最新的CCNP Security認證 300-209考試題庫

問題1

Which command will allow a referenced ASA interface to become accessible across a site to site VPN?

A. Access- list 101 extended permit ICMP any any

B. Crypto map vpn 10 match address 101

C. Crypto map vpn interface inside

D. Management-access <interface name>

正確答案: C

問題2

Which header is used when a data plane IPsec packet is created?

A. AES

B. SHA

C. IKEv1

D. ESP

正確答案: D

問題3

An engineer has successfully established a phase 1 tunnel, but notices that no packets are decrypted on the headend side of the tunnel. What is a potential cause for this issue?

A. Disabled pFS

B. Misconfigured DH group

C. Firewall blocking Phase 2 ESP or AH

D. Different Phase 2 encryption

正確答案: C

問題4

Within a PKI system, which option is a trusted entity?

A. registration authority

B. root certificate

C. certificate authority

D. RSA authentication server

正確答案: C

問題5

Which two changes must be made to migrate from DMVPN phase2 to phase3 when EIGRP is configured? (choose two)

A. Enable EIGRP next-hop-self on the hub

B. Add NHRP shortcuts on the hub

C. Disable EIGRP next hope-self on the hub

D. Add NHRP redirects on the spoke

E. Add NHRP redirects on the hub

正確答案: B,E

問題6

A user with IP address 10.10.10.10 is unable to access a HTTP website at IP address 209.165.200.225 through a Cisco ASA. Which two features and commands will help troubleshoot the issue? (Choose two.)

A. Use packet tracer command packet-tracer input inside udp 0.10.10.10 1234192.168.1.3 161 to see what the firewall is doing with the user's traffic

B. Check if an access-list on the firewall is blocking the user by using command show running-config access-list | include 10.10.10.10

C. Enable logging at level 1 and check the syslogs using commands logging enable, logging buffered 1 and show logging | include 10.10.10.10

D. Capture user traffic using command capture capin interface inside match ip host 10.10.10.10 any

E. After verifying that user traffic reaches the firewall using syslogs or captures, use packet tracer command packet-tracer input inside tcp 10.10.10.10 1234 209.165.200.225 80

正確答案: D,E

問題7

What advantage does elliptic curve cryptography have over RSA cryptography?

A. ECC has wider industry adoption

B. ECC compresses the enciphered data

C. ECC utilizes symmetric encryption for greater performance

D. ECC provides greater security with a smaller key size

正確答案: D

問題8

Which VPN technology is preferred to reduce latency and provide encryption over MPLS without the use of a central hub?

A. DMVPN

B. GET VPN

C. IPsec

D. FlexVPN

正確答案: B

說明：（僅 VCESoft 成員可見）

問題9

An engineer is configuring SSL VPN to provide access to a corporate network for remote users. Traffic destined to the enterprise IP range should go over the tunnel and all other traffic should go directly to the internet. Which feature should go configured?

A. U turning

B. Hairpining

C. Split tunnel

D. Dual homing

正確答案: C

問題10

You need to configure your company's client VPN access to send antivirus client update traffic directly to a vendor's cloud server. All other traffic must go to the corporate network. Which feature do you configure?

A. Split DNS

B. smart tunnel

C. full tunnel

D. split tunnel

正確答案: D

問題11

What is a trusted entity within a PKI system?

A. registration authority

B. root certificate

C. certificate authority

D. RSA authentication server

正確答案: C

問題12

Which access lists are used in a typical IPsec VPN configuration?

A. ACL to define what traffic to exempt from NAT

B. ACL to NAT traffic across the VPN tunnel

C. ACL for routing neigbors across the tunnel

D. ACL to define policy based routing

正確答案: A

問題13

Refer to the exhibit,

Which result of this command is true?

A. It specifies self-signed enrollment for a trustpoint

B. Generates an RSA key called TRIALFOUR (

C. Makes the router generate a certificate signing request

D. It displays the RSA public keys of the Router

正確答案: C

問題14

An engineer wants to ensure that operating systems and service packs on a remote device with a Cisco clientless SSL VPN are identified, Which feature must be used?

A. host scan

B. keystroke logger detection

C. cache cleaner

D. host emulation detection

正確答案: A

最新的Cisco Implementing Cisco Secure Mobility Solutions - 300-209免費考試真題

最新更新

站內鏈接

聯系我們