View Full Cisco CCNP Security 300-730 Exam Dumps and Practice Test Dumps.

 

Question 281

Which GETVPN characteristic allows encrypted group traffic to retain the original IP addressing information?

1. Use of NHRP
2. Preservation of the original IP header
3. Use of a VTI
4. NAT traversal

Correct Answer: 2

Explanation

GETVPN is designed for group-based encryption and can preserve the original IP header when protecting traffic. This characteristic allows existing routing information to remain visible and can be useful in enterprise networks where routing between multiple sites is already established. Unlike traditional point-to-point tunnel designs, GETVPN does not require a separate tunnel interface for every pair of communicating sites. The Key Server distributes the required cryptographic information and policies to authorized group members. NHRP is associated with DMVPN, VTI is used in route-based VPN designs, and NAT traversal addresses a different problem.

Question 282

Which GETVPN device role encrypts and decrypts protected group traffic?

1. Group Member
2. Key Server
3. Certificate Authority
4. RADIUS Server

Correct Answer: 1

Explanation

GETVPN Group Members are the routers that perform encryption and decryption of protected group traffic. They receive cryptographic keys and security policies from the centralized Key Server. The Key Server is responsible for distributing the necessary information and controlling group membership rather than acting as the normal data-plane encryption endpoint for every packet. A Certificate Authority issues certificates, while RADIUS provides centralized AAA services. The Group Member role is therefore directly associated with protecting user traffic in a GETVPN deployment. Understanding the distinction between the Key Server and Group Members is important when designing and troubleshooting GETVPN.

Question 283

Which GETVPN component determines whether a router is authorized to participate in the encryption group?

1. NHRP Server
2. Key Server
3. DHCP Server
4. DNS Server

Correct Answer: 2

Explanation

The GETVPN Key Server manages group membership and distributes the cryptographic keys and policies required by authorized Group Members. During registration, a Group Member establishes its relationship with the Key Server and receives the information needed to participate in the protected group. This centralized architecture simplifies key management compared with manually configuring separate point-to-point IPsec relationships between every site. NHRP servers are associated with DMVPN, while DHCP and DNS provide completely different network services. The Key Server therefore performs the central authorization and key-management role within GETVPN.

Question 284

Which IPsec feature helps prevent an attacker from capturing a valid packet and retransmitting it later?

1. Confidentiality
2. Anti-replay protection
3. NAT exemption
4. Compression

Correct Answer: 2

Explanation

IPsec anti-replay protection helps defend against replay attacks, in which an attacker captures a valid protected packet and attempts to retransmit it later. IPsec uses sequence numbers and a replay window to determine whether received packets are acceptable or appear to have already been processed. Confidentiality protects the contents of traffic from unauthorized disclosure, while NAT exemption controls address translation behavior. Compression does not provide replay protection. Anti-replay mechanisms are particularly important because encryption and integrity alone do not necessarily prevent an attacker from retransmitting a previously valid packet.

Question 285

Which cryptographic mechanism is commonly used by IPsec to provide confidentiality?

1. AES
2. SHA
3. Diffie-Hellman
4. RSA certificate

Correct Answer: 1

Explanation

AES is a symmetric encryption algorithm commonly used by IPsec to provide confidentiality. It encrypts the protected payload so that unauthorized parties cannot read the contents of the communication. SHA-based algorithms are generally associated with integrity rather than encryption, while Diffie-Hellman is used for establishing shared keying material during IKE negotiation. Certificates can authenticate identities but do not themselves function as the bulk encryption algorithm for IPsec data. Therefore, AES is a common choice for providing confidentiality in modern IPsec VPN deployments.

Question 286

Which cryptographic function is primarily associated with verifying that protected VPN data has not been modified?

1. AES
2. Diffie-Hellman
3. SHA-based integrity
4. NAT

Correct Answer: 3

Explanation

SHA-based cryptographic mechanisms can be used as part of integrity protection to help verify that protected VPN data has not been modified in transit. Integrity mechanisms generate authentication information that the receiving device can validate. If the verification fails, the packet can be rejected because the contents may have been altered. AES is primarily associated with confidentiality, Diffie-Hellman establishes shared keying material, and NAT changes IP addressing information. In modern IPsec configurations, authenticated encryption modes may combine confidentiality and integrity more efficiently, but the underlying distinction between encryption and integrity remains important.

Question 287

What is the primary purpose of Diffie-Hellman in IKE?

1. Create a shared secret without directly transmitting the secret
2. Authenticate administrators
3. Assign IP addresses to VPN users
4. Filter URLs

Correct Answer: 1

Explanation

Diffie-Hellman allows two VPN peers to establish shared secret material over an untrusted communication channel without directly transmitting the resulting secret across the network. Each peer generates private information and exchanges corresponding public values. The mathematical properties of the exchange allow both sides to independently derive shared keying material. IKE uses this mechanism as part of secure key establishment. Diffie-Hellman does not perform administrator authentication, assign user IP addresses, or filter URLs. Authentication is handled through mechanisms such as pre-shared keys or digital certificates, while URL filtering is a separate security function.

Question 288

Which authentication method is generally more scalable for large numbers of VPN peers because identities can be validated through a PKI hierarchy?

