Q1. Which algorithm is replaced by elliptic curve cryptography in Cisco NGE?
A. 3DES
B. AES
C. DES
D. RSA
Answer: D
Q2. Which technology can provide high availability for an SSL VPN?
A. DMVPN
B. a multiple-tunnel configuration
C. a Cisco ASA pair in active/passive failover configuration
D. certificate to tunnel group maps
Answer: C
Q3. Which VPN feature allows remote access clients to print documents to local network printers?
A. Reverse Route Injection
B. split tunneling
C. loopback addressing
D. dynamic virtual tunnels
Answer: B
Q4. What is the Cisco recommended TCP maximum segment on a DMVPN tunnel interface when the MTU is set to 1400 bytes?
A. 1160 bytes
B. 1260 bytes
C. 1360 bytes
D. 1240 bytes
Answer: C
Q5. Which option describes the purpose of the command show derived-config interface virtual-access 1?
A. It verifies that the virtual access interface is cloned correctly with per-user attributes.
B. It verifies that the virtual template created the tunnel interface.
C. It verifies that the virtual access interface is of type Ethernet.
D. It verifies that the virtual access interface is used to create the tunnel interface.
Answer: A
Q6. Which two IKEv1 policy options must match on each peer when you configure an IPsec site-to-site VPN? (Choose two.)
A. priority number
B. hash algorithm
C. encryption algorithm
D. session lifetime
E. PRF algorithm
Answer: B,C
Q7. A custom desktop application needs to access an internal server. An administrator is tasked with configuring the company's SSL VPN gateway to allow remote users to work. Which two technologies would accommodate the company's requirement? (Choose two).
A. AnyConnect client
B. Smart Tunnels
C. Email Proxy
D. Content Rewriter
E. Portal Customizations
Answer: A,B
Q8. Which three settings are required for crypto map configuration? (Choose three.)
A. match address
B. set peer
C. set transform-set
D. set security-association lifetime
E. set security-association level per-host
F. set pfs
Answer: A,B,C
Q9. Scenario
Your organization has just implemented a Cisco AnyConnect SSL VPN solution. Using Cisco ASDM, answer the questions regarding the implementation.
Note: Not all screens or option selections are active for this exercise.
Topology
Default_Home
Which two networks will be included in the secured VPN tunnel? (Choose two.)
A. 10.10.0.0/16
B. All networks will be securely tunneled
C. Networks with a source of any4
D. 10.10.9.0/24
E. DMZ network
Answer: A,E
Explanation:
Navigate to the Configuration -> Remote Access -> Group Policies tab to observe the following:
Then, click on the DlftGrpPolicy to see the following:
On the left side, select “Split Tunneling” to get to this page:
Here you see that the Network List called “Inside Subnets” is being tunneled (secured). Select Manage to see the list of networks
Here we see that the 10.10.0.0/16 and DMZ networks are being secured over the tunnel.
Q10. Where do you configure AnyConnect certificate-based authentication in ASDM?
A. group policies
B. AnyConnect Connection Profile
C. AnyConnect Client Profile
D. Advanced Network (Client) Access
Answer: B