Category Archives: Cisco

Official 2014 Latest Cisco 350-030 Dump Free Download(1-10)!

QUESTION 1
IP phones A (extension 1001), B (extension 1002), and C (extension 1003) are registered to the CME system and are able to call each other by dialing each others’ extension numbers. However, when any of the phones attempt to transfer a call to any of the other phones they get a fast busy tone. How can the transfer issue be resolved? (Choose 2)

A.    Upgrade the IP phone firmware with the latest version.
B.    Reset the phonesso that the transfer capability will work.
C.    Add this command under “telephony service” on the CME system: transfer-pattern 1 . . .
or transfer-pattern . . . ‘
D.    Add this command under “telephony-service” on the CME system: transfer-system full-consult

Answer: BC

QUESTION 2
Which ports must be opened on an IOS firewall to allow successful H.225 RAS (Registration, Admission, and Status) message exchanges between an IOS gatekeeper and IOS H.323 gateways?

A.    TCP 1718 and TCP 1719
B.    UDP 1718 and TCP 1719
C.    UDP 1718 and UDP 1719
D.    UDP 1719 and UDP 1720
E.    TCP 1718 and TCP 1720

Answer: C

QUESTION 3
Company CADORNA’s INC. is planning a deployment of Cisco Contact Center Express and are looking for a design that provides maximum resilience, performance, and redundancy. They are planning to install Cisco CallManager 4.1(3) and Cisco Contact Center Express 4.0. How many CTI Managers can we configure in one cluster?

A.    1
B.    2
C.    4
D.    8
E.    16

Answer: D

QUESTION 4
Company CADORNA’s INC. is planning a deployment of Cisco IP Telephony using the Centralized Call Processing model, using Cisco CallManager 4.1(3). The company has 1 HQ and 25 branches interconnected with an MPLS network that provides “full-mesh” connectivity between all sites. Which of the following statements is NOT true?

A.    This topology implies that, from an IP routing perspective on the enterprise side of the network,
each site is one IP hop away from all other sites.
B.    From the Cisco CallManager’s call admission control perspective, a service-provider IP WAN service
based on MPLS is in reality equivalent to a hub-and-spoke topology without a hub site.
C.    This configuration requires that call admission control be performed on the central site link independently
of the branch links.
D.    The Cisco CallManager Servers need to be aware of the underlying MPLS network by setting the
appropriate Enterprise Parameters.
E.    All of the above statements are true.

Answer: D

QUESTION 5
If the CFNA and CFB are set to a hunt pilot number, what impact will the maximum hunt timer have on a call sent to the hunt pilot?

A.    The timer limits the number of seconds allotted for hunting through a hunt list.
B.    The timer limits the number of seconds the call will wait for an answer at each member of a line group.
C.    The timer limits the number of seconds a call will wait before being forwarded to a voice- messaging
system, a specific dialed number, or some personal treatment (if configured), or the call gets released.
D.    The timer allows limits on the number of seconds allotted to hunting through a line group.

Answer: A

QUESTION 6
Two ports on a 3600 gateway platform are stuck in the EM_PARK state. What are two possible causes of this problem? (Choose 2)

A.    A call is parked and no one has answered.
B.    A fake answer has been configured on the router.
C.    The DSP is having hardware or software issues.
D.    The PSTN switch / PBX is sending a continuous off-hook signal

Answer: CD

QUESTION 7
Which of the following is NOT true about DHCP snooping?

A.    DHCP snooping is a feature that provides network security by filtering untrusted DHCP messages
and by building and maintaining a DHCP snooping binding database.
B.    For DHCP snooping to function properly, all DHCP servers must be connected to the switch through
trusted interfaces.
C.    DHCP Snooping is enabled by VLAN.
D.    DHCP Snooping has the capability to use rate limiting.
E.    DHCP Snooping stops Man-in-the-Middle (MITM) Attacks

Answer: E

QUESTION 8
Acme Widgets Inc. wants to compress the voice data traveling over their WAN connection to their parent company. They are presently using the G.729 loading two voice frames per packet. When they implement cRTP using the ip rtp header-compression command, what will be the bandwidth consumption per call over the HDLC WAN link?

A.    8.0 kbps
B.    8.8 kbps
C.    9.6 kbps
D.    12.0 kbps
E.    16.0 kbps

Answer: C

QUESTION 9
Which two conditions will result in an H.323 gatekeeper receiving an ARQ from a registered H.323 endpoint? (Choose two.)

A.    A remote zone endpoint initiates a call.
B.    A local zone endpoint requests permission to admit an incoming call.
C.    A remote zone endpoint sends keepalive to ensure registration continuity.
D.    A remote zone gatekeeper initiates a call.
E.    A local zone endpoint initiates a call.
F.    A local zone endpoint sends keepalive to ensure registration continuity.

