Q91. Which two RADIUS attributes are needed for a VRF-aware FlexVPN hub? (Choose two.) 

A. ip:interface-config=ip unnumbered loobackn 

B. ip:interface-config=ip vrf forwarding ivrf 

C. ip:interface-config=ip src route 

D. ip:interface-config=ip next hop 

E. ip:interface-config=ip neighbor 0.0.0.0 

Answer: A,B 


Q92. Refer to the exhibit. 

Which statement about the given IKE policy is true? 

A. The tunnel will be valid for 2 days, 88 minutes, and 00 seconds. 

B. It will use encrypted nonces for authentication. 

C. It has a keepalive of 60 minutes, checking every 5 minutes. 

D. It uses a 56-bit encryption algorithm. 

Answer:


Q93. A company has decided to migrate an existing IKEv1 VPN tunnel to IKEv2. Which two are valid configuration constructs on a Cisco IOS router? (Choose two.) 

A. crypto ikev2 keyring keyring-name 

peer peer1 

address 209.165.201.1 255.255.255.255 

pre-shared-key local key1 

pre-shared-key remote key2 

B. crypto ikev2 transform-set transform-set-name 

esp-3des esp-md5-hmac 

esp-aes esp-sha-hmac 

C. crypto ikev2 map crypto-map-name 

set crypto ikev2 tunnel-group tunnel-group-name 

set crypto ikev2 transform-set transform-set-name 

D. crypto ikev2 tunnel-group tunnel-group-name 

match identity remote address 209.165.201.1 

authentication local pre-share 

authentication remote pre-share 

E. crypto ikev2 profile profile-name 

match identity remote address 209.165.201.1 

authentication local pre-share 

authentication remote pre-share 

Answer: A,E 


Q94. Which two statements describe effects of the DoNothing option within the untrusted network policy on a Cisco AnyConnect profile? (Choose two.) 

A. The client initiates a VPN connection upon detection of an untrusted network. 

B. The client initiates a VPN connection upon detection of a trusted network. 

C. The always-on feature is enabled. 

D. The always-on feature is disabled. 

E. The client does not automatically initiate any VPN connection. 

Answer: A,D 


Q95. Which two technologies are considered to be Suite B cryptography? (Choose two.) 

A. MD5 

B. SHA2 

C. Elliptical Curve Diffie-Hellman 

D. 3DES 

E. DES 

Answer: B,C 


Q96. Which Cisco firewall platform supports Cisco NGE? 

A. FWSM 

B. Cisco ASA 5505 

C. Cisco ASA 5580 

D. Cisco ASA 5525-X 

Answer:


Q97. Which Cisco adaptive security appliance command can be used to view the count of all active VPN sessions? 

A. show vpn-sessiondb summary 

B. show crypto ikev1 sa 

C. show vpn-sessiondb ratio encryption 

D. show iskamp sa detail 

E. show crypto protocol statistics all 

Answer:


Q98. In DMVPN phase 2, which two EIGRP features need to be disabled on the hub to allow spoke-to-spoke communication? (Choose two.) 

A. autosummary 

B. split horizon 

C. metric calculation using bandwidth 

D. EIGRP address family 

E. next-hop-self 

F. default administrative distance 

Answer: B,E 


Q99. Which command will prevent a group policy from inheriting a filter ACL in a clientless SSL VPN? 

A. vpn-filter none 

B. no vpn-filter 

C. filter value none 

D. filter value ACLname 

Answer:

Reference: 

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/T-Z/cmdref4/v.html#pgfId-1842564 


Q100. Refer to the exhibit. 

The customer can establish an AnyConnect connection on the first attempt only. Subsequent attempts fail. What might be the issue? 

A. IKEv2 is blocked over the path. 

B. UserGroup must be different than the name of the connection profile. 

C. The primary protocol should be SSL. 

D. UserGroup must be the same as the name of the connection profile. 

Answer: