300-209 Exam
[Real] 300-209 Cisco book 11-20 (Sep 2021)
We provide real 300-209 exam questions and answers braindumps in two formats. Download PDF & Practice Tests. Pass Cisco 300-209 Exam quickly & easily. The 300-209 PDF type is available for reading and printing. You can print more and practice many times. With the help of our Cisco 300-209 dumps pdf and vce product and material, you can easily pass the 300-209 exam.
Q11. Which statement regarding GET VPN is true?
A. TEK rekeys can be load-balanced between two key servers operating in COOP.
B. When you implement GET VPN with VRFs, all VRFs must be defined in the GDOI group configuration on the key server.
C. Group members must acknowledge all KEK and TEK rekeys, regardless of configuration.
D. The configuration that defines which traffic to encrypt is present only on the key server.
E. The pseudotime that is used for replay checking is synchronized via NTP.
Answer: D
Q12. As network consultant, you are asked.to suggest a VPN technology that can support a multivendor environment and secure traffic between sites. Which technology should you recommend?
A. DMVPN
B. FlexVPN
C. GET VPN
D. SSL VPN
Answer: B
Q13. A custom desktop application needs to access an internal server. An administrator is tasked with configuring the company's SSL VPN gateway to allow remote users to work. Which two technologies would accommodate the company's requirement? (Choose two).
A. AnyConnect client
B. Smart Tunnels
C. Email Proxy
D. Content Rewriter
E. Portal Customizations
Answer: A,B
Q14. In a spoke-to-spoke DMVPN topology, which type of interface does a branch router require?
A. Virtual tunnel interface
B. Multipoint GRE interface
C. Point-to-point GRE interface
D. Loopback interface
Answer: B
Q15. Which statement is true when implementing a router with a dynamic public IP address in a crypto map based site-to-site VPN?
A. The router must be configured with a dynamic crypto map.
B. Certificates are always used for phase 1 authentication.
C. The tunnel establishment will fail if the router is configured as a responder only.
D. The router and the peer router must have NAT traversal enabled.
Answer: C
Q16. Which technology supports tunnel interfaces while remaining compatible with legacy VPN implementations?
A. FlexVPN
B. DMVPN
C. GET VPN
D. SSL VPN
Answer: A
Q17. Which three parameters must match on all routers in a DMVPN Phase 3 cloud? (Choose three.)
A. NHRP network ID
B. GRE tunnel key
C. NHRP authentication string
D. tunnel VRF
E. EIGRP process name
F. EIGRP split-horizon setting
Answer: A,B,C
Q18. Refer to the exhibit.
What is the problem with the IKEv2 site-to-site VPN tunnel?
A. incorrect PSK
B. crypto access list mismatch
C. incorrect tunnel group
D. crypto policy mismatch
E. incorrect certificate
Answer: B
Q19. When you configure IPsec VPN High Availability Enhancements, which technology does Cisco recommend that you enable to make reconvergence faster?
A. EOT
B. IP SLAs
C. periodic IKE keepalives
D. VPN fast detection
Answer: C
Q20. Which Cisco adaptive security appliance command can be used to view the count of all active VPN sessions?
A. show vpn-sessiondb summary
B. show crypto ikev1 sa
C. show vpn-sessiondb ratio encryption
D. show iskamp sa detail
E. show crypto protocol statistics all
Answer: A