDH is required, Group 24 is NOT suitable (you should use Groups 19, 20, or 21 instead). If you are using traditional DH and need more security than Group 14, then Group 24 can be a good choice because It is not an ECDH group; instead, it is a traditional DH MODP group. It provides enhanced security over DH Group 14 (2048-bit MODP) by incorporating a 256-bit prime order subgroup, mitigating some vulnerabilities related to small subgroup attacks.

    4. Q

       Queeny

       2023-11-18

       3 upvotes

       I disagree with you. Please note that to implement the NSA Suite B cryptography specification, you use IKEv2 and select one of the elliptic curve Diffie-Hellman (ECDH) options: 19, 20, or 21. Therefore from the option given in this question, the correct answer is group 19 for ECDH. Reference: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/720/management-center-device-config-72/vpn-overview.html

11. Question 11 of 25

    Under which section must a bookmark or URL list be configured on a Cisco ASA to be available for clientless SSLVPN users?

    • Atunnel-group (general-attributes)
    • Btunnel-group (webvpn-attributes)
    • Cwebvpn (group-policy)
    • Dwebvpn (global configuration)

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    I think C , i have configured list called test in ASA ASDM, the configuration as below: import webvpn url-list test disk0:/tmpAsdmImportFile94134984 delete /noconfirm disk0:/tmpAsdmImportFile94134984 group-policy "GroupPolicy_SSL-Clientless" attributes webvpn url-list value test exit group-policy "GroupPolicy_SSL-Clientless" attributes no vpn-simultaneous-login-delete-no-delay exit so its under WEBVPN group policy

    Adapted from community discussion by mazinhoo · 2023-01-26 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. C

       cisco_guy

       2021-07-15

       9 upvotes

       Correct answer is C. The bookmark is applied under the web vpn subconfiguration mode of the group policy.

    2. K

       kylesam2017

       2024-07-03

       1 upvote

       "C" appears to be right answer. To make a bookmark or URL list available for clientless SSLVPN users on a Cisco ASA, it needs to be configured under the "webvpn (group-policy)" section. The "webvpn (group-policy)" configuration is specific to a particular group policy on the Cisco ASA. By configuring the bookmark or URL list under the appropriate group policy, you can control which clientless SSLVPN users have access to specific bookmarks or URLs. The "webvpn (global configuration)" section, on the other hand, is used for global configuration settings that apply to all clientless SSLVPN users. It defines the overall behavior and settings of the SSLVPN functionality on the Cisco ASA but does not handle the specific bookmarks or URL lists. Therefore, to make a bookmark or URL list available for clientless SSLVPN users, ensure that it is configured under the relevant group policy within the "webvpn (group-policy)" section.

    3. M

       marges

       2024-01-18

       1 upvote

       Answer C is correct. Apply a URL List: You can specify a list of URLs to appear on the clientless SSL VPN home page for a group policy. First, you must create one or more named lists by entering the url-list command in global configuration mode. To apply a list of servers and URLs for clientless SSL VPN sessions to a particular group policy, allowing access to the URLs in a list for a specific group policy, use the name of the list or lists you create there with the url-list command in group-policy webvpn configuration mode. There is no default URL list. The following example sets a URL list called FirstGroupURLs for the group policy named FirstGroup and specifies that this should be the first URL list displayed on the homepage: hostname(config)# group-policy FirstGroup attributes hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# url-list value FirstGroupURLs 1 hostname(config-group-webvpn)#

    4. A

       Acnaris

       2024-03-25

       Selected C1 upvote

       You can specify a list of URLs to appear on the clientless SSL VPN home page for a group policy. First, you must create one or more named lists by entering the url-list command in global configuration mode. To apply a list of servers and URLs for clientless SSL VPN sessions to a particular group policy, allowing access to the URLs in a list for a specific group policy, use the name of the list or lists you create there with the url-list command in group-policy webvpn configuration mode. There is no default URL list. https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/vpn/asa-97-vpn-config/webvpn-configure-policy-groups.html#ID-2439-00001484

12. Question 12 of 25

    

    Refer to the exhibit. Based on the exhibit, why are users unable to access CCNP Webserver bookmark?

    • AThe URL is being blocked by a WebACL.
    • BThe ASA cannot resolve the URL.
    • CThe bookmark has been disabled.
    • DThe user cannot access the URL.

