I85PREP
⌘ K
Cisco 300-730 SVPN study materials
Cisco 300-730 SVPN study resources

Cisco 300-730 SVPN practice questions

One question at a time. Build your Cisco 300-730 SVPN understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Site-to-site VPNs

In a FlexVPN hub-and-spoke deployment using IKEv2, which mechanism lets spokes dynamically learn routes to other spokes without a permanent tunnel between every pair?

  1. IPsec transport mode with GRE keepalives disabled
  2. NHRP shortcut switching with per-spoke static routes
  3. IKEv2 configuration payloads pushing a default route plus dynamic routing over the hub Correct answer.
  4. IKEv1 aggressive mode with mode-config exchange

Explanation

In FlexVPN the hub can push routing information to spokes through IKEv2 configuration payloads, and a dynamic routing protocol or summarization over the hub tunnel provides reachability to other spokes. This avoids a full mesh of permanent tunnels and keeps spoke configuration minimal.

Question 2Site-to-site VPNs

Which technology forms a full mesh of point-to-point IPsec tunnels automatically between many peers using a single virtual interface on each router?

  1. DMVPN Phase 1
  2. FlexVPN Correct answer.
  3. Group Encrypted Transport with multicast replication
  4. GET VPN

Explanation

FlexVPN uses a single virtual-template interface and IKEv2 to build many point-to-point IPsec tunnels, including spoke-to-spoke tunnels, from one configuration. This scales better than per-peer static crypto maps.

Question 3Site-to-site VPNs

A DMVPN Phase 3 network uses NHRP shortcut switching. Which statement describes how a spoke reaches another spoke?

  1. The spoke uses a static crypto map to the destination spoke configured by the administrator
  2. The spoke sends all traffic through the hub permanently because shortcut switching is disabled in Phase 3
  3. The spoke relies on GET VPN group policy to redirect traffic to the destination
  4. The spoke requests an NHRP resolution for the destination and builds a direct tunnel if the hub permits it Correct answer.

Explanation

In Phase 3 the hub summarizes routes so spokes send unknown destinations to the hub, and NHRP resolution allows a spoke to build a direct tunnel to the destination spoke when allowed. This combines the scalability of summarization with direct spoke-to-spoke paths.

Question 4Site-to-site VPNs

Which DMVPN component is responsible for mapping a tunnel IP address to an NBMA (public) address so spokes can find each other?

  1. IKEv2 configuration payload
  2. NHRP Correct answer.
  3. mGRE
  4. IPsec SA rekeying

Explanation

NHRP is the resolution protocol that maps tunnel addresses to NBMA addresses, allowing spokes to discover each other's public endpoints. mGRE provides the multipoint tunnel interface, and IPsec secures the traffic, but neither performs address resolution.

Question 5Site-to-site VPNs

In a DMVPN Phase 2 topology, which hub configuration is required for spokes to build direct spoke-to-spoke tunnels?

  1. Disable split horizon and advertise a summarized route to the spokes Correct answer.
  2. Configure the hub as a route reflector for BGP only
  3. Advertise a default route to all spokes and enable NHRP redirect
  4. Enable IPsec transport mode on the hub tunnel interface

Explanation

Phase 2 requires the hub to preserve the specific spoke routes so spokes learn the real next hop, which typically means disabling split horizon and avoiding summarization. With specific routes present, spokes can initiate NHRP resolution and build direct tunnels.

Question 6Site-to-site VPNs

Which protocol combination does a classic DMVPN tunnel use for the overlay encapsulation and its encryption?

  1. IP-in-IP over SSL
  2. GRE over IPsec with mGRE on the tunnel interface Correct answer.
  3. VXLAN over MACsec
  4. L2TPv3 over IPsec transport mode

Explanation

DMVPN uses multipoint GRE (mGRE) to provide the NBMA overlay and IPsec to protect the GRE traffic. NHRP rides on the mGRE interface to resolve peer addresses.

Question 7Site-to-site VPNs

A GET VPN deployment must keep traffic encrypted between group members while traversing a provider MPLS network. Which keying model does GET VPN use?

