♥♥ 2021 NEW RECOMMEND ♥♥

Free VCE & PDF File for Cisco 300-209 Real Exam (Full Version!)

★ Pass on Your First TRY ★ 100% Money Back Guarantee ★ Realistic Practice Exam Questions

Free Instant Download NEW 300-209 Exam Dumps (PDF & VCE):
Available on: http://www.surepassexam.com/300-209-exam-dumps.html

Q21. Which IKEv2 feature minimizes the configuration of a FlexVPN on Cisco IOS devices? 

A. IKEv2 Suite-B 

B. IKEv2 proposals 

C. IKEv2 profiles 

D. IKEv2 Smart Defaults 

Answer: D 


Q22. You are troubleshooting a site-to-site VPN issue where the tunnel is not establishing. After issuing the debug crypto isakmp command on the headend router, you see the following output. What does this output suggest? 

1d00h: ISAKMP (0:1): atts are not acceptable. Next payload is 0 

1d00h: ISAKMP (0:1); no offers accepted! 

1d00h: ISAKMP (0:1): SA not acceptable! 

1d00h: %CRYPTO-6-IKMP_MODE_FAILURE. Processing of Main Mode failed with peer at 10.10.10.10 

A. Phase 1 policy does not match on both sides. 

B. The transform set does not match on both sides. 

C. ISAKMP is not enabled on the remote peer. 

D. There is a mismatch in the ACL that identifies interesting traffic. 

Answer: A 


Q23. Based on the provided ASDM configuration for the remote ASA, which one of the following is correct?

A. An access-list must be configured on the outside interface to permit inbound VPN traffic 

B. A route to 192.168.22.0/24 will not be automatically installed in the routing table 

C. The ASA will use a window of 128 packets (64x2) to perform the anti-replay check _ 

D. The tunnel can also be established on TCP port 10000 

Answer: C 

Explanation: 

Cisco IP security (IPsec) authentication provides anti-replay protection against an attacker duplicating encrypted packets by assigning a unique sequence number to each encrypted packet. The decryptor keeps track of which packets it has seen on the basis of these numbers. Currently, the default window size is 64 packets. Generally, this number (window size) is sufficient, but there are times when you may want to expand this window size. The IPsec Anti-Replay Window: Expanding and Disabling feature allows you to expand the window size, allowing the decryptor to keep track of more than 64 packets. 


Q24. Which two features are required when configuring a DMVPN network? (Choose two.) 

A. Dynamic routing protocol 

B. GRE tunnel interface 

C. Next Hop Resolution Protocol 

D. Dynamic crypto map 

E. IPsec encryption 

Answer: B,C 


Q25. Refer to the exhibit. 

You executed the show crypto ipsec sa command to troubleshoot an IPSec issue. What problem does the given output indicate? 

A. IKEv2 failed to establish a phase 2 negotiation. 

B. The Crypto ACL is different on the peer device. 

C. ISAKMP was unable to find a matching SA. 

D. IKEv2 was used in aggressive mode. 

Answer: B 


Q26. Which option is a possible solution if you cannot access a URL through clientless SSL VPN with Internet Explorer, while other browsers work fine? 

A. Verify the trusted zone and cookies settings in your browser. 

B. Make sure that you specified the URL correctly. 

C. Try the URL from another operating system. 

D. Move to the IPsec client. 

Answer: A 


Q27. Regarding licensing, which option will allow IKEv2 connections on the adaptive security appliance? 

A. AnyConnect Essentials can be used for Cisco AnyConnect IKEv2 connections. 

B. IKEv2 sessions are not licensed. 

C. The Advanced Endpoint Assessment license must be installed to allow Cisco AnyConnect IKEv2 sessions. 

D. Cisco AnyConnect Mobile must be installed to allow AnyConnect IKEv2 sessions. 

Answer: B 


Q28. Which two are features of GETVPN but not DMVPN and FlexVPN?.(Choose two.) 

A. one IPsec SA for all encrypted traffic 

B. no requirement for an overlay routing protocol 

C. design for use over public or private WAN 

D. sequence numbers that enable scalable replay checking 

E. enabled use of ESP or AH 

F. preservation of IP protocol in outer header 

Answer: A,B 


Q29. Which technology does a multipoint GRE interface require to resolve endpoints? 

A. ESP 

B. dynamic routing 

C. NHRP 

D. CEF 

E. IPSec 

Answer: C 


Q30. Which are two main use cases for Clientless SSL VPN? (Choose two.) 

A. In kiosks that are part of a shared environment 

B. When the users do not have admin rights to install a new VPN client 

C. When full tunneling is needed to support applications that use TCP, UDP, and ICMP 

D. To create VPN site-to-site tunnels in combination with remote access 

Answer: A,B