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    B is correct. WebVPN Clients Cannot Hit Bookmarks and is Grayed Out Problem If these bookmarks were configured for users to sign in to the clientless VPN, but on the home screen under "Web Applications" they show up as grayed out, how can I enable these HTTP links so that the users are able to click them and go into the particular URL? Solution You should first make sure that the ASA can resolve the websites through DNS. Try to ping the websites by name. If the ASA cannot resolve the name, the link is grayed out. If the DNS servers are internal to your network, configure the DNS domain-lookup private interface. https://www.cisco.com/c/en/us/support/docs/security-vpn/webvpn-ssl-vpn/119417-config-asa-00.html#anc15

    Adapted from community discussion by PopLife · 2022-03-25 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • cisco.com documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. P

       PopLife

       2022-03-25

       4 upvotes

       B is correct. WebVPN Clients Cannot Hit Bookmarks and is Grayed Out Problem If these bookmarks were configured for users to sign in to the clientless VPN, but on the home screen under "Web Applications" they show up as grayed out, how can I enable these HTTP links so that the users are able to click them and go into the particular URL? Solution You should first make sure that the ASA can resolve the websites through DNS. Try to ping the websites by name. If the ASA cannot resolve the name, the link is grayed out. If the DNS servers are internal to your network, configure the DNS domain-lookup private interface. https://www.cisco.com/c/en/us/support/docs/security-vpn/webvpn-ssl-vpn/119417-config-asa-00.html#anc15

    2. S

       shiznity2k

       2022-02-24

       3 upvotes

       it is normally greyed out when the ASA is not resolving the URL to IP address

    3. L

       LouisVuitton

       2023-10-29

       Selected B2 upvotes

       B: If no DNS server is configured on the Cisco ASA or DNS resolution fails, the bookmark will be greyed out for the user.

    4. N

       Net4dd

       2024-02-15

       Selected B2 upvotes

       B seems correct: https://community.cisco.com/t5/network-security/missing-ssl-vpn-bookmarks/td-p/1597023

13. Question 13 of 25

    Select 2

    

    Refer to the exhibit. Which two commands under the tunnel-group webvpn-attributes result in a Cisco AnyConnect user receiving the AnyConnect prompt in the exhibit? (Choose two.)

    • Agroup-url https://172.16.31.10/General enable
    • Bgroup-policy General internal
    • Cauthentication aaa
    • Dauthentication certificate
    • Egroup-alias General enable

    Show answer

    Correct answer: C, E

    How others answered

    • CE78%
    • BE17%

    Explanation

    The answers are A & E. https://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/vpngrp.html Step 5 - To specify incoming URLs or IP addresses for the group, use the group-url command. Specifying a group URL or IP address eliminates the need for the user to select a group at login. When a user logs in, the security appliance looks for the user's incoming URL or address in the tunnel-group-policy table. If it finds the URL or address and if group-url is enabled in the tunnel group, then the security appliance automatically selects the associated tunnel group and presents the user with only the username and password fields in the login window. The questions asks which two commands under the tunnel-group webvpn-attributes result in a Cisco AnyConnect user receiving the AnyConnect prompt. It does not ask whether authentication attempts are successful. Here, the keyword is 'AnyConnect prompt'.

    Adapted from community discussion by jimmyjose · 2024-09-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. J

       jimmyjose

       2024-09-18

       2 upvotes

       The answers are A & E. https://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/vpngrp.html Step 5 - To specify incoming URLs or IP addresses for the group, use the group-url command. Specifying a group URL or IP address eliminates the need for the user to select a group at login. When a user logs in, the security appliance looks for the user's incoming URL or address in the tunnel-group-policy table. If it finds the URL or address and if group-url is enabled in the tunnel group, then the security appliance automatically selects the associated tunnel group and presents the user with only the username and password fields in the login window. The questions asks which two commands under the tunnel-group webvpn-attributes result in a Cisco AnyConnect user receiving the AnyConnect prompt. It does not ask whether authentication attempts are successful. Here, the keyword is 'AnyConnect prompt'.

    2. S

       starletka

       2024-07-11

       Selected C, E3 upvotes

       E to enable alias is definitely required both B and C are required too but its always assumed that they are already done. B group policy is not required as Default can be used C if AAA is not configured than authentication will not work.

    3. A

       Acnaris

       2024-03-26

       Selected C, E3 upvotes

       https://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/vpngrp.html

    4. M

       mjuarez20

       2024-05-07

       Selected C, E2 upvotes

       C and E seems correct, because AAA authentication is done under tunnel group config, and it will ask for username and password. And the group-list under tunnel group as well, it will asks to select from the drop down menu.

14. Question 14 of 25

    

    Refer to the exhibit. Which VPN technology is allowed for users connecting to the Employee tunnel group?