Answer: BE

QUESTION 10
Match the IP Multicast Components as per their simple definitions.
1) Basic Multicast
2) Reliable Multicast
3) One-to-Many Multicast
4) Inter-Domain Multicast
5) Many-to-Many Multicast
a. MBGP , MSDP, Anycast RP, RGMP, BSR
b. SSM and IGMP v3
c. PIM – Bi-Directional
d. PGM
e. PIM SM, DM, Auto RP, IGMP v2, CGMP

A.    1 – d, 2 – b, 3 – c, 4 – e, 5 – a
B.    1 – e, 2 – c, 3 – a, 4 – d, 5 – b
C.    1 – e, 2 – d, 3 – b, 4 – a, 5 – c
D.    1 – a, 2 – b, 3 – c, 4 – d, 5 – e

Answer: C

If you want to pass the Cisco 350-030 Exam sucessfully, recommend to read latest Cisco 350-030 Dump full version.

clip_image001

Official 2014 Latest Cisco 300-209 Dump Free Download(81-89)!

QUESTION 81
Which other match command is used with the match flow ip destination-address command within the class map configurations of the Cisco ASA MPF?

A.    match tunnel-group
B.    match access-list
C.    match default-inspection-traffic
D.    match port
E.    match dscp

Answer: A

QUESTION 82
Which Cisco ASA configuration is used to configure the TCP intercept feature?

A.    a TCP map
B.    an access list
C.    the established command
D.    the set connection command with the embryonic-conn-max option
E.    a type inspect policy map

Answer: D

QUESTION 83
On which type of encrypted traffic can a Cisco ASA appliance running software version 8.4.1 perform application inspection and control?

A.    IPsec
B.    SSL
C.    IPsec or SSL
D.    Cisco Unified Communications
E.    Secure FTP

Answer: D

QUESTION 84
The Cisco ASA software image has been erased from flash memory. Which two statements about the process to recover the Cisco ASA software image are true? (Choose two.)

A.    Access to the ROM monitor mode is required.
B.    The Cisco ASA appliance must have connectivity to the TFTP server where the Cisco ASA image is
stored through the Management 0/0 interface.
C.    The copy tftp flash command is necessary to start the TFTP file transfer.
D.    The server command is necessary to set the TFTP server IP address.
E.    Cisco ASA password recovery must be enabled
Answer: AD

QUESTION 85
Which two Cisco ASA licensing features are correct with Cisco ASA Software Version 8.3 and later? (Choose two.)

A.    Identical licenses are not required on the primary and secondary Cisco ASA appliance.
B.    Cisco ASA appliances configured as failover pairs disregard the time-based activation keys.
C.    Time-based licenses are stackable in duration but not in capacity.
D.    A time-based license completely overrides the permanent license, ignoring all permanently licensed
features until the time-based license is uninstalled.

Answer: AC

QUESTION 86
Which three actions can be applied to a traffic class within a type inspect policy map? (Choose three.)

A.    drop
B.    priority
C.    log
D.    pass
E.    inspect
F.    reset

Answer: ACF

QUESTION 87
Which Cisco ASA platform should be selected if the requirements are to support 35,000 connections per second, 600,000 maximum connections, and traffic shaping?

A.    5540
B.    5550
C.    5580-20
D.    5580-40

Answer: B

QUESTION 88
Authorization of a clientless SSL VPN defines the actions that a user may perform within a clientless SSL VPN session. Which statement is correct concerning the SSL VPN authorization process?

A.    Remote clients can be authorized by applying a dynamic access policy, which is configured on an
external AAA server.
B.    Remote clients can be authorized externally by applying group parameters from an external database.
C.    Remote client authorization is supported by RADIUS and TACACS+ protocols.
D.    To configure external authorization, you must configure the Cisco ASA for cut-through proxy.

Answer: B

QUESTION 89
Which Cisco ASA SSL VPN feature provides support for PCI compliance by allowing for the validation of two sets of username and password credentials on the SSL VPN login page?

A.    Single Sign-On
B.    Certificate to Profile Mapping
C.    Double Authentication
D.    RSA OTP

Answer: C

If you want to pass the Cisco 300-209 Exam sucessfully, recommend to read latest Cisco 300-209 Dumpfull version.

clip_image001

Official 2014 Latest Cisco 300-209 Dump Free Download(71-80)!

QUESTION 71
When implementing GET VPN, which of these is a characteristic of GDOI IKE?

A.    GDOI IKE sessions are established between all peers in the network
B.    GDOI IKE uses UDP port 500
C.    Security associations do not need to linger between members once a group member has authenticated
to the key server and obtained the group policy
D.    Each pair of peers has a private set of IPsec security associations that is only shared between the
two peers

Answer: C

QUESTION 72
Which two features are required when configuring a DMVPN network? (Choose two.)

A.    Dynamic routing protocol
B.    GRE tunnel interface
C.    Next Hop Resolution Protocol
D.    Dynamic crypto map
E.    IPsec encryption

Answer: BC

QUESTION 73
When you are configuring a DMVPN network, which tunnel mode should you use for the hub router configuration?

A.    GRE multipoint
B.    classic point-to-point GRE
C.    IPsec multipoint
D.    nonbroadcast multiaccess

Answer: A

QUESTION 74
Which Cisco IOS feature provides secure, on-demand meshed connectivity?

A.    Easy VPN
B.    IPsec VPN
C.    mGRE
D.    DMVPN

Answer: D

QUESTION 75
Which of these is true regarding tunnel configuration when deploying a Cisco ISR as a DMVPN hub router?

