December/2019 New Braindump2go 300-209 Exam Dumps with PDF and VCE Free Updated Today! Following are some new 300-209 Exam Questions!
New Question
A user is experiencing issues connecting to a Cisco AnyConnect VPN and receives this error message:
The AnyConnect package on the secure gateway could not be located.
You may be experiencing network connectivity issues. Please try connecting again.
Which option is the likely cause of this issue?
A. This Cisco ASA firewall has experienced a failure.
B. The user is entering an incorrect password.
C. The user’s operating system is not supported with the ASA’s current configuration.
D. The user laptop clock is not synchronized with NTP.
Answer: C
New Question
Which two operational advantages does GetVPN offer over site-to-site IPsec tunnel in a private MPLS-based core network? (Choose two.)
A. Key servers perform encryption and decryption of all the data in the network, which allows for tight security policies.
B. Traffic uses one VRF to encrypt data and a different on to decrypt data, which allows for multicast traffic isolation.
C. GETVPN is tunnel-less, which allows any group member to perform decryption and routing around network failures.
D. Packets carry original source and destination IP addresses, which allows for optimal routing of encrypted traffic.
E. Group Domain of Interpretation protocol allows for homomorphic encryption, which allows group members to operate on messages without decrypting them
Answer: CD
Explanation:
http://www.cisco.com/c/en/us/products/collateral/security/group-encrypted-transport-vpn/deployment_guide_c07_554713.html
New Question
An administrator received a report that a user cannot connect to the headquarters site using Cisco AnyConnect and receives this error. The installer was not able to start the Cisco VPN client, clientless access is not available, Which option is a possible cause for this error?
A. The client version of Cisco AnyConnect is not compatible with the Cisco ASA software image.
B. The operating system of the client machine is not supported by Cisco AnyConnect.
C. The driver for Cisco AnyConnect is outdatate.
D. The installed version of Java is not compatible with Cisco AnyConnect.
Answer: A
New Question
Scenario:
You are the senior network security administrator for your organization. Recently and junior
engineer configured a site-to-site IPsec VPN connection between your headquarters Cisco
ASA and a remote branch office.
You are now tasked with verifying the IKEvl IPsec installation to ensure it was properly
configured according to designated parameters. Using the CLI on both the Cisco ASA and
branch ISR, verify the IPsec configuration is properly configured between the two sites.
NOTE: the show running-config command cannot be used for this exercise.
Topology:
What is being used as the authentication method on Die branch ISR?
A. Certificates
B. Pre-shared keys
C. RSA public keys
D. Diffie-Hellman Group 2
Answer: D
New Question
Using the Next Generation Encryption technologies, which is the minimum acceptable encryption level to protect sensitive information?
A. AES 92 bits
B. AES 128 bits
C. AES 256 bits
D. AES 512 bits
Answer: B
New Question
An engineer is configuring an IPsec VPN with IKEv2.
Which three components are part of the IKEv2 proposal for this implementation? (Choos three.)
A. key ring
B. DH group
C. integrity
D. tunnel name
E. encryption
Answer: BCE
New Question
Which command can be used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?
A. show crypto lkev2 client flexvpn
B. show crypto identity
C. show crypto isakmp sa
D. show crypto gkm
Answer: A
New Question
Refer to the exhibit. An engineer encounters a debug message.
Which action can the engineer take to eliminate this error message?
A. Use stronger encryption suite.
B. Correct the VPN peer address.
C. Make adjustment to IPSec replay window.
D. Change the preshared key to match.
Answer: C
New Question
Which two changes must be made to migrate from DMVPN Phase 2 to Phase 3 when EIGRP is configured? (Choose two )
A. Disable EIGRP next-hop-self on the hub.
B. Enable EIGRP next-hop-self on the hub.
C. Add NHRP shortcuts on the hub.
D. Add NHRP redirects on the hub.
E. Add NHRP redirects on the spoke.
Answer: AD
New Question
Refer to the exhibit. VPN load balancing provides a way to distribute remote access, IPsec, and SSL VPN connections across multiple security appliances.
