NEW QUESTION 1
Which two changes must be made in order to migrate from DMVPN Phase 2 to Phase 3 when EIGRP is configured? (Choose two.)

• A. Add NHRP shortcuts on the hub.
• B. Add NHRP redirects on the spoke.
• C. Disable EIGRP next-hop-self on the hub.
• D. Enable EIGRP next-hop-self on the hub.
• E. Add NHRP redirects on the hub.

Answer: CE

NEW QUESTION 2
What are two functions of ECDH and ECDSA? (Choose two.)

• A. nonrepudiation
• B. revocation
• C. digital signature
• D. key exchange
• E. encryption

Answer: CD

Explanation:
Reference: https://tools.cisco.com/security/center/resources/next_generation_cryptography

NEW QUESTION 3
Which requirement is needed to use local authentication for Cisco AnyConnect Secure Mobility Clients that connect to a FlexVPN server?

• A. use of certificates instead of username and password
• B. EAP-AnyConnect
• C. EAP query-identity
• D. AnyConnect profile

Answer: D

Explanation:
Reference: https://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2-Remote-Access.html

NEW QUESTION 4
Where is split tunneling defined for IKEv2 remote access clients on a Cisco router?

• A. IKEv2 authorization policy
• B. Group Policy
• C. virtual template
• D. webvpn context

Answer: B

NEW QUESTION 5
A Cisco AnyConnect client establishes a SSL VPN connection with an ASA at the corporate office. An engineer must ensure that the client computer meets the enterprise security policy. Which feature can update the client to meet an enterprise security policy?

• A. Endpoint Assessment
• B. Cisco Secure Desktop
• C. Basic Host Scan
• D. Advanced Endpoint Assessment

Answer: D

NEW QUESTION 6
Refer to the exhibit.

Based on the exhibit, why are users unable to access CCNP Webserver bookmark?

• A. The URL is being blocked by a WebACL.
• B. The ASA cannot resolve the URL.
• C. The bookmark has been disabled.
• D. The user cannot access the URL.

Answer: C

NEW QUESTION 7
A second set of traffic selectors is negotiated between two peers using IKEv2. Which IKEv2 packet will contain details of the exchange?

• A. IKEv2 IKE_SA_INIT
• B. IKEv2 INFORMATIONAL
• C. IKEv2 CREATE_CHILD_SA
• D. IKEv2 IKE_AUTH

Answer: B

NEW QUESTION 8
Which two remote access VPN solutions support SSL? (Choose two.)

• A. FlexVPN
• B. clientless
• C. EZVPN
• D. L2TP
• E. Cisco AnyConnect

Answer: BE

NEW QUESTION 9
Refer to the exhibit.

An engineer is troubleshooting a new GRE over IPsec tunnel. The tunnel is established but the engineer cannot ping from spoke 1 to spoke 2. Which type of traffic is being blocked?

• A. ESP packets from spoke2 to spoke1
• B. ISAKMP packets from spoke2 to spoke1
• C. ESP packets from spoke1 to spoke2
• D. ISAKMP packets from spoke1 to spoke2

Answer: A

NEW QUESTION 10
Which redundancy protocol must be implemented for IPsec stateless failover to work?

• A. SSO
• B. GLBP
• C. HSRP
• D. VRRP

Answer: C

Explanation:
Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/17826-ipsec-feat.html

NEW QUESTION 11
Which parameter must match on all routers in a DMVPN Phase 3 cloud?

• A. GRE tunnel key
• B. NHRP network ID
• C. tunnel VRF
• D. EIGRP split-horizon setting

Answer: A

NEW QUESTION 12
Refer to the exhibit.

The IKEv2 site-to-site VPN tunnel between two routers is down. Based on the debug output, which type of mismatch is the problem?

• A. preshared key
• B. peer identity
• C. transform set
• D. ikev2 proposal

Answer: B

NEW QUESTION 13
Which two features provide headend resiliency for Cisco AnyConnect clients? (Choose two.)

• A. AnyConnect Auto Reconnect
• B. AnyConnect Network Access Manager
• C. AnyConnect Backup Servers
• D. ASA failover
• E. AnyConnect Always On

Answer: CD

NEW QUESTION 14
Which parameter is initially used to elect the primary key server from a group of key servers?