A.    Only one tunnel can be created per tunnel source interface.
B.    Only one tunnel can be created and should be associated with a loopback interface for dynamic
redundancy
C.    The GRE tunnel key is used to encrypt the traffic going through the tunnel through the hub.
D.    You can run multiple parallel DMVPNs on the hub router, but each tunnel requires a unique tunnel key.

Answer: D

QUESTION 76
When you are configuring a hub-and-spoke DMVPN network, which tunnel mode should you use for the spoke router configuration?

A.    GRE multipoint
B.    Classis point-to-point GRE
C.    IPsec multipoint
D.    Nonbroadcast multiaccess

Answer: B

QUESTION 77
With Cisco ASA active/standby failover, by default, how many monitored interface failures will cause failover to occur?

A.    1
B.    2
C.    3
D.    4
E.    5

Answer: A

QUESTION 78
Which two statements about the running configuration of the Cisco ASA are true? (Choose Two)

A.    The auto NAT configuration causes all traffic arriving on the inside interface destined to any outside
destinations to be translated with dynamic port address transmission using the outside interface
IP address.
B.    The Cisco ASA is using the Cisco ASDM image from disk1:/asdm-642.bin
C.    The Cisco ASA is setup as the DHCP server for hosts that are on the inside and outside interfaces.
D.    SSH and Cisco ASDM access to the Cisco ASA requires AAA authentication using the LOCAL
user database.
E.    The Cisco ASA is using a persistent self-signed certified so users can authenticate the Cisco ASA
when accessing it via ASDM

Answer: AE

QUESTION 79
Which option lists the main tasks in the correct order to configure a new Layer 3 and 4 inspection policy on the Cisco ASA appliance using the Cisco ASDM Configuration > Firewall > Service Policy Rules pane?

A.    1. Create a class map to identify which traffic to match.
2. Create a policy map and apply action(s) to the traffic class(es).
3. Apply the policy map to an interface or globally using a service policy.
B.    1. Create a service policy rule.
2. Identify which traffic to match.
3. Apply action(s) to the traffic.
C.    1. Create a Layer 3 and 4 type inspect policy map.
2. Create class map(s) within the policy map to identify which traffic to match.
3. Apply the policy map to an interface or globally using a service policy.
D.    1. Identify which traffic to match.
2. Apply action(s) to the traffic.
3. Create a policy map.
4. Apply the policy map to an interface or globally using a service policy.

Answer: B

QUESTION 80
By default, how does a Cisco ASA appliance process IP fragments?

A.    Each fragment passes through the Cisco ASA appliance without any inspections.
B.    Each fragment is blocked by the Cisco ASA appliance.
C.    The Cisco ASA appliance verifies each fragment and performs virtual IP re-assembly before the
full IP packet is forwarded out.
D.    The Cisco ASA appliance forwards the packet out as soon as all of the fragments of the packet
have been received.

Answer: C

If you want to pass the Cisco 300-209 Exam sucessfully, recommend to read latest Cisco 300-209 Dumpfull version.

clip_image001

Official 2014 Latest Cisco 300-209 Dump Free Download(61-70)!

QUESTION 61
Which three settings are required for crypto map configuration? (Choose three.)

A.    match address
B.    set peer
C.    set transform-set
D.    set security-association lifetime
E.    set security-association level per-host
F.    set pfs

Answer: ABC

QUESTION 62
A network is configured to allow clientless access to resources inside the network. Which feature must be enabled and configured to allow SSH applications to respond on the specified port 8889?

A.    auto applet download
B.    port forwarding
C.    web-type ACL
D.    HTTP proxy

Answer: B

QUESTION 63
Consider this scenario. When users attempt to connect via a Cisco AnyConnect VPN session, the certificate has changed and the connection fails.
What is a possible cause of the connection failure?

A.    An invalid modulus was used to generate the initial key.
B.    The VPN is using an expired certificate.
C.    The Cisco ASA appliance was reloaded.
D.    The Trusted Root Store is configured incorrectly.

Answer: C

QUESTION 64
In the Cisco ASDM interface, where do you enable the DTLS protocol setting?

A.    Configuration > Remote Access VPN > Network (Client) Access > Group Policies > Add or Edit >
Add or Edit Internal Group Policy
B.    Configuration > Remote Access VPN > Network (Client) Access > AAA Setup > Local Users > Add or Edit
C.    Device Management > Users/AAA > User Accounts > Add or Edit > Add or Edit User Account >
VPN Policy > SSL VPN Client
D.    Configuration > Remote Access VPN > Network (Client) Access > Group Policies > Add or Edit

Answer: D

QUESTION 65
What are two forms of SSL VPN? (Choose two.)

A.    port forwarding
B.    Full Tunnel Mode
C.    Cisco IOS WebVPN
D.    Cisco AnyConnect

Answer: AB

QUESTION 66
When Cisco ASA applies VPN permissions, what is the first set of attributes that it applies?

A.    dynamic access policy attributes
B.    group policy attributes
C.    connection profile attributes
D.    user attributes

Answer: A

QUESTION 67
What are two variables for configuring clientless SSL VPN single sign-on? (Choose two.)