Which remote access client types does the load balancing feature support?
A. IPsec site-to-site tunnels
B. L2TP over IPsec
C. OpenVPN
D. Cisco AnyConnect Secure Mobility Client
Answer: D
New Question
Which two are features of GETVPN but not DMVPN and FlexVPN? (Choose two.)
A. sequence numbers that enable scalable replay checking CD protocol
B. no requirement for an overlay routing protocol.
C. design for use over public or private.
D. WAN enabled use of ESP or AH.
E. one IPsec SA for all encrypted traffic.
Answer: BE
New Question
Refer to the exhibit. A new NOC engineer, while viewing a real-time log from an SSL VPN tunnel, has a question about a line in the log.
The IP address 172.26.26.30 is attached to which interface in the network?
A. the Cisco ASA physical interface
B. the physical interface of the end user
C. the Cisco ASA SSL VPN tunnel interface
D. the SSL VPN tunnel interface of the end user
Answer: B
New Question
You have been using pre-shared keys for IKE authentication on your VPN.
Your network has grown rapidly, and now you need to create VPNs with numerous IPsec peers.
How can you enable scaling to numerous IPsec peers?
A. Migrate to external CA-based digital certificate authentication.
B. Migrate to a load-balancing server.
C. Migrate to a shared license server.
D. Migrate from IPsec to SSL VPN client extended authentication.
Answer: A
New Question
Which statement is correct concerning the trusted network detection (TND) feature?
A. The Cisco AnyConnect 3.0 Client supports TND on Windows, Mac, and Linux platforms.
B. With TND, one result of a Cisco Secure Desktop basic scan on an endpoint is to determine whether a device is a member of a trusted or an untrusted network.
C. If enabled, and a CSD scan determines that a host is a member of an untrusted network, an administrator can configure the TND feature to prohibit an end user from launching the Cisco AnyConnect VPN Client.
D. When the user is inside the corporate network, TND can be configured to automatically disconnect a Cisco AnyConnect session.
Answer: D
Explanation:
http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect25/administrat ion/guide/ac03features.html
Trusted Network Detection
Trusted Network Detection (TND) gives you the ability to have AnyConnect automatically disconnect a VPN connection when the user is inside the corporate network (the trusted network) and start the VPN connection when the user is outside the corporate network (the untrusted network). This feature encourages greater security awareness by initiating a VPN connection when the user is outside the trusted network.
If AnyConnect is also running Start Before Logon (SBL), and the user moves into the trusted network, the SBL window displayed on the computer automatically closes. TND does not interfere with the ability of the user to manually establish a VPN connection. It does not disconnect a VPN connection that the user starts manually in the trusted network. TND only disconnects the VPN session if the user first connects in an untrusted network and moves into a trusted network. For example, TND disconnects the VPN session if the user makes a VPN connection at home and then moves into the corporate office.
Because the TND feature controls the AnyConnect GUI and automatically initiates connections, the GUI should run at all times. If the user exits the GUI, TND does not automatically start the VPN connection.
You configure TND in the AnyConnect profile. No changes are required to the ASA configuration.
New Question
Refer to the exhibit. A NOC engineer needs to tune some postlogin parameters on an SSL VPN tunnel.
From the information shown, where should the engineer navigate to, in order to find all the postlogin session parameters?
A. “engineering” Group Policy
B. “contractor” Connection Profile
C. DefaultWEBVPNGroup Group Policy
D. DefaultRAGroup Group Policy
E. “engineer1” AAA/Local Users
Answer: B
1.|2019 Latest Braindump2go 300-209 Exam Dumps (PDF & VCE) Instant Download:
https://www.braindump2go.com/300-209.html
2.|2019 Latest Braindump2go 300-209 Exam Questions & Answers Instant Download:
https://drive.google.com/drive/folders/0B75b5xYLjSSNRkY3M21SbTdTNDg?usp=sharing