    • ASSL AnyConnect
    • BIKEv2 AnyConnect
    • Ccrypto map
    • Dclientless

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    the tunnel group Employee doens have any specific group applied which means it will use the dfltgrpPolicy, in the dfltgrpPolicy only clientless is enabled, so the correct answer is D, Clientless

    Adapted from community discussion by Carlj007 · 2022-12-29 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. C

       Carlj007

       2022-12-29

       Selected D7 upvotes

       the tunnel group Employee doens have any specific group applied which means it will use the dfltgrpPolicy, in the dfltgrpPolicy only clientless is enabled, so the correct answer is D, Clientless

    2. N

       Net4dd

       2024-02-18

       Selected D2 upvotes

       When you configure other group policies, any attribute that you do not explicitly specify takes its value from the default group policy. To view the default group policy. https://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/vpngrp.html

    3. A

       ahadmin

       2022-02-05

       3 upvotes

       The tunnel-group Employee has no entry for a specific default-group-policy as with the Admin-Group. The group-policy DfltGrpPolicy is used instead. This permits only ssl-clientless. Answer D - clientless is correct.

    4. S

       spambox730

       2024-07-06

       Selected D2 upvotes

       D - nothing is declared in the Employee group-policy so it falls back to the default group policy.

15. Question 15 of 25

    In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form. Which troubleshooting step solves the issue?

    • AVerify the spoke configuration to check if the NHRP redirect is enabled.
    • BVerify that the spoke receives redirect messages and sends resolution requests.
    • CVerify the hub configuration to check if the NHRP shortcut is enabled.
    • DVerify that the tunnel interface is contained within a VRF.

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-summ- maps.pdf

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. N

       Net4dd

       2024-08-17

       Selected B1 upvote

       On receiving the redirect, Spoke1 initiates a resolution request for Host2 over the point-to-point tunnel interface (the same interface over which it received the redirect). The resolution request traverses the routed path (Spoke1-hub-spoke2). On receiving the resolution request, Spoke2 determines that it is the exit point and needs to respond to the resolution request. https://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-2mt/sec-flex-spoke.html

    2. D

       Dante8880

       2024-05-15

       1 upvote

       The hub sends out an NHRP redirect message to spoke1 on virtual access interface1. On receiving the redirect, Spoke1 initiates a resolution request for Host2 over the point-to-point tunnel interface (the same interface over which it received the redirect). The resolution request traverses the routed path (Spoke1-hub-spoke2). On receiving the resolution request, Spoke2 determines that it is the exit point and needs to respond to the resolution request. https://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-2mt/sec-flex-spoke.html#GUID-2762C965-B052-4876-8F9A-2ACCEF05BBE4

    3. N

       Net4dd

       2024-08-22

       1 upvote

       https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-mt/sec-flex-vpn-15-mt-book/sec-flex-spoke.html

    4. N

       NullNull88

       2024-04-09

       1 upvote

       A and C can be eliminated because the HUB = Redirects and Spokes = Shortcuts Not the other way around

16. Question 16 of 25

    An engineer is troubleshooting a new DMVPN setup on a Cisco IOS router. After the show crypto isakmp sa command is issued, a response is returned of "MM_NO_STATE." Why does this failure occur?

    • AThe ISAKMP policy priority values are invalid.
    • BESP traffic is being dropped.
    • CThe Phase 1 policy does not match on both devices.
    • DTunnel protection is not applied to the DMVPN tunnel.

    Show answer

    Correct answer: C

    How others answered

    • C90%

    Explanation

    Could also be a mismatch on both sides as stated in this troubleshooting guide. https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html Though it is mentioned that its DMVPN so that could be why esp is being dropped but that should only be if protection is on.

    Adapted from community discussion by Slysloth · 2021-01-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. N

       nospampls

       2025-03-03

       Selected C1 upvote

       should be C A show crypto isakmp sa command shows the ISAKMP SA to be inMM_NO_STATE. This also means that main mode has failed. dst src state conn-id slot 10.1.1.2 10.1.1.1 MM_NO_STATE 1 0 Verify that the phase 1 policy is on both peers, and ensure that all the attributes match. https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html#toc-hId--70669866

    2. S

       Slysloth

       2021-01-08

       2 upvotes

       Could also be a mismatch on both sides as stated in this troubleshooting guide. https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html Though it is mentioned that its DMVPN so that could be why esp is being dropped but that should only be if protection is on.

    3. S

       shiznity2k

       2021-02-24

       2 upvotes

       C is the correct answer, it is due to policy mismatch for phase 1

    4. J

       joegreen

       2024-07-04

       Selected C1 upvote

       Answer is C. ISAKMP packets would be dropped if it were the case, not ESP packets.

17. Question 17 of 25

    Select 2

    Which two commands help determine why the NHRP registration process is not being completed even after the IPsec tunnel is up? (Choose two.)

    • Ashow crypto isakmp sa
    • Bshow ip traffic
    • Cshow crypto ipsec sa
    • Dshow ip nhrp traffic
    • Eshow dmvpn detail

    Show answer

    Correct answer: D, E

    How others answered

    • DE71%
    • AD18%

    Only 71% agreed on this answer — treat it as contested rather than settled.