• A. code version
• B. highest IP address
• C. highest-priority value
• D. lowest IP address

Answer: C

Explanation:
Reference: https://www.cisco.com/c/en/us/products/collateral/security/group-encrypted-transport-vpn/deployment_guide_c07_554713.html

NEW QUESTION 15
Refer to the exhibit.

Which two commands under the tunnel-group webvpn-attributes result in a Cisco AnyConnect user receiving the AnyConnect prompt in the exhibit? (Choose two.)

• A. group-url https://172.16.31.10/General enable
• B. group-policy General internal
• C. authentication aaa
• D. authentication certificate
• E. group-alias General enable

Answer: BE

NEW QUESTION 16
Refer to the exhibit.

Which type of mismatch is causing the problem with the IPsec VPN tunnel?

• A. crypto access list
• B. Phase 1 policy
• C. transform set
• D. preshared key

Answer: D

Explanation:
Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html#ike

NEW QUESTION 17
Refer to the exhibit.

The DMVPN tunnel is dropping randomly and no tunnel protection is configured. Which spoke configuration mitigates tunnel drops?
A.

• A.
• B. D.

Answer: D

NEW QUESTION 18
In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form. Which troubleshooting step solves the issue?

• A. Verify the spoke configuration to check if the NHRP redirect is enabled.
• B. Verify that the spoke receives redirect messages and sends resolution requests.
• C. Verify the hub configuration to check if the NHRP shortcut is enabled.
• D. Verify that the tunnel interface is contained within a VRF.

Answer: B

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-summ-maps.pdf

NEW QUESTION 19
Refer to the exhibit.

Cisco AnyConnect must be set up on a router to allow users to access internal servers 192.168.0.10 and 192.168.0.11. All other traffic should go out of the client's local NIC. Which command accomplishes this configuration?

• A. svc split include 192.168.0.0 255.255.255.0
• B. svc split exclude 192.168.0.0 255.255.255.0
• C. svc split include acl CCNP
• D. svc split exclude acl CCNP

Answer: C

NEW QUESTION 20
Refer to the exhibit.

Which two tunnel types produce the show crypto ipsec sa output seen in the exhibit? (Choose two.)

• A. crypto map
• B. DMVPN
• C. GRE
• D. FlexVPN
• E. VTI

Answer: BE

NEW QUESTION 21
Which VPN solution uses TBAR?

• A. GETVPN
• B. VTI
• C. DMVPN
• D. Cisco AnyConnect

Answer: A

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_getvpn/configuration/xe-3s/sec-get-vpn-xe-3s-book/sec-get-vpn.html

NEW QUESTION 22
Refer to the exhibit.

The customer must launch Cisco AnyConnect in the RDP machine. Which IOS configuration accomplishes this task?

• A.
• B.
• C.
• D.

Answer: C

Explanation:
Reference: https://community.cisco.com/t5/vpn/starting-anyconnect-vpn-through-rdp-session-on-cisco-891/td-p/2128284

NEW QUESTION 23
Refer to the exhibit.

What is configured as a result of this command set?

• A. FlexVPN client profile for IPv6
• B. FlexVPN server to authorize groups by using an IPv6 external AAA
• C. FlexVPN server for an IPv6 dVTI session
• D. FlexVPN server to authenticate IPv6 peers by using EAP

Answer: A

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/xe-3s/sec-flex-vpn-xe-3s-book/sec-cfg-flex-clnt.html

NEW QUESTION 24
Refer to the exhibit.

A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which action brings up the VPN tunnel?

• A. Reduce the maximum SA limit on the local Cisco ASA.
• B. Increase the maximum in-negotiation SA limit on the local Cisco ASA.
• C. Remove the maximum SA limit on the remote Cisco ASA.
• D. Correct the crypto access list on both Cisco ASA devices.

Answer: B

NEW QUESTION 25
Which two statements about the Cisco ASA Clientless SSL VPN solution are true? (Choose two.)

• A. When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the client uses the local DNS to perform FQDN resolution.
• B. The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default.
• C. A Cisco ASA can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions.
• D. When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the ASA uses its configured DNS servers to perform FQDN resolution.
• E. Clientless SSLVPN provides Layer 3 connectivity into the secured network.

Answer: CD

NEW QUESTION 26
......