A.    CSCO_WEBVPN_OTP_PASSWORD
B.    CSCO_WEBVPN_INTERNAL_PASSWORD
C.    CSCO_WEBVPN_USERNAME
D.    CSCO_WEBVPN_RADIUS_USER

Answer: BC

QUESTION 68
An internet-based VPN solution is being considered to replace anexisting private WAN connectingremote offices. A multimedia application is used that relies on multicast for communication. Which two VPN solutions meet the application’s network requirement? (Choose two.)

A.    FlexVPN
B.    DMVPN
C.    Group Encrypted Transport VPN
D.    Crypto-map based Site-to-Site IPsec VPNs
E.    AnyConnect VPN

Answer: AB

QUESTION 69
In a GET VPN solution, which two ways can the key server distribute the new keys to the group members during the rekey process? (Choose two.)

A.    multicast UDP transmission
B.    multicast TCP transmission
C.    unicast UDP transmission
D.    unicast TCP transmission

Answer: AC

QUESTION 70
An IOS SSL VPN is configured to forward TCP ports. A remote user cannot access the corporate FTP site with a Web browser. What is a possible reason for the failure?

A.    The user’s FTP application is not supported.
B.    The user is connecting to an IOS VPN gateway configured in Thin Client Mode.
C.    The user is connecting to an IOS VPN gateway configured in Tunnel Mode.
D.    The user’s operating system is not supported.

Answer: B

If you want to pass the Cisco 300-209 Exam sucessfully, recommend to read latest Cisco 300-209 Dumpfull version.

clip_image001

Official 2014 Latest Cisco 300-209 Dump Free Download(51-60)!

QUESTION 51
A company has decided to migrate an existing IKEv1 VPN tunnel to IKEv2. Which two arevalid configuration constructs on a Cisco IOS router? (Choose two.)

A.    crypto ikev2 keyring keyring-name
peer peer1
address 209.165.201.1 255.255.255.255
pre-shared-key local key1
pre-shared-key remote key2
B.    crypto ikev2 transform-set transform-set-name esp-3des esp-md5-hmac
esp-aes esp-sha-hmac
C.    crypto ikev2 map crypto-map-name
set crypto ikev2 tunnel-group tunnel-group-name
set crypto ikev2 transform-set transform-set-name
D.    crypto ikev2 tunnel-group tunnel-group-name
match identity remote address 209.165.201.1
authentication local pre-share
authentication remote pre-share
E.    crypto ikev2 profile profile-name
match identity remote address 209.165.201.1
authentication local pre-share
authentication remote pre-share

Answer: AE

QUESTION 52
Guaranteed success with TestInsides practice guides 2 Cisco 300-209 : Practice Test
Which four activities does the Key Server perform in a GETVPN deployment? (Choose four.)

A.    authenticates group members
B.    manages security policy
C.    creates group keys
D.    distributes policy/keys
E.    encrypts endpoint traffic
F.    receives policy/keys
G.    defines group members

Answer: ABCD

QUESTION 53
Where is split-tunneling defined for remote access clients on an ASA?

A.    Group-policy
B.    Tunnel-group
C.    Crypto-map
D.    Web-VPN Portal
E.    ISAKMP client

Answer: A

QUESTION 54
Which of the following could be used to configure remote access VPN Host-scan and pre- login policies?

A.    ASDM
B.    Connection-profile CLI command
C.    Host-scan CLI command under the VPN group policy
D.    Pre-login-check CLI command

Answer: A

QUESTION 55
Guaranteed success with TestInsides practice guides 3 Cisco 300-209 : Practice Test
In FlexVPN, what command can an administrator use to create a virtual template interface that can be configured and applied dynamically to create virtual access interfaces?

A.    interface virtual-template number type template
B.    interface virtual-template number type tunnel
C.    interface template number type virtual
D.    interface tunnel-template number

Answer: B

QUESTION 56
In FlexVPN, what is the role of a NHRP resolution request?

A.    It allows these entities to directly communicate without requiring traffic to use an intermediate hop
B.    It dynamically assigns VPN users to a group
C.    It blocks these entities from to directly communicating with each other
D.    It makes sure that each VPN spoke directly communicates with the hub

Answer: A

QUESTION 57
What are three benefits of deploying a GET VPN? (Choose three.)

A.    It provides highly scalable point-to-point topologies.
B.    It allows replication of packets after encryption.
C.    It is suited for enterprises running over a DMVPN network.
D.    It preserves original source and destination IP address information.
E.    It simplifies encryption management through use of group keying.
F.    It supports non-IP protocols.

Answer: BDE

QUESTION 58
What is the default topology type for a GET VPN?

A.    point-to-point
B.    hub-and-spoke
C.    full mesh
D.    on-demand spoke-to-spoke

Answer: C

QUESTION 59
Which two GDOI encryption keys are used within a GET VPN network? (Choose two.)

A.    key encryption key
B.    group encryption key
C.    user encryption key
D.    traffic encryption key

Answer: AD

QUESTION 60
What are the three primary components of a GET VPN network? (Choose three.)

A.    Group Domain of Interpretation protocol
B.    Simple Network Management Protocol
C.    server load balancer
D.    accounting server
E.    group member
F.    key server

Answer: AEF

If you want to pass the Cisco 300-209 Exam sucessfully, recommend to read latest Cisco 300-209 Dumpfull version.

clip_image001

Official 2014 Latest Cisco 300-209 Dump Free Download(41-50)!