    Explanation

    IPsec process is complete so that rules out all crypto vpn related commands. You need to look at NHRP next. Which commands are left that produce nhrp outputs? D and E

    Adapted from community discussion by brian7857ffs45 · 2023-08-08 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. B

       brian7857ffs45

       2023-08-08

       Selected D, E5 upvotes

       IPsec process is complete so that rules out all crypto vpn related commands. You need to look at NHRP next. Which commands are left that produce nhrp outputs? D and E

    2. Y

       YourFriendlyNeighborhoodSpider

       2022-08-12

       6 upvotes

       D AND E my friends. IPsec is already up, thus isakmp(phase 1) as well.

    3. S

       ScaX

       2023-05-10

       4 upvotes

       Correct Answer: D,E Explanation: Ipsec tunnel is up so we don’t need to troubleshoot that (so we don’t need option A and C here) Option B (show ip traffic) is totally unrelated here. This leave us with D and E which are indeed both helping us to troubleshoot DMVPN NHRP registration process.

    4. S

       starletka

       2024-07-11

       2 upvotes

       your link shows that correct answer is C and D Router#show crypto IPSEC sa local ident (addr/mask/prot/port): (172.16.1.1/255.255.255.255/47/0) remote ident (addr/mask/prot/port): (172.17.0.1/255.255.255.255/47/0) #pkts encaps: 154, #pkts encrypt: 154, #pkts digest: 154 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 inbound esp sas: spi: 0xF830FC95(4163959957) outbound esp sas: spi: 0xD65A7865(3596253285) !--- !--- Output is truncated !--- It shows that return traffic does not come back from the other end of the tunnel. Check NHS entry in the spoke router: Router#show ip nhrp nhs detail Legend: E=Expecting replies, R=Responding Tunnel0: 172.17.0.1 E req-sent 0 req-failed 30 repl-recv 0 Pending Registration Requests: Registration Request: Reqid 4371, Ret 64 NHS 172.17.0.1

18. Question 18 of 25

    Which VPN does VPN load balancing on the ASA support?

    • AVTI
    • BIPsec site-to-site tunnels
    • CL2TP over IPsec
    • DCisco AnyConnect

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Quote from 300-730 official certification guide "Some VPN clients may not be able to participate in load balancing. For example, the Cisco ASA supports IPsec clients, SSL VPN clients, and clientless sessions. The Cisco ASA allows support for LT2P, PPTP clients, or L2TP/IPsec, but they do not participate in load balancing." Therefore I believe D is correct one

    Adapted from community discussion by squirrel49 · 2024-07-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. S

       squirrel49

       2024-07-08

       Selected D2 upvotes

       Quote from 300-730 official certification guide "Some VPN clients may not be able to participate in load balancing. For example, the Cisco ASA supports IPsec clients, SSL VPN clients, and clientless sessions. The Cisco ASA allows support for LT2P, PPTP clients, or L2TP/IPsec, but they do not participate in load balancing." Therefore I believe D is correct one

    2. K

       kylesam2017

       2024-07-03

       1 upvote

       "B" is the correct answer here. The VPN load balancing feature on the ASA (Adaptive Security Appliance) supports IPsec site-to-site tunnels. The ASA is capable of load balancing VPN traffic across multiple IPsec site-to-site tunnels. This allows for efficient distribution of VPN traffic across the available tunnels, improving performance and scalability. On the other hand, Cisco AnyConnect is a remote access VPN solution, primarily used for secure remote connectivity to a network. While AnyConnect offers various features and capabilities, VPN load balancing is not specifically supported by Cisco AnyConnect. Therefore, the correct answer is that VPN load balancing on the ASA supports IPsec site-to-site tunnels.

    3. S

       starletka

       2024-07-11

       1 upvote

       VPN Load balancing is effective only on remote sessions initiated with the following clients: AnyConnect Secure Mobility Client (Release 3.0 and later) ASA 5505 (when acting as an Easy VPN client) Firepower 1010 (when acting as an Easy VPN client) IOS EZVPN Client devices supporting IKE-redirect (IOS 831/871) Clientless SSL VPN https://www.cisco.com/c/en/us/td/docs/security/asa/asa912/configuration/vpn/asa-912-vpn-config/vpn-ha.html#ID-2186-00000429 So i guess I vote D

    4. J

       JKPippers

       2024-05-01

       1 upvote

       Answer correct is B VPN load balancing works with IPsec clients and SSL VPN client and clientless sessions. All other VPN connection types (L2TP, PPTP, L2TP/IPsec), including LAN-to-LAN, can connect to an ASA on which VPN load balancing is enabled, but they cannot participate in VPN load balancing. https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/configuration/vpn/asa-99-vpn-config/vpn-ha.html

19. Question 19 of 25

    Which parameter must match on all routers in a DMVPN Phase 3 cloud?