  1. Per-pair IKEv1 main mode between every pair of routers
  2. IKEv2 configuration payloads from a hub router
  3. A group domain of interpretation with a key server distributing group keys Correct answer.
  4. Certificate-only authentication with no key server

Explanation

GET VPN uses GDOI so a key server distributes group policy and traffic encryption keys to all group members, letting them encrypt directly to each other over the provider cloud. This preserves the any-to-any topology without per-pair IKE.

Question 8Site-to-site VPNs

Which GET VPN feature allows traffic to be decrypted and inspected at a provider edge while remaining encrypted for other destinations?

  1. Policy-based replication
  2. Cooperative key server
  3. Encryption policy with a secondary policy for tunneled traffic Correct answer.
  4. Group member rekey

Explanation

GET VPN supports secondary policies that permit specific traffic to be decrypted at an intermediate point for inspection and re-encrypted for onward transport. This is useful for provider-hosted services that must see certain flows.

Question 9Site-to-site VPNs

In a point-to-point IPsec site-to-site tunnel using IKEv2, which two message exchanges establish the initial IKE SA?

  1. Four messages of aggressive mode
  2. A single message carrying all proposals
  3. Six messages of main mode
  4. Two messages (IKE_SA_INIT) followed by two messages (IKE_AUTH) Correct answer.

Explanation

IKEv2 establishes the IKE SA with a two-message IKE_SA_INIT exchange and then authenticates with a two-message IKE_AUTH exchange. Child SAs are created within IKE_AUTH or in a separate CREATE_CHILD_SA exchange.

Question 10Site-to-site VPNs

Which IPsec mode is used when a GRE tunnel is encrypted between two routers, preserving the original IP header inside the tunnel?

  1. AH-only mode
  2. Beet mode
  3. Transport mode
  4. Tunnel mode Correct answer.

Explanation

Tunnel mode encapsulates the entire original packet, including its IP header, inside a new IPsec packet. This is the normal choice when protecting GRE or other tunnel traffic between gateways.

Question 11Site-to-site VPNs

A site-to-site tunnel uses a crypto map on an interface that also has NAT applied. What is a common cause of tunnel failure after NAT is configured?

  1. Tunnel mode requires NAT to be applied twice
  2. The crypto ACL automatically excludes all NAT traffic
  3. NAT is applied to traffic that should be excluded from translation before it is encrypted Correct answer.
  4. IKEv2 cannot traverse NAT under any circumstance

Explanation

Traffic destined for the tunnel must be excluded from NAT with a deny statement in the NAT ACL, otherwise the source address is translated before encryption and no longer matches the crypto ACL. The classic symptom is that the tunnel comes up but interesting traffic is not encrypted.

Question 12Site-to-site VPNs

Which mechanism allows IPsec peers to detect and recover from NAT devices along the path during IKEv2 negotiation?

  1. NAT detection with UDP encapsulation of ESP Correct answer.
  2. IKE fragmentation with aggressive mode
  3. Dead peer detection with GRE keepalives
  4. Path MTU discovery with DF bit clearing

Explanation

IKEv2 detects NAT by comparing source hashes, and when NAT is present it encapsulates ESP in UDP to traverse the device. This is NAT-T, and it is negotiated during IKE_AUTH.

Question 13Site-to-site VPNs

Which statement best describes the role of the crypto ACL in a classic point-to-point IPsec tunnel?

  1. It assigns the tunnel interface IP address
  2. It defines the transform sets offered during IKE
  3. It authenticates the peer using pre-shared keys
  4. It selects which traffic is interesting and therefore protected by the tunnel Correct answer.

Explanation

The crypto ACL identifies the traffic that should be encrypted and sent through the tunnel; matching packets trigger or use the IPsec SA. Transform sets and authentication are configured separately.

Question 14Site-to-site VPNs

In a FlexVPN spoke configuration using IKEv2, which command enables the spoke to accept a dynamically assigned tunnel address from the hub?