QUESTION 41
Guaranteed success with TestInsides practice guides 22 Cisco 300-209 : Practice Test
Which NGE IKE Diffie-Hellman group identifier has the strongest cryptographic properties?

A.    group 20
B.    group 24
C.    group 5
D.    group 20

Answer: D

QUESTION 42
What is the Cisco recommended TCP maximum segment on a DMVPN tunnel interface when the MTU is set to 1400 bytes?

A.    1160 bytes
B.    1260 bytes
C.    1360 bytes
D.    1240 bytes

Answer: C

QUESTION 43
Which technology does a multipoint GRE interface require to resolve endpoints?

A.    ESP
B.    dynamic routing
C.    NHRP
D.    CEF
E.    IPSec

Answer: C

QUESTION 44
Which two cryptographic technologies are recommended for use with FlexVPN? (Choose two.)

A.    SHA (HMAC variant)
B.    Diffie-Hellman
C.    DES
D.    MD5 (HMAC variant)

Answer: AB

QUESTION 45
Which command configures IKEv2 symmetric identity authentication?

A.    match identity remote address 0.0.0.0
B.    authentication local pre-share
C.    authentication pre-share
D.    authentication remote rsa-sig

Answer: D

QUESTION 46
Which two examples of transform sets are contained in the IKEv2 default proposal? (Choose two.)

A.    aes-cbc-192, sha256, 14
B.    3des, md5, 5
C.    3des, sha1, 1
D.    aes-cbc-128, sha, 5

Answer: BD

QUESTION 47
What is the default storage location of user-level bookmarks in an IOS clientless SSL VPN?

A.    disk0:/webvpn/{context name}/
B.    disk1:/webvpn/{context name}/
C.    flash:/webvpn/{context name}/
D.    nvram:/webvpn/{context name}/

Answer: C

QUESTION 48
Which command will prevent a group policy from inheriting a filter ACL in a clientless SSL VPN?

A.    vpn-filter none
B.    no vpn-filter
C.    filter value none
D.    filter value ACLname

Answer: C

QUESTION 49
Which command specifies the path to the Host Scan package in an ASA AnyConnect VPN?

A.    csd hostscan path image
B.    csd hostscan image path
C.    csd hostscan path
D.    hostscan image path

Answer: B

QUESTION 50
Which two are characteristics of GETVPN? (Choose two.)

A.    The IP header of the encrypted packet is preserved
B.    A key server is elected among all configured Group Members
C.    Unique encryption keys are computed for each Group Member
D.    The same key encryption and traffic encryption keys are distributed to all Group Members

Answer: AD

If you want to pass the Cisco 300-209 Exam sucessfully, recommend to read latest Cisco 300-209 Dumpfull version.

clip_image001

Official 2014 Latest Cisco 300-209 Dump Free Download(31-40)!

QUESTION 31
A Cisco IOS SSL VPN gateway is configured to operate in clientless mode so that users can access file shares on a Microsoft Windows 2003 server. Which protocol is used between the Cisco IOS router and the Windows server?

A.    HTTPS
B.    NetBIOS
C.    CIFS
D.    HTTP

Answer: C

QUESTION 32
You are configuring a Cisco IOS SSL VPN gateway to operate with DVTI support. Which command must you configure on the virtual template?

A.    tunnel protection ipsec
B.    ip virtual-reassembly
C.    tunnel mode ipsec
D.    ip unnumbered

Answer: D

QUESTION 33
Guaranteed success with TestInsides practice guides 19 Cisco 300-209 : Practice Test
Which protocol supports high availability in a Cisco IOS SSL VPN environment?

A.    HSRP
B.    VRRP
C.    GLBP
D.    IRDP

Answer: A

QUESTION 34
When you configure IPsec VPN High Availability Enhancements, which technology does Cisco recommend that you enable to make reconvergence faster?

A.    EOT
B.    IP SLAs
C.    periodic IKE keepalives
D.    VPN fast detection

Answer: C

QUESTION 35
Which hash algorithm is required to protect classified information?

A.    MD5
B.    SHA-1
C.    SHA-256
D.    SHA-384

Answer: D

QUESTION 36
Which cryptographic algorithms are approved to protect Top Secret information?

A.    HIPPA DES
B.    AES-128
C.    RC4-128
D.    AES-256

Answer: D

QUESTION 37
Which Cisco firewall platform supports Cisco NGE?

A.    FWSM
B.    Cisco ASA 5505
C.    Cisco ASA 5580
D.    Cisco ASA 5525-X

Answer: D

QUESTION 38
Which algorithm is replaced by elliptic curve cryptography in Cisco NGE?

A.    3DES
B.    AES
C.    DES
D.    RSA

Answer: D

QUESTION 39
Which encryption and authentication algorithms does Cisco recommend when deploying a Cisco NGE supported VPN solution?

A.    AES-GCM and SHA-2
B.    3DES and DH
C.    AES-CBC and SHA-1
D.    3DES and SHA-1

Answer: A

QUESTION 40
An administrator wishes to limit the networks reachable over the Anyconnect VPN tunnels. Which configuration on the ASA will correctly limit the networks reachable to 209.165.201.0/27 and 209.165.202.128/27?