    • AGRE tunnel key
    • BNHRP network ID
    • Ctunnel VRF
    • DEIGRP split-horizon setting

    Show answer

    Correct answer: A

    How others answered

    • A53%
    • B47%

    Only 53% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I think is A-> "Notes: NHRP network IDs are locally significant and can be different. It makes sense from a deployment and maintenance perspective to use unique network ID numbers using the ip nhrp network-id command) across all routers in a DMVPN network, but it is not necessary that they be the same." https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-dmvpn.html

    Adapted from community discussion by fukumoto0925 · 2024-11-27 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. D

       Dako_Dakar

       2023-03-22

       6 upvotes

       Es A, probado en mi Lab ,no se por que en algunas partes dice que el nhrp network id debe hacer match . Cuando puse diferentes tunnel key si bien el SA se formaba exitosamente el tráfico no pasaba.

    2. K

       kylesam2017

       2023-12-17

       2 upvotes

       In a DMVPN (Dynamic Multipoint Virtual Private Network) Phase 3 cloud, the parameter that must match on all routers is the NHRP (Next Hop Resolution Protocol) Network ID. The NHRP Network ID is used to identify and group routers together within the DMVPN network. It ensures that routers can communicate with each other and exchange routing information correctly. On the other hand, the GRE (Generic Routing Encapsulation) Tunnel Key is used to differentiate multiple tunnels between the same source and destination IP addresses. Each tunnel will have a unique GRE Tunnel Key, which helps in identifying and forwarding traffic correctly within the DMVPN network. So, to summarize, the parameter that needs to match on all routers in a DMVPN Phase 3 cloud is the NHRP Network ID. If this parameter is consistent across all routers, they will be able to establish connectivity and exchange routing information seamlessly.

    3. F

       fukumoto0925

       2024-11-27

       Selected A2 upvotes

       I think is A-> "Notes: NHRP network IDs are locally significant and can be different. It makes sense from a deployment and maintenance perspective to use unique network ID numbers using the ip nhrp network-id command) across all routers in a DMVPN network, but it is not necessary that they be the same." https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-dmvpn.html

    4. N

       netizen937

       2023-03-17

       Selected A2 upvotes

       Tunnel key is optional in phase 3, but if you have one it must match on all routers in an NHRP domain, and if you do not use a tunnel key, you must not use it on any router in the NHRP domain (meaning technically it has to match, whether it's there or not). I vote A. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-dmvpn.html

20. Question 20 of 25

    Where is split tunneling defined for IKEv2 remote access clients on a Cisco router?

    • AIKEv2 authorization policy
    • BGroup Policy
    • Cvirtual template
    • Dwebvpn context

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Steap 13 (Optional). By default, all traffic from the client is sent through the tunnel. You can configure split tunnel, which allows only selected traffic to go through the tunnel. ip access-list standard split_tunnel permit 10.0.0.0 0.255.255.255 ! crypto ikev2 authorization policy ikev2-auth-policy route set access-list split_tunnel https://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2-Remote-Access.html#toc-hId-936641904

    Adapted from community discussion by pfrank · 2024-08-13 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. K

       kylesam2017

       2024-07-03

       1 upvote

       n a Cisco router, split tunneling for IKEv2 remote access clients is typically defined within the Group Policy configuration. The Group Policy defines various parameters and settings for a particular group of remote access clients. Within the Group Policy configuration, you can specify whether split tunneling should be enabled or disabled for the IKEv2 remote access clients associated with that group. Split tunneling determines how network traffic is routed when a remote access client is connected to the router using IKEv2. It allows the client to decide which traffic should be sent through the VPN tunnel and which traffic should be directly routed to the local network or the internet. While IKEv2 Authorization Policy can also play a role in defining access permissions and policies for IKEv2 remote access clients, split tunneling itself is typically configured within the Group Policy. So, the correct answer is that split tunneling for IKEv2 remote access clients on a Cisco router is defined within the Group Policy.

