CCNP Security Practice Test | Secure Mobility (SIMOS)

Exam: 300-209

Question 1 / 15

90:00

Which set of commands will correctly configure the local authorization policy?

A. Router(config)#crypto ikev2 authorization policy policy1
Router(config-ikev2-author-policy)#pool flex-pool
Router(config-ikev2-author-policy)#def-domain brocadero.com
Router(config-ikev2-author-policy)#route set interface
Rout

B. Router(config-ikev2-profile)#virtual-template 1

C. Router(config)#crypto ipsec profile default
Router(ipsec-profile)#set ikev2-profile default

D. Router(config)#aaa new-model
Router(config)#aaa authorization network list1 local

Which statements regarding the verification of DMVPN full-mesh routing and IKE peering are true? (Choose two)

A. Multiple IKE sessions are established.

B. Direct routes to other spokes exist from the spoke.

C. A single IKE session is created.

D. Spokes are reachable over the hub.

What is the purpose of a connection profile? (Choose two)

A. It defines the client privileges

B. It defines prelogin behavior

C. It is a reference to the Group Policy

D. It includes the split tunneling configuration

What are the characteristics of symmetric algorithms? (Choose three)

A. Efficient, fast, and simple to accelerate in hardware

B. Typical key lengths are in thousands of bits

C. Examples are RSA and ECC

D. Suitable for real-time bulk encryption

E. Generally used for digital signatures or key exchanges

F. Examples are 3DES, RC4, SEAL, AES, and Blowfish

What is the first required step in configuring a DMVPN spoke?

A. Configure an IPSec profile with an optional transform set

B. Create an mGRE tunnel interface

C. Generate or configure hub authentication credentials

D. Associate the IPSec profile with the mGRE interface

You are troubleshooting a failed clientless SSL VPN session establishment. Which two utilities can be used to query the DNS server to troubleshoot issues why the browser cannot resolve the SSL VPN portal's URL? (Choose two)

A. arp

B. dig

C. traceroute

D. ping

E. nslookup

When using smart tunnel-based application access with SSL VPN, what happens directly after a user connects and authenticates to the SSL VPN portal?

A. The SSL VPN gateway establishes a TCP connection with the real target server and acts as a data relay between the two TCP sessions

B. A smart tunnel configuration downloads and executes the smart tunnel agent on the client system

C. The smart tunnel applet intercepts the TCP connection of the Lotus Sametime client to the real server and forwards the TCP connection to the existing SSL VPN session

D. The SSL VPN gateway extracts the TCP session from the SSL VPN session

Which commands can be used to restore the original IKEv2 Smart Defaults values? (Choose two)

A. default crypto ipsec transform-set

B. default crypto ikev2 proposal

C. no crypto ipsec transform-set default

D. no crypto ikev2 proposal default

Which three security algorithms are minimally recommended when configuring IKE VPN technologies? (Choose three)

A. SHA-1

B. DES

C. MD5

D. 3DES

E. Group 5

F. Group 14

G. AES-CBC-128

H. SHA-256

Which method of certificate enrollment using SCEP automates the enrollment of Cisco AnyConnect users?

A. Simple Certificate Enrollment Protocol Proxy

B. Direct Simple Certificate Enrollment Protocol

C. Manual

D. Microsoft Active Directory Certificate Services

Which two site-to-site VPN technologies natively support IP Multicasts? (Choose two)

A. IPSec VPN

B. DMVPN

C. FlexVPN

D. GETVPN

Which command is used to verify that the ECDSA keys have been successfully generated?

A. show crypto key

B. show crypto ipsec sa detail

C. show crypto ipsec sa

D. show crypto pki certificates verbose

Which SSL VPN portal home page view enables you to verify smart tunnels when they have been configured to start manually?

A. Web Applications

B. VNC Connections

C. Application Access

D. Browse Networks

What are the three fields in an X.509v3 certificate? (Choose three)

A. Serial Number

B. Validity Period

C. Owner Full Name

D. Version

E. Usage Order

Review the output. Which statement is true concerning the output?

A. The HostScan extension can be activated.

B. The HostScan extension cannot be activated.

C. HostScan should be enabled on a branch device, not on an HQ.

D. There is not enough information to determine whether the HostScan extension can be activated.

While calculating your results take a moment to complete our simple survey!
How likely is it that you would recommend LearnCisco.net to a friend or colleague?
0	1	2	3	4	5	6	7	8	9	10

Not at all likely								Extremely likely
Why?

While calculating your results take a moment to complete our simple survey!

How likely is it that you would recommend LearnCisco.net to a friend or colleague?

Why?

How likely is it that you would recommend LearnCisco.net
to a friend or colleague?