  1. ip address negotiated on the virtual template interface Correct answer.
  2. crypto ipsec profile with a static peer address
  3. ip address dhcp on the physical interface
  4. tunnel source dynamic with no destination

Explanation

FlexVPN spokes can request an address from the hub through IKEv2 configuration payloads, and the virtual template uses ip address negotiated to accept it. This lets many spokes share a template without per-spoke address configuration.

Question 15Site-to-site VPNs

Which DMVPN Phase 3 feature lets the hub tell a spoke that a better direct path exists to a destination?

  1. NHRP redirect Correct answer.
  2. NHRP registration
  3. IPsec SA rekey
  4. Multicast replication

Explanation

NHRP redirect is sent by the hub to inform a spoke that traffic to a destination could take a direct path, prompting the spoke to resolve the destination and build a shortcut tunnel. Registration is how spokes announce themselves to the hub.

Question 16Site-to-site VPNs

Which routing design is typical for a large DMVPN Phase 3 hub to reduce spoke routing table size while still allowing spoke-to-spoke shortcuts?

  1. Disable routing protocols and use static routes on each spoke
  2. Advertise a default or summarized route to spokes and rely on NHRP redirect Correct answer.
  3. Use only connected routes on the hub
  4. Advertise all specific spoke routes to every spoke

Explanation

Phase 3 allows the hub to summarize or advertise a default route, keeping spoke tables small, while NHRP redirect and resolution still permit direct spoke-to-spoke tunnels. This is the scalability benefit of Phase 3 over Phase 2.

Question 17Site-to-site VPNs

A GET VPN group member cannot decrypt traffic after a rekey. Which component should be verified first?

  1. The spoke's NHRP registration
  2. The key server's rekey policy and reachability to members Correct answer.
  3. The hub's IKEv2 configuration payload
  4. The DMVPN tunnel interface state

Explanation

GET VPN members receive traffic encryption keys from the key server through rekeys, so a failed rekey usually points to key server policy, reachability, or timing issues. NHRP and DMVPN concepts do not apply to GET VPN.

Question 18Site-to-site VPNs

Which IPsec protocol provides authentication of the packet including the outer IP header but does not provide confidentiality?

  1. ESP with null encryption
  2. IKEv2
  3. AH Correct answer.
  4. GRE with checksum

Explanation

AH authenticates the entire packet including the outer IP header, but it does not encrypt the payload, so it provides integrity and authentication without confidentiality. ESP can authenticate and encrypt, and with null encryption it provides no confidentiality but does not cover the outer header the same way.

Question 19Site-to-site VPNs

Which statement describes dead peer detection (DPD) in a site-to-site IPsec deployment?

  1. It negotiates transform sets during IKE
  2. It assigns overlay addresses to spokes
  3. It distributes group keys to GET VPN members
  4. It periodically probes the peer to detect failure and can tear down stale SAs Correct answer.

Explanation

DPD sends periodic probes to determine whether the peer is still reachable and can remove stale SAs when the peer stops responding. This helps traffic fail over or re-establish tunnels promptly.

Question 20Site-to-site VPNs

A network engineer needs to protect traffic between two data centers over the Internet and requires the tunnel to survive WAN address changes on one side. Which design is most appropriate?

  1. GET VPN with a key server
  2. DMVPN Phase 1 with static NHRP mappings
  3. FlexVPN with IKEv2 and dynamic peer detection Correct answer.
  4. Static crypto map with fixed peer addresses

Explanation

FlexVPN with IKEv2 can use dynamic peer addresses and re-establish tunnels when a WAN address changes, which static crypto maps cannot handle. GET VPN and static NHRP designs assume stable addresses.

Question 21Site-to-site VPNs

Which configuration element in a DMVPN hub allows a single mGRE interface to serve many spokes with different public addresses?

  1. An individual virtual template per spoke
  2. A static crypto map entry per spoke
  3. A tunnel interface with tunnel mode gre multipoint Correct answer.
  4. A point-to-point GRE tunnel per spoke

Explanation

A multipoint GRE tunnel interface accepts connections from many spokes and uses NHRP to map their tunnel addresses to NBMA addresses. This avoids configuring a separate point-to-point tunnel for each spoke.