    2. P

       pfrank

       2024-08-13

       Selected A2 upvotes

       Steap 13 (Optional). By default, all traffic from the client is sent through the tunnel. You can configure split tunnel, which allows only selected traffic to go through the tunnel. ip access-list standard split_tunnel permit 10.0.0.0 0.255.255.255 ! crypto ikev2 authorization policy ikev2-auth-policy route set access-list split_tunnel https://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2-Remote-Access.html#toc-hId-936641904

    3. L

       Lantis125

       2022-08-15

       3 upvotes

       I'd say A - IKEv2 Authorization Policy Source (Step 13): https://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2-Remote-Access.html Webvpn is for SSL remote access VPN's and the question asks about an IKEv2 remote access

    4. [

       [Removed]

       2022-11-02

       Selected A2 upvotes

       VPN-ROUTER(config)# ip access-list extended SPLIT_TUNNEL_ACL VPN-ROUTER(config-std-nacl)# permit 172.20.1.0 0.0.0.255 VPN-ROUTER(config-std-nacl)# VPN-ROUTER(config-std-nacl)# crypto ikev2 authorization policy EMPLOYEES VPN-ROUTER(config-ikev2-author-policy)# route set access-list SPLIT_TUNNEL_ACL

21. Question 21 of 25

    An engineer is configuring clientless SSL VPN. The finance department has a database server that only they should access, but the sales department can currently access it. The finance and the sales departments are configured as separate group-policies. What must be added to the configuration to make sure the users in the sales department cannot access the finance department server?

    • Atunnel group lock
    • Bsmart tunnel
    • Cport forwarding
    • Dwebtype ACL

    Show answer

    Correct answer: D

    How others answered

    • D71%
    • A29%

    Only 71% agreed on this answer — treat it as contested rather than settled.

    Explanation

    "D". To ensure that users in the sales department cannot access the finance department server in a clientless SSL VPN setup, a webtype ACL (Access Control List) must be added to the configuration. A webtype ACL is used to define specific access controls for clientless SSL VPN users. It allows you to control and restrict the resources that users can access through the SSL VPN portal. By creating a webtype ACL and applying it to the appropriate group-policy associated with the sales department, you can explicitly deny access to the finance department server. This ACL will prevent users in the sales department from reaching the finance department server even though they are configured under separate group-policies. On the other hand, "tunnel group lock" is not directly related to restricting access to specific resources. It is a feature that allows you to lock a user to a specific tunnel group, ensuring that the user always connects to that particular tunnel group. Therefore, the correct approach to prevent users in the sales department from accessing the finance department server in a clientless SSL VPN setup is to use a webtype ACL.

    Adapted from community discussion by kylesam2017 · 2024-07-03 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. K

       kylesam2017

       2024-07-03

       3 upvotes

       "D". To ensure that users in the sales department cannot access the finance department server in a clientless SSL VPN setup, a webtype ACL (Access Control List) must be added to the configuration. A webtype ACL is used to define specific access controls for clientless SSL VPN users. It allows you to control and restrict the resources that users can access through the SSL VPN portal. By creating a webtype ACL and applying it to the appropriate group-policy associated with the sales department, you can explicitly deny access to the finance department server. This ACL will prevent users in the sales department from reaching the finance department server even though they are configured under separate group-policies. On the other hand, "tunnel group lock" is not directly related to restricting access to specific resources. It is a feature that allows you to lock a user to a specific tunnel group, ensuring that the user always connects to that particular tunnel group. Therefore, the correct approach to prevent users in the sales department from accessing the finance department server in a clientless SSL VPN setup is to use a webtype ACL.

    2. M

       marges

       2024-01-25

       1 upvote

       The correct answer is D. webtype ACL ! User Anonymous983475 says: But if we use only one ACL and the user can access another tunnel group, he will have the access according to the other tunnel group. That's not quite right, because we can assign a specific group policy to the remote users that prevents access even if he uses a different tunnel group: ASA(config)# access-list WebACL_SALES_DEPARTMENT webtype permit url http://192.168.10.100 log default ASA(config)# access-list WebACL_FINANCE_DEPARTMENT webtype permit url http://192.168.20.100 log default ASA(config)# group-policy sales_department internal ASA(config)# group-policy sales_department attributes ASA(config-group-policy)# vpn-tunnel-protocol ssl-clientless ASA(config-group-policy)# webvpn ASA(config-group-webvpn)# filtervalue WebACL_SALES_DEPARTMENT ASA(config)# username RemoteUser1 password xxx ASA(config)# username RemoteUser1 attribute ASA(config-username)# vpn-group-policy sales_department

    3. P

       pfrank

       2024-08-13

       Selected D3 upvotes

       Web ACLs allow administrators to control the resources users are able to access when making access requests through a clientless SSL VPN.

    4. N

       Net4dd

       2023-08-23

       Selected D2 upvotes

       D is correct https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/acl-webtype.html

22. Question 22 of 25

    

    Refer to the exhibit. Which type of Cisco VPN is shown for group Cisc012345678?