A.    access-list splitlist standard permit 209.165.201.0 255.255.255.224
access-list splitlist standard permit 209.165.202.128 255.255.255.224 !
group-policy GroupPolicy1 internal
group-policy GroupPolicy1 attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list value splitlist
B.    access-list splitlist standard permit 209.165.201.0 255.255.255.224
access-list splitlist standard permit 209.165.202.128 255.255.255.224 !
group-policy GroupPolicy1 internal
group-policy GroupPolicy1 attributes
split-tunnel-policy tunnelall
split-tunnel-network-list value splitlist
C.    group-policy GroupPolicy1 internal
group-policy GroupPolicy1 attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list ipv4 1 209.165.201.0 255.255.255.224
split-tunnel-network-list ipv4 2 209.165.202.128 255.255.255.224
D.    access-list splitlist standard permit 209.165.201.0 255.255.255.224
access-list splitlist standard permit 209.165.202.128 255.255.255.224 !
crypto anyconnect vpn-tunnel-policy tunnelspecified
crypto anyconnect vpn-tunnel-network-list splitlist
E.    crypto anyconnect vpn-tunnel-policy tunnelspecified
crypto anyconnect split-tunnel-network-list ipv4 1 209.165.201.0 255.255.255.224
crypto anyconnect split-tunnel-network-list ipv4 2 209.165.202.128 255.255.255.224

Answer: A

If you want to pass the Cisco 300-209 Exam sucessfully, recommend to read latest Cisco 300-209 Dumpfull version.

clip_image001

Official 2014 Latest Cisco 300-209 Dump Free Download(21-30)!

QUESTION 21
Which statement is true when implementing a router with a dynamic public IP address in a crypto map based site-to-site VPN?

A.    The router must be configured with a dynamic crypto map.
B.    Certificates are always used for phase 1 authentication.
C.    The tunnel establishment will fail if the router is configured as a responder only.
D.    The router and the peer router must have NAT traversal enabled.

Answer: C

QUESTION 22
Which two statements are true when designing a SSL VPN solution using Cisco AnyConnect? (Choose two.)

A.    The VPN server must have a self-signed certificate.
B.    A SSL group pre-shared key must be configured on the server.
C.    Server side certificate is optional if using AAA for client authentication.
D.    The VPN IP address pool can overlap with the rest of the LAN networks.
E.    DTLS can be enabled for better performance.

Answer: DE

QUESTION 23
Refer to the exhibit. Given the partial configuration shown, which two statements are correct? (Choose two.)

A.    The tunnel will use the routing protocol configured for GigabitEthemet 1/1 for all tunnel
communication with the peer.
B.    The IP route statement to reach the remote network behind the DMVPN peer is incorrect, it
should be ip route 192.168.2.0 255.255.255.0 tunnel 0.
C.    This is an example of a static point-to-point VTI tunnel.
D.    The tunnel will use esp-sha-hmac encryption in ESP tunnel mode.
E.    The tunnel will use 128-bit AES encryption in ESP tunnel mode.

Answer: CE

QUESTION 24
What are two benefits of DMVPN Phase 3? (Choose two.)

A.    Administrators can use summarization of routing protocol updates from hub to spokes.
B.    It introduces hierarchical DMVPN deployments.
C.    It introduces non-hierarchical DMVPN deployments.
D.    It supports L2TP over IPSec as one of the VPN protocols.

Answer: AB

QUESTION 25
Which are two main use cases for Clientless SSL VPN? (Choose two.)

A.    In kiosks that are part of a shared environment
B.    When the users do not have admin rights to install a new VPN client
C.    When full tunneling is needed to support applications that use TCP, UDP, and ICMP
D.    To create VPN site-to-site tunnels in combination with remote access

Answer: AB

QUESTION 26
Which technology can rate-limit the number of tunnels on a DMVPN hub when system utilization is above a specified percentage?

A.    NHRP Event Publisher
B.    interface state control
C.    CAC
D.    NHRP Authentication
E.    ip nhrp connect

Answer: C

QUESTION 27
Which technology supports tunnel interfaces while remaining compatible with legacy VPN implementations?

A.    FlexVPN
B.    DMVPN
C.    GET VPN
D.    SSL VPN

Answer: A

QUESTION 28
Which IKEv2 feature minimizes the configuration of a FlexVPN on Cisco IOS devices?

A.    IKEv2 Suite-B
B.    IKEv2 proposals
C.    IKEv2 profiles
D.    IKEv2 Smart Defaults

Answer: D

QUESTION 29
When an IPsec SVTI is configured, which technology processes traffic forwarding for encryption?

A.    ACL
B.    IP routing
C.    RRI
D.    front door VPN routing and forwarding

Answer: B

QUESTION 30
Which Cisco IOS VPN feature simplifies IPsec VPN configuration and design by using on-demand virtual access interfaces that are cloned from a virtual template configuration?