Question 22Site-to-site VPNs

In an IPsec profile used by FlexVPN, which parameter defines the traffic protection suite applied to the child SA?

  1. The IPsec transform set Correct answer.
  2. The NHRP network ID
  3. The crypto ACL
  4. The IKEv2 proposal

Explanation

The IPsec transform set defines the encryption and integrity algorithms used for the child SA that protects data traffic. The IKEv2 proposal covers protection of the control-plane IKE SA.

Question 23Site-to-site VPNs

Which statement about IKEv2 configuration payloads in FlexVPN is accurate?

  1. They encrypt data traffic directly
  2. They replace the need for any routing protocol
  3. They can push an IP address, DNS server, and routes to the spoke Correct answer.
  4. They are only valid in IKEv1 main mode

Explanation

IKEv2 configuration payloads let the responder assign attributes such as an overlay IP address, DNS servers, and protected routes to the initiator. They simplify spoke provisioning but do not replace data-plane encryption or routing entirely.

Question 24Site-to-site VPNs

A DMVPN spoke registers with the hub but cannot build a direct tunnel to another spoke. Which two conditions should be verified?

  1. The spoke has a route to the destination and NHRP resolution succeeds Correct answer.
  2. The key server is reachable and the group policy is valid
  3. The spoke uses transport mode and DPD is disabled
  4. The hub has a static crypto map and the spoke uses AH

Explanation

A direct spoke-to-spoke tunnel requires that the initiating spoke have a route to the destination network and successfully resolve the destination's NBMA address through NHRP. If either fails, traffic continues through the hub.

Question 25Site-to-site VPNs

Which technology uses a key server to distribute a common group policy and traffic encryption key to many routers, preserving any-to-any communication over a provider network?

  1. FlexVPN
  2. Static point-to-point IPsec
  3. DMVPN Phase 3
  4. GET VPN Correct answer.

Explanation

GET VPN uses a key server to distribute group policy and traffic encryption keys, allowing members to encrypt directly to each other over a provider network without per-pair tunnels. This preserves the native any-to-any topology.

Question 26Site-to-site VPNs

A hub router in a hub-and-spoke DMVPN network must advertise a single default route to every spoke so that spokes forward all unknown traffic to the hub, while spokes still keep their tunnel interfaces in the same subnet. Which hub-side configuration accomplishes this?

  1. Configure the tunnel interface with a summary-address command that originates a default route into the NHRP domain. Correct answer.
  2. Configure the hub to advertise the default route into the tunnel with the ip nhrp map multicast dynamic command.
  3. Configure the hub to send a default route with the ip nhrp redirect command on the tunnel interface.
  4. Configure the mGRE tunnel interface as a non-broadcast network and enable split horizon on the tunnel interface.

Explanation

On the hub's mGRE tunnel interface, the summary-address command injects a summarized route (such as 0.0.0.0/0) into the NHRP-enabled overlay so spokes receive it as a default route pointing at the hub. This keeps spoke routing tables small while preserving reachability to the hub for unknown destinations.

Question 27Site-to-site VPNs

A network engineer is designing a site-to-site VPN between two branch routers across the Internet. The design requires that the tunnel re-establish automatically after a link flap without manual intervention, and that the tunnel interface remain up independent of the underlying physical interface state. Which combination supports this requirement?

  1. A tunnel interface protected by an IPsec profile with IKEv2 and DPD configured, allowing the tunnel to renegotiate on demand. Correct answer.
  2. A crypto map applied to a loopback interface with NAT-T disabled on both peers.
  3. A GRE tunnel without IPsec, relying on routing protocol hellos to detect failures.
  4. A static crypto map with a pre-shared key and no keepalives enabled on the physical interface.