    • ACisco AnyConnect Client VPN
    • BDMVPN
    • CClientless SSLVPN
    • DGETVPN

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    I think the correct Answer should actually be A. For it to be C we would need protocol set as follows: vpn-tunnel-protocol ssl-clientless

    Adapted from community discussion by johnd47 · 2023-06-30 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • cisco.com documentation
    • Cisco documentation

    View community discussion3

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. J

       johnd47

       2023-06-30

       2 upvotes

       I think the correct Answer should actually be A. For it to be C we would need protocol set as follows: vpn-tunnel-protocol ssl-clientless

    2. L

       LegitimateBuilding6

       2023-11-18

       Selected A1 upvote

       A is correct: https://learningnetwork.cisco.com/s/question/0D53i00000Q4COCCA3/anyconnect-ssl-vpn

    3. J

       johnd47

       2023-06-30

       1 upvote

       Answer C: https://www.cisco.com/c/en/us/support/docs/security-vpn/webvpn-ssl-vpn/119417-config-asa-00.html

23. Question 23 of 25

    Select 2

    Which two changes must be made in order to migrate from DMVPN Phase 2 to Phase 3 when EIGRP is configured? (Choose two.)

    • AAdd NHRP shortcuts on the hub.
    • BAdd NHRP redirects on the spoke.
    • CDisable EIGRP next-hop-self on the hub.
    • DEnable EIGRP next-hop-self on the hub.
    • EAdd NHRP redirects on the hub.

    Show answer

    Correct answer: D, E

    How others answered

    • DE50%
    • CE50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Answer is D and E. DMVPN disables the EIRGP next-hop-self with "no ip next-hop-self eigrp xxx" in DMVPN phase 2, and to go from Phase 2 to 3 you need use the NHRP protocol, and again enable EIRGP next-hop-self with "ip next-hop-self eigrp 134" under the tunnel interface https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-dmvpn.html#GUID-BF561439-BCC0-4AAF-80D9-1F7876CB7B81

    Adapted from community discussion by Soter · 2023-04-28 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • cisco.com documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. S

       Soter

       2023-04-28

       4 upvotes

       Answer is D and E. DMVPN disables the EIRGP next-hop-self with "no ip next-hop-self eigrp xxx" in DMVPN phase 2, and to go from Phase 2 to 3 you need use the NHRP protocol, and again enable EIRGP next-hop-self with "ip next-hop-self eigrp 134" under the tunnel interface https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-dmvpn.html#GUID-BF561439-BCC0-4AAF-80D9-1F7876CB7B81

    2. J

       JKPippers

       2024-05-04

       3 upvotes

       Answer correct are C and E https://networkingjournalblog.wordpress.com/2017/05/04/dmvpn-configuration-phase-3/ #ip nhrp redirect: this command informs the spokes that spoke-to-spoke communication can in fact be had directly and there is no need to traverse the hub. All it does is trigger the spoke NHRP resolution request. Disable EIGRP next-hop-self on the hub: EIGRP next-hop-self is a feature that causes the hub to advertise its own IP address as the next hop for traffic destined for other spokes. When migrating from DM Phase 2 to Phase 3, this feature should be disabled on the hub to allow spoke-to-spoke communication without going through the hub.

    3. K

       kylesam2017

       2024-06-18

       2 upvotes

       To migrate from DMVPN Phase 2 to Phase 3 with EIGRP, you should disable EIGRP next-hop-self on the hub. In DMVPN Phase 3, the spoke routers directly exchange routing information, including EIGRP updates, without going through the hub. Disabling EIGRP next-hop-self on the hub ensures that it doesn't modify the next-hop IP address in the EIGRP updates it sends to the spoke routers. This allows the spoke routers to use their own routing table to determine the next-hop for EIGRP updates.

    4. M

       marges

       2024-01-18

       1 upvote

       D and E are correct. Remember Phase 3 EIGRP in terms of configuration requires a slight modification to the existing configuration from phase 2, and a couple additional commands at the hub and spokes, but otherwise it is very much the same. The additional command needed at the hub is "ip nhrp redirect". For phase 3 to be really successful, the command "no ip next-hop-self eigrp x "from phase 2 must be revoked for EIGRP. Forgetting to enable next-hop-self on the hub will give the impression that phase 3 is working when it is not. Phase 3: disable “no ip next-hop-self eigrp x” and enable “ip nhrp redirect.” R1(config)# int tun 0 R1(config-if)#ip next-hop-self eigrp 100 R1(config-if)#ip nhrp redirect

24. Question 24 of 25

    Select 2

    Which two NHRP functions are specific to DMVPN Phase 3 implementation? (Choose two.)

    • Aregistration reply
    • Bredirect
    • Cresolution reply
    • Dregistration request
    • Eresolution request

    Show answer

    Correct answer: B, E

    How others answered

    • BE45%
    • CE32%
    • BC23%

    Only 45% agreed on this answer — treat it as contested rather than settled.