A.    GET VPN
B.    dynamic VTI
C.    static VTI
D.    GRE tunnels
E.    GRE over IPsec tunnels
F.    DMVPN

Answer: B

If you want to pass the Cisco 300-209 Exam sucessfully, recommend to read latest Cisco 300-209 Dumpfull version.

clip_image001

Official 2014 Latest Cisco 300-209 Dump Free Download(11-20)!

QUESTION 11
A user is unable to establish an AnyConnect VPN connection to an ASA. When using the Real-Time Log viewer within ASDM to troubleshoot the issue, which two filter options would the administrator choose to show only syslog messages relevant to the VPN connection? (Choose two.)

A.    Client’s public IP address
B.    Client’s operating system
C.    Client’s default gateway IP address
D.    Client’s username
E.    ASA’s public IP address

Answer: AD

QUESTION 12
Which Cisco ASDM option configures forwarding syslog messages to email?

A.    Configuration > Device Management > Logging > E-Mail Setup
B.    Configuration > Device Management > E-Mail Setup > Logging Enable
C.    Select the syslogs to email, click Edit, and select the Forward Messages option.
D.    Select the syslogs to email, click Settings, and specify the Destination Email Address option.

Answer: A

QUESTION 13
Which Cisco ASDM option configures WebVPN access on a Cisco ASA?

A.    Configuration > WebVPN > WebVPN Access
B.    Configuration > Remote Access VPN > Clientless SSL VPN Access
C.    Configuration > WebVPN > WebVPN Config
D.    Configuration > VPN > WebVPN Access

Answer: B

QUESTION 14
A user with IP address 10.10.10.10 is unable to access a HTTP website at IP address
209.165.200.225 through a Cisco ASA. Which two features and commands will help
troubleshoot the issue? (Choose two.)

A.    Capture user traffic using command capture capin interface inside match ip host
10.10.10.10 any
B.    After verifying that user traffic reaches the firewall using syslogs or captures, use packet tracer command
packet-tracer input inside tcp 10.10.10.10 1234 209.165.200.225 80
C.    Enable logging at level 1 and check the syslogs using commands logging enable, logging buffered 1 and
show logging | include 10.10.10.10
D.    Check if an access-list on the firewall is blocking the user by using command show running-config
access-list | include 10.10.10.10
E.     Use packet tracer command packet-tracer input inside udp 0.10.10.10 1234192.168.1.3 161 to see
what the firewall is doing with the user’s traffic

Answer: AB

QUESTION 15
A Cisco router may have a fan issue that could increase its temperature and trigger a failure. What troubleshooting steps would verify the issue without causing additional risks?

A.    Configure logging using commands “logging on”, “logging buffered 4”, and check for fan failure logs
using “show logging”
B.    Configure logging using commands “logging on”, “logging buffered 6”, and check for fan failure logs
using “show logging”
C.    Configure logging using commands “logging on”, “logging discriminator msglog1 console 7”, and check
for fan failure logs using “show logging”
D.    Configure logging using commands “logging host 10.11.10.11”, “logging trap 2”, and check for fan failure
logs at the syslog server 10.11.10.11

Answer: A

QUESTION 16
Which of these are the two types of keys used when implementing GET VPN? (Choose two)

A.    key encryption
B.    group encryption
C.    pre-shared key
D.    public key
E.    private key
F.    traffic encryption key

Answer: AF

QUESTION 17
A private wan connection is suspected of intermittently corrupting data. Which technology can a network administrator use to detect and drop the altered data traffic?

A.    AES-128
B.    RSA Certificates
C.    SHA2-HMAC
D.    3DES
E.    Diffie-Helman Key Generation

Answer: C

QUESTION 18
A company needs to provide secure access to its remote workforce. The end users use
public kiosk computers and a wide range of devices. They will be accessing only an internal web application. Which VPN solution satisfies these requirements?

A.    Clientless SSLVPN
B.    AnyConnect Client using SSLVPN
C.    AnyConnect Client using IKEv2
D.    FlexVPN Client
E.    Windows built-in PPTP client

Answer: A

QUESTION 19
A network administrator is configuring AES encryption for the ISAKMP policy on an IOS router. Which two configurations are valid? (Choose two.)

A.    crypto isakmp policy 10
encryption aes 254
B.    crypto isakmp policy 10
encryption aes 192
C.    crypto isakmp policy 10
encryption aes 256
D.    crypto isakmp policy 10
encryption aes 196
E.    crypto isakmp policy 10
encryption aes 192
F.    crypto isakmp policy 10
encryption aes 64

Answer: BC

QUESTION 20
Which two qualify as Next Generation Encryption integrity algorithms? (Choose two.)

A.    SHA-512
B.    SHA-256
C.    SHA-192
D.    SHA-380
E.    SHA-192
F.    SHA-196

Answer: AB

If you want to pass the Cisco 300-209 Exam sucessfully, recommend to read latest Cisco 300-209 Dumpfull version.

clip_image001

Official 2014 Latest Cisco 300-209 Dump Free Download(1-10)!

QUESTION 1
Which two IKEv1 policy options must match on each peer when you configure an IPsec site-to-site VPN? (Choose two.)

A.    priority number
B.    hash algorithm
C.    encryption algorithm
D.    session lifetime
E.    PRF algorithm

Answer: BC

QUESTION 2
Which two parameters are configured within an IKEv2 proposal on an IOS router? (Choose two.)