Explanation

Protecting a tunnel interface with an IPsec profile and IKEv2, combined with dead peer detection, allows the tunnel to renegotiate automatically after a failure and keeps the logical tunnel resilient to physical link flaps. This is the standard FlexVPN-style design for resilient site-to-site tunnels.

Question 28Site-to-site VPNs

In a DMVPN Phase 3 deployment, a spoke needs to build a direct tunnel to another spoke. Which two conditions must be satisfied for the spoke-to-spoke tunnel to come up? (Choose the best answer.)

  1. The hub must have a static NHRP mapping for every spoke and the spokes must share the same pre-shared key.
  2. The hub must be configured as a route reflector and the spokes must run OSPF in broadcast mode.
  3. The spokes must use the same tunnel IP subnet as the hub and must have multicast mapping disabled.
  4. The spokes must have NHRP resolution enabled and the hub must return a redirect so the initiating spoke can resolve the target spoke's NBMA address. Correct answer.

Explanation

Spoke-to-spoke tunnels in DMVPN Phase 3 require NHRP resolution on the spokes and a redirect from the hub so the initiating spoke learns the target spoke's NBMA address and can build the direct tunnel. Both the NHRP client behavior and the hub's redirect capability are necessary.

Question 29Site-to-site VPNs

Which statement accurately describes how a GET VPN group member obtains the traffic encryption key (TEK) used to encrypt traffic between group members?

  1. The key server distributes the TEK to group members through the group management protocol after they register. Correct answer.
  2. Each member negotiates a unique TEK directly with every other member using IKEv2.
  3. The TEK is distributed by the provider edge router on the MPLS network as part of the VPN label.
  4. The TEK is derived locally from the group pre-shared key without contacting the key server.

Explanation

In GET VPN, group members register with the key server and receive the traffic encryption key via the group management protocol, allowing all members to share the same key without pairwise negotiation. This is what permits scalable any-to-any encryption over a provider network.

Question 30Site-to-site VPNs

A network engineer is configuring a point-to-point IPsec tunnel between two routers using IKEv1 in main mode with pre-shared keys. Which statement describes the authentication behavior during phase 1?

  1. The pre-shared key is encrypted with the peer's RSA public key before transmission.
  2. The pre-shared key is sent in cleartext during the first exchange to identify the peer.
  3. The pre-shared key is exchanged only after the IPsec SA is established in quick mode.
  4. The pre-shared key is used to derive the authentication hash, and the key itself is never transmitted on the wire. Correct answer.

Explanation

In IKEv1 main mode with pre-shared key authentication, the pre-shared key is combined with nonces and other values to compute authentication hashes; the key itself is never sent across the network. This is why pre-shared keys must match on both peers.

Question 31Site-to-site VPNs

An engineer is troubleshooting a DMVPN hub that uses a single mGRE interface to serve many spokes with different public IP addresses. Which configuration element allows the hub to accept registrations from spokes whose NBMA addresses are not statically known?

  1. A static NHRP map for each spoke's public address on the tunnel interface.
  2. The ip nhrp authentication command on the tunnel interface.
  3. The ip nhrp map multicast dynamic command on the tunnel interface. Correct answer.
  4. The ip nhrp network-id command on the tunnel interface.

Explanation

On the hub's mGRE interface, ip nhrp map multicast dynamic enables the hub to dynamically learn spoke NBMA addresses and replicate multicast traffic to them, which is essential when spokes have unknown public addresses. Static maps would not scale and are unnecessary for dynamic registration.

Question 32Site-to-site VPNs

In a FlexVPN deployment using an IPsec profile, which parameter defines the protection suite applied to the child SA (the actual data traffic)?

  1. The pfs group configured on the tunnel interface.
  2. The pre-shared key configured under the IKEv2 keyring.
  3. The IKEv2 proposal referenced by the IKEv2 profile.
  4. The transform-set referenced by the IPsec profile. Correct answer.

Explanation

The transform-set (or transform profile) referenced by the IPsec profile specifies the encryption and integrity algorithms used to protect the child SA, which carries the data traffic. The IKEv2 proposal instead governs the IKE SA used for control-plane negotiation.