    Explanation

    BC is the correct answer. In DMVPN Phase 3 implementation, the two NHRP (Next Hop Resolution Protocol) functions that are specific to it are resolution reply and redirect. 1. Resolution reply: This function is used by the hub router to respond to NHRP resolution requests by providing the mapping information (such as the real IP address of the spoke router). 2. Redirect: This function is used by the hub router to inform the spoke router that a more optimal path to reach a destination is available through a different spoke router. The redirect message allows the spoke router to update its routing table and use the more efficient path. These functions help in the dynamic establishment of tunnels and efficient data routing in DMVPN Phase.

    Adapted from community discussion by kylesam2017 · 2023-12-19 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • cisco.com documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. K

       kylesam2017

       2023-12-19

       2 upvotes

       BC is the correct answer. In DMVPN Phase 3 implementation, the two NHRP (Next Hop Resolution Protocol) functions that are specific to it are resolution reply and redirect. 1. Resolution reply: This function is used by the hub router to respond to NHRP resolution requests by providing the mapping information (such as the real IP address of the spoke router). 2. Redirect: This function is used by the hub router to inform the spoke router that a more optimal path to reach a destination is available through a different spoke router. The redirect message allows the spoke router to update its routing table and use the more efficient path. These functions help in the dynamic establishment of tunnels and efficient data routing in DMVPN Phase.

    2. P

       pfrank

       2024-02-13

       Selected B, E3 upvotes

       *Apr 13 19:06:07.596: (M) traffic code: redirect(0) *Apr 13 19:06:07.609: NHRP: Send Resolution Request via Tunnel0 vrf 0, packet size: 84 ttps://www.cisco.com/c/en/us/support/docs/security/dynamic-multipoint-vpn-dmvpn/211292-Configure-Phase-3-Hierarchical-DMVPN-wit.html#anc16

    3. P

       petestudies

       2023-12-19

       Selected B, E3 upvotes

       I agree above, it should be B & E https://ine.com/blog/2008-12-23-dmvpn-phase-3 "NRHP Phase 3 involves spokes in responding to NHRP resolution requests. ... Step 3: Let's say an mGRE tunnel is configured for NHRP redirects (the first magic component of NHRP Phase 3). "...

    4. H

       haydenme97

       2024-03-13

       2 upvotes

       BE https://learningnetwork.cisco.com/s/article/dmvpn-concepts-amp-configuration NHRPredirect enable specifically in Phase 3, after hub sends redirect spokes use resolution requests to get enach other NBMA address

25. Question 25 of 25

    

    Refer to the exhibit. Upon setting up a tunnel between two sites, users are complaining that connections to applications over the VPN are not working consistently. The output of show crypto ipsec sa was collected on one of the VPN devices. Based on this output, what should be done to fix this issue?

    • ALower the tunnel MTU.
    • BEnable perfect forward secrecy.
    • CSpecify the application networks in the remote identity.
    • DMake an adjustment to IPSec replay window.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    I'd say this question is a bit confusing. There are packets that are falling out of anti-replay window - which might by caused by the MTU - as we can see path MTU is 1500. So I'd go with A however it is also possible to play with anti-replay window: https://www.cisco.com/c/en/us/support/docs/ip/internet-key-exchange-ike/116858-problem-replay-00.html However in general that is not recommended. Especially when fragmentation makes the packets fall out of anti-replay window.

    Adapted from community discussion by [Removed] · 2022-11-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • cisco.com documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-730 or CertExamHQ.

    1. [

       [Removed]

       2022-11-08

       2 upvotes

       I'd say this question is a bit confusing. There are packets that are falling out of anti-replay window - which might by caused by the MTU - as we can see path MTU is 1500. So I'd go with A however it is also possible to play with anti-replay window: https://www.cisco.com/c/en/us/support/docs/ip/internet-key-exchange-ike/116858-problem-replay-00.html However in general that is not recommended. Especially when fragmentation makes the packets fall out of anti-replay window.

    2. M

       mazinhoo

       2023-01-25

       Selected D1 upvote

       i think the correct answer here is D: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dplane/configuration/xe-16-8/sec-ipsec-data-plane-xe-16-8-book/sec-ipsec-antireplay.html#GUID-1FF00FBB-0746-48B2-A02A-2BB066BEDEF8

    3. A

       albee3_20

       2023-02-14

       Selected D1 upvote

       https://community.cisco.com/t5/vpn/ipsec-anti-replay-errors-on-1-gig-vpn-tunnel/td-p/4524103

    4. M

       mihaid

       2024-02-27

       Selected D1 upvote

       I would say D , but again fked up question that could also be A

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-730 practice, question 1 of 25