A.    authentication
B.    encryption
C.    integrity
D.    lifetime

Answer: BC

QUESTION 3
In a spoke-to-spoke DMVPN topology, which type of interface does a branch router require?

A.    virtual tunnel interface
B.    multipoint GRE interface
C.    point-to-point GRE interface
D.    loopback interface

Answer: B

QUESTION 4
To change the title panel on the logon page of the Cisco IOS WebVPN portal, which file must you configure?

A.    Cisco IOS WebVPN customization template
B.    Cisco IOS WebVPN customization general
C.    web-access-hlp.inc
D.    app-access-hlp.inc

Answer: A

QUESTION 5
Which three plugins are available for clientless SSL VPN? (Choose three.)

A.    CIFS
B.    RDP2
C.    SSH
D.    VNC
E.    SQLNET
F.    ICMP

Answer: BCD

QUESTION 6
Which command simplifies the task of converting an SSL VPN to an IKEv2 VPN on a Cisco ASA appliance that has an invalid IKEv2 configuration?

A.    migrate remote-access ssl overwrite
B.    migrate remote-access ikev2
C.    migrate l2l
D.    migrate remote-access ssl

Answer: A

QUESTION 7
Guaranteed success with TestInsides practice guides 10 Cisco 300-209 : Practice Test
Which statement describes a prerequisite for single-sign-on Netegrity Cookie Support in an IOC SSL VPN?

A.    The Cisco AnyConnect Secure Mobility Client must be installed in flash.
B.    A SiteMinder plug-in must be installed on the Cisco SSL VPN gateway.
C.    A Cisco plug-in must be installed on a SiteMinder server.
D.    The Cisco Secure Desktop software package must be installed in flash.

Answer: C

QUESTION 8
Which two statements describe effects of the DoNothing option within the untrusted network policy on a Cisco AnyConnect profile? (Choose two.)

A.    The client initiates a VPN connection upon detection of an untrusted network.
B.    The client initiates a VPN connection upon detection of a trusted network.
C.    The always-on feature is enabled.
D.    The always-on feature is disabled.
E.    The client does not automatically initiate any VPN connection.

Answer: AD

QUESTION 9
Which command enables IOS SSL VPN Smart Tunnel support for PuTTY?

A.    appl ssh putty.exe win
B.    appl ssh putty.exe windows
C.    appl ssh putty
D.    appl ssh putty.exe

Answer: B

QUESTION 10
Which three remote access VPN methods in an ASA appliance provide support for Cisco
Secure Desktop? (Choose three.)

A.    IKEv1
B.    IKEv2
C.    SSL client
D.    SSL clientless
E.    ESP
F.    L2TP

Answer: BCD

If you want to pass the Cisco 300-209 Exam sucessfully, recommend to read latest Cisco 300-209 Dump full version.

clip_image001

Free 2014 Cisco 200-101 Dump (91-96) Download!

QUESTION 91
Which three statements about the features of SNMPv2 and SNMPv3 are true? (Choose three.)

A.    SNMPv3 enhanced SNMPv2 security features.
B.    SNMPv3 added the Inform protocol message to SNMP.
C.    SNMPv2 added the Inform protocol message to SNMP.
D.    SNMPv3 added the GetBulk protocol messages to SNMP.
E.    SNMPv2 added the GetBulk protocol message to SNMP.
F.    SNMPv2 added the GetNext protocol message to SNMP.

Answer: ACE

QUESTION 92
What Cisco IOS feature can be enabled to pinpoint an application that is causing slow network performance?

A.    SNMP
B.    Netflow
C.    WCCP
D.    IP SLA

Answer: B

QUESTION 93
In a GLBP network, who is responsible for the arp request?

A.    AVF
B.    AVG
C.    Active Router
D.    Standby Router

Answer: B

QUESTION 94
In GLBP, which router will respond to client ARP requests?

A.    The active virtual gateway will reply with one of four possible virtual MAC addresses.
B.    All GLBP member routers will reply in round-robin fashion.
C.    The active virtual gateway will reply with its own hardware MAC address.
D.    The GLBP member routers will reply with one of four possible burned in hardware addresses.

Answer: A

QUESTION 95
Which three statements about HSRP operation are true? (Choose three.)

A.    The virtual IP address and virtual MA+K44C address are active on the HSRP Master router.
B.    The HSRP default timers are a 3 second hello interval and a 10 second dead interval.
C.    HSRP supports only clear-text authentication.
D.    The HSRP virtual IP address must be on a different subnet than the routers’ interfaces on the same LAN.
E.    The HSRP virtual IP address must be the same as one of the router’s interface addresses on the LAN.
F.    HSRP supports up to 255 groups per interface, enabling an administrative form of load balancing.

Answer: ABF

QUESTION 96
What is a valid HSRP virtual MAC address?

A.    0000.5E00.01A3
B.    0007.B400.AE01
C.    0000.0C07.AC15
D.    0007.5E00.B301

Answer: C

If you want to pass the Cisco 200-101 Exam sucessfully, recommend to read latest Cisco 200-101 Dumpfull version.

clip_image001

Pages: 1 2 ... 98 99 100 101 102 103 104 105