Question 33Site-to-site VPNs

Which statement about IKEv2 configuration payloads in a FlexVPN spoke configuration is accurate?

  1. Configuration payloads are used exclusively to distribute routing information between peers.
  2. Configuration payloads are used only in IKEv1 aggressive mode and are unavailable in IKEv2.
  3. Configuration payloads allow the spoke to request a tunnel IP address and other attributes from the hub during IKE_AUTH. Correct answer.
  4. Configuration payloads carry the pre-shared key between peers during the IKE_SA_INIT exchange.

Explanation

IKEv2 configuration payloads let a responder supply attributes such as an internal IP address, DNS server, or subnet mask to the initiator during IKE_AUTH. In FlexVPN this is how a spoke can obtain a dynamically assigned tunnel address from the hub.

Question 34Site-to-site VPNs

A site-to-site IPsec tunnel uses a crypto map on an interface that also performs NAT. Tunnel traffic fails while other traffic works. Which configuration change most directly resolves the failure?

  1. Change the crypto ACL to permit all traffic between the peers.
  2. Enable NAT-T by allowing UDP port 4500 through the firewall.
  3. Disable PFS on the crypto map to avoid rekey failures.
  4. Add a NAT exemption (deny NAT) for traffic matching the crypto ACL before the NAT statement. Correct answer.

Explanation

When a crypto map interface also applies NAT, traffic matching the crypto ACL can be translated before encryption, breaking the tunnel. A NAT exemption rule that denies translation for the tunnel traffic, placed before the NAT statement, preserves the original addresses for IPsec.

Question 35Site-to-site VPNs

Which statement describes the role of the crypto ACL in a classic point-to-point IPsec tunnel?

  1. It authenticates the peer during IKE phase 1.
  2. It identifies traffic that should be encrypted and triggers tunnel establishment when matching traffic is seen. Correct answer.
  3. It specifies the pre-shared key used for peer authentication.
  4. It defines the encryption and integrity algorithms used to protect the tunnel.

Explanation

The crypto ACL (extended ACL referenced by the crypto map) selects which traffic is interesting for IPsec; matching traffic triggers SA establishment and is encrypted. It does not define algorithms, authentication, or keys.

Question 36Site-to-site VPNs

A network engineer must protect traffic between two data centers over the Internet and requires the tunnel to survive a change in the public IP address of one peer without reconfiguring the other. Which design best meets this requirement?

  1. A tunnel interface protected by an IPsec profile using IKEv2 with dynamic peer discovery and DPD. Correct answer.
  2. A crypto map using IKEv1 main mode with a pre-shared key and no keepalives.
  3. A GRE tunnel without IPsec and with static routing.
  4. A static crypto map with a fixed peer address and no DPD.

Explanation

Using a tunnel interface with an IPsec profile and IKEv2, combined with dynamic peer discovery and DPD, allows the tunnel to renegotiate when a peer's address changes and to detect failures. Static crypto maps with fixed peers cannot adapt to address changes automatically.

Question 37Site-to-site VPNs

In a DMVPN Phase 3 hub configuration, which command enables the hub to inform a spoke that a better direct path exists to a destination?

  1. ip nhrp map multicast dynamic
  2. ip nhrp authentication
  3. ip nhrp network-id
  4. ip nhrp redirect Correct answer.

Explanation

The ip nhrp redirect command on the hub allows it to send an NHRP redirect to a spoke, signaling that a better direct path exists to the destination. The spoke then resolves the target spoke's NBMA address and builds a direct tunnel.

Question 38Site-to-site VPNs

Which IPsec mode encapsulates the entire original IP packet, including its original IP header, inside a new IP header and provides confidentiality for the original packet?

  1. Tunnel mode with AH only
  2. Tunnel mode with ESP Correct answer.
  3. Transport mode with AH
  4. Transport mode with ESP

Explanation

Tunnel mode with ESP encapsulates the complete original IP packet (header and payload) within a new IP packet and encrypts the original packet, providing confidentiality. Transport mode with ESP encrypts only the payload and leaves the original IP header visible. AH provides authentication but not confidentiality.