1. Static pre-shared keys for every peer
2. Digital certificates
3. Plaintext passwords
4. MAC address filtering

Correct Answer: 2

Explanation

Digital certificates can provide scalable peer authentication by allowing VPN devices to validate identities through a Public Key Infrastructure. Instead of manually maintaining a unique shared secret relationship for every peer, certificates can be issued and validated through a Certificate Authority and associated trust hierarchy. Pre-shared keys can be effective for smaller deployments but may become difficult to manage as the number of peers increases. Passwords and MAC filtering are not substitutes for certificate-based VPN peer authentication. PKI therefore provides a structured framework for managing identity and trust across larger VPN environments.

Question 289

Which PKI component signs and issues digital certificates to trusted entities?

1. Certificate Authority
2. OCSP Responder
3. RADIUS Server
4. NHRP Server

Correct Answer: 1

Explanation

A Certificate Authority, or CA, is responsible for issuing and digitally signing certificates for trusted entities within a PKI environment. The CA establishes a trust relationship by using its signing key to certify the identity represented by a certificate. An OCSP responder provides certificate-status information, while RADIUS is commonly used for centralized AAA and NHRP supports DMVPN address resolution. During certificate-based VPN authentication, devices can validate certificates through the established trust chain. The CA therefore provides the foundational certificate-issuance function within a PKI architecture.

Question 290

Which PKI mechanism provides real-time or near-real-time information about whether a certificate has been revoked?

1. CRL
2. OCSP
3. SCEP
4. DHCP Snooping

Correct Answer: 2

Explanation

OCSP, or Online Certificate Status Protocol, allows a device to query an OCSP responder to determine the current status of a digital certificate. It can indicate whether a certificate is valid, revoked, or otherwise unavailable for status determination. A CRL provides revocation information through a published list, which may not be updated as frequently as an online query. SCEP is primarily used for certificate enrollment and provisioning, while DHCP Snooping protects against rogue DHCP activity. OCSP is therefore useful when a deployment requires more timely certificate-revocation status checking.

Question 291

What is the main purpose of a Certificate Revocation List?

1. To publish certificates that should no longer be trusted
2. To generate IKE encryption keys
3. To assign VPN IP addresses
4. To create NHRP mappings

Correct Answer: 1

Explanation

A Certificate Revocation List, or CRL, is a periodically published list containing certificates that have been revoked before their normal expiration date. Devices that validate certificates can consult the appropriate CRL to determine whether a certificate should still be trusted. A CRL is different from SCEP, which supports certificate enrollment, and OCSP, which provides online certificate-status checking. CRLs do not generate IKE keys or create NHRP mappings. They are an important part of PKI trust management because certificates may need to be revoked when their associated private keys are compromised or when an entity should no longer be trusted.

Question 292

Which protocol is commonly used to automate certificate enrollment for network devices?

1. OCSP
2. SCEP
3. ESP
4. NHRP

Correct Answer: 2

Explanation

SCEP, or Simple Certificate Enrollment Protocol, can automate certificate enrollment for supported network devices. It allows devices to obtain certificates from a PKI infrastructure without requiring every certificate to be manually installed. This is particularly useful when many devices require certificates for VPN authentication or other security functions. OCSP is used to check certificate status, ESP protects IPsec traffic, and NHRP supports dynamic address resolution in DMVPN. SCEP therefore addresses the certificate-provisioning portion of a PKI deployment rather than certificate revocation checking or VPN data protection.

Question 293

Which component establishes trust between a device certificate and a trusted root in a PKI hierarchy?

1. Certificate chain
2. Crypto ACL
3. NHRP shortcut
4. DHCP binding

Correct Answer: 1

Explanation

A certificate chain establishes a path of trust between an end-entity certificate and a trusted root Certificate Authority. Each certificate in the chain is signed by the authority above it, allowing a validating device to establish whether the presented certificate ultimately traces back to a trusted root. Crypto ACLs identify traffic for traditional IPsec policies, NHRP shortcuts support DMVPN forwarding, and DHCP bindings associate IP and MAC information. Certificate-chain validation is particularly important for certificate-based VPN authentication because the peer must be able to establish that the presented certificate comes from a trusted PKI hierarchy.

Question 294

Which AAA function determines what actions an authenticated user is permitted to perform?

1. Authentication
2. Accounting
3. Authorization
4. Encryption

Correct Answer: 3

Explanation

Authorization determines what an authenticated user or device is allowed to do. In an AAA architecture, authentication first verifies the identity, authorization then determines permitted services or actions, and accounting records activity. For network administration, authorization can include command-level permissions or privilege assignments. Encryption protects information but is not one of the three AAA functions. Keeping authentication and authorization conceptually separate is important because successfully proving identity does not automatically mean the user should have unrestricted access. Authorization policies allow organizations to apply different permissions according to identity, role, device, or other contextual information.

Question 295

Which AAA function verifies the identity of a user or device before access is granted?

1. Authentication
2. Authorization
3. Accounting
4. Auditing

Correct Answer: 1

Explanation

Authentication is the AAA function responsible for verifying identity. It determines whether the presented credentials or authentication method successfully proves that the user or device is who it claims to be. Authentication can use passwords, certificates, tokens, or other mechanisms depending on the deployment. Authorization occurs after authentication and determines what the authenticated identity is allowed to access or perform. Accounting records activity and usage information. Authentication is therefore the first core AAA function and provides the foundation for applying identity-based authorization policies.

Question 296

Which Cisco solution is designed to provide centralized identity-based network access control?

1. Cisco Umbrella
2. Cisco ISE
3. Cisco Secure Firewall Management Center
4. Cisco Secure Client

Correct Answer: 2

Explanation

Cisco Identity Services Engine, or Cