Question 1

Refer to the exhibit.

An engineer is building an IKEv1 tunnel to a peer Cisco ASA, but the tunnel is failing. Based on the configuration in the exhibit, which action must be taken to allow the VPN tunnel to come up?

Options :

A : Add a route for the 10.7.7.0/24 network to egress the outside interface.

B : Enable IKEv1 on the outside interface.

C : Change the IKEv1 policy number to be at least 256.

D : Change the transform set mode to transport.

Answer: B

Question 2

A network administrator wants the Cisco ASA to automatically start downloading the Cisco AnyConnect client without prompting the user to select between WebVPN or AnyConnect. Which command accomplishes this task?

Options :

A : anyconnect ssl df-bit-ignore enable

B : anyconnect ask none default anyconnect

C : anyconnect ask enable default anyconnect

D : anyconnect modules value default

Answer: C

Question 3

Which benefit of FlexVPN is a limitation of DMVPN using IKEv1?

Options :

A :

GRE encapsulation allows for forwarding of non-IP traffic.

B :

IKE implementation can install routes in routing table.

C :

NHRP authentication provides enhanced security.

D :

Dynamic routing protocols can be configured.

Answer: B

Question 4

On an ASA with multiple connection profiles for different departments, what is the best design to ensure that AnyConnect users are assigned the correct connection profile based on their department and do not have the ability to choose a different connection profile?

Options :

A : group URL

B : group alias

C : dynamic access policy

D : certificate mapping

Answer: A

Question 5

A network engineer is configuring a server. The router will terminate encrypted VPN connections on g0/0, which is in the VRF "Internet". The cleartext traffic that must be encrypted before being sent out traverses g0/1, which is in the VRF "Internal". Which two VRF-specific configurations allow

VPN traffic to traverse the VRF-aware interfaces? (Choose two.)

Options :

A : Under the IKEv2 profile, add the ivrf Internal command.

B : Under the virtual-template interface, add the ip vrf forwarding Internet command.

C : Under the IKEv2 profile, add the match fvrf Internal command.

D : Under the IKEv2 profile, add the match fvrf Internet command

E : Under the virtual-template interface, add the tunnel vrf Internet command.

Answer: B,D