Question 39Site-to-site VPNs

A network engineer is configuring a point-to-point IPsec tunnel between two routers using IKEv1 in main mode with pre-shared keys. The engineer wants to ensure that the tunnel comes up only when there is interesting traffic and that the SA is torn down after 30 minutes of inactivity. Which combination of configuration elements should be used?

  1. An IPsec profile applied to a tunnel interface with the keepalive 30 3 command
  2. A crypto map with an ACL that defines interesting traffic and a crypto map configuration with the security-association lifetime kilobytes 1800 command
  3. A crypto map with an ACL that defines interesting traffic and a crypto map configuration with the security-association idle-time 1800 command Correct answer.
  4. A crypto map with an ACL that defines interesting traffic and a crypto map configuration with the security-association lifetime seconds 1800 command

Explanation

The security-association idle-time command configures the idle timeout in seconds after which the IPsec SA is torn down if no traffic is received. The crypto map with an ACL defines interesting traffic that triggers tunnel establishment. The lifetime seconds command sets the SA lifetime, not an inactivity timer.

Question 40Site-to-site VPNs

A network engineer is troubleshooting a DMVPN Phase 3 deployment where a spoke cannot establish a direct tunnel to another spoke even though the hub has signaled that a direct path is available. The hub is configured with the ip nhrp redirect command and the spokes are configured with the ip nhrp shortcut command. Which two conditions must be satisfied for the direct tunnel to be built? (Choose two.)

  1. The spokes must have the same NHRP network ID, and the spokes must have the same ISAKMP policy.
  2. The spokes must have the same NHRP network ID, and the spokes must have a route to each other's tunnel IP addresses via the hub.
  3. The spokes must have a route to each other's tunnel IP addresses via the hub, and the spokes must have the same IPsec profile applied. Correct answer.
  4. The spokes must have the same NHRP network ID, and the spokes must have the same IPsec profile applied.

Explanation

For a direct spoke-to-spoke tunnel in DMVPN Phase 3, the spokes must have a route to each other's tunnel IP addresses via the hub (often a default route) so that the initial packet is sent to the hub, and they must have the same IPsec profile so that the direct tunnel can be protected. The NHRP network ID must match for NHRP to function, but it is not sufficient by itself; the routing and IPsec profile are also required.

Question 41Remote access VPNs

An administrator wants Cisco AnyConnect clients to download a new profile from the headend without user interaction. Which configuration on the adaptive security appliance accomplishes this?

  1. Set the AnyConnect module to always-on and push the profile through a SCEP enrollment.
  2. Bind the profile to the tunnel group and require the user to reinstall the client.
  3. Enable profile update on the group policy and place the new profile in the flash profile directory. Correct answer.
  4. Configure a client firewall policy that forces a profile refresh at connect time.

Explanation

AnyConnect profile updates are delivered by enabling the profile update option on the group policy and storing the profile where the headend serves it, typically flash:/profile. The client compares its local copy at connect time and downloads the newer file automatically.

Question 42Remote access VPNs

A clientless SSL VPN user needs to reach an internal web application that is not reachable through the default portal. What must the administrator configure?

  1. A DTLS tunnel for the clientless session.
  2. An AnyConnect posture assessment rule for the browser plugin.
  3. A bookmarked URL entry in the clientless group policy or portal customization. Correct answer.
  4. A split-tunnel ACL applied to the clientless connection.

Explanation

Clientless access is delivered through the web portal, and internal web resources are exposed as bookmarks defined in the group policy or portal customization. Without a bookmark the application is not presented to the clientless user.

Question 43Remote access VPNs

Which statement describes the role of the Secure Sockets Layer VPN's DTLS channel for AnyConnect clients?

  1. It is used only for certificate enrollment during initial client provisioning.
  2. It provides compression of HTTP bookmarks for clientless users.
  3. It carries tunneled data over UDP to reduce latency and is negotiated after the TLS control channel is up. Correct answer.
  4. It replaces the TLS control channel entirely once the user authenticates.

Explanation

DTLS provides a UDP-based data path for AnyConnect tunnel traffic, improving throughput and latency for real-time applications. The TLS control channel is established first and negotiates the DTLS data channel.

Question 44Remote access VPNs

An engineer must verify which AnyConnect modules are enabled for a tunnel group. Which command shows the group policy and its associated client modules?

  1. show import webvpn webcontent
  2. show vpn-sessiondb svc
  3. show running-config webvpn
  4. show vpn-sessiondb detail anyconnect Correct answer.

Explanation

The show vpn-sessiondb detail anyconnect command lists active AnyConnect sessions along with the enabled modules and group policy applied. It is the standard way to confirm which modules a session is using.

Question 45Remote access VPNs

Which authentication method allows an AnyConnect user to authenticate with a one-time password delivered by SMS in addition to a static password?

  1. Local user database with static passwords
  2. RADIUS with a challenge-response token server Correct answer.
  3. Anonymous authentication
  4. Digital certificates only

Explanation

One-time passwords delivered out of band, such as by SMS, are typically provided by a RADIUS or token server that issues a challenge and validates the response. The ASA forwards the challenge to the client and relays the response to the server.

Question 46Remote access VPNs

An administrator needs to allow split tunneling for AnyConnect users so only corporate subnets traverse the tunnel. What must be configured?

  1. A tunnel group with a default gateway of 0.0.0.0.
  2. An ACL on the group policy specifying the networks to tunnel, with split tunneling enabled. Correct answer.
  3. A DTLS policy with the corporate subnets listed as excluded.
  4. A clientless bookmark list containing the corporate subnets.

Explanation

Split tunneling is controlled by an ACL applied to the group policy that defines which destinations are sent through the tunnel. Destinations not matched by the ACL are sent outside the tunnel when split tunneling is enabled.

Question 47Remote access VPNs

Which certificate field is validated by the AnyConnect client when it connects to an ASA using a server certificate?

  1. The serial number must match the client's local certificate.
  2. The certificate must be issued by the same CA as the client certificate.
  3. The subject name must match the address the client is connecting to. Correct answer.
  4. The key usage must include client authentication only.

Explanation

The AnyConnect client verifies that the server certificate's subject or subject alternative name matches the hostname or address used in the connection. Mismatches trigger a certificate warning or connection failure.

Question 48Remote access VPNs

What is the purpose of a dynamic access policy (DAP) in an SSL VPN deployment?

  1. To translate internal addresses for tunneled clients.
  2. To apply authorization attributes based on endpoint posture and user attributes. Correct answer.
  3. To terminate the TLS control channel for clientless sessions.
  4. To define the order in which group policies are evaluated for authentication.

Explanation

DAPs evaluate endpoint and user conditions and then assign authorization attributes such as ACLs or a different group policy. They provide posture-driven access control after authentication.

Question 49Remote access VPNs

An administrator wants to restrict clientless SSL VPN users to a specific internal server and port. Which configuration element is used to enforce this?

  1. A split-tunnel ACL applied to the connection profile
  2. A DTLS fallback policy
  3. A tunnel-group pre-shared key
  4. A webtype ACL applied to the group policy Correct answer.

Explanation

Clientless access control is enforced with webtype ACLs that permit or deny specific URLs and ports. These ACLs are applied to the group policy serving the clientless users.

Question 50Remote access VPNs

A user reports that AnyConnect repeatedly prompts for credentials during a single session. Which configuration is the most likely cause?

  1. The group policy has the wrong authentication server order configured, causing re-authentication. Correct answer.
  2. The client is using DTLS and the firewall blocks UDP 443.
  3. The profile update interval is set too short.
  4. The tunnel group is configured with a backup server list.

Explanation

Repeated credential prompts usually indicate that authentication is being retried against a server or method that fails, often due to incorrect authentication server ordering or a secondary method that cannot complete. Correcting the server sequence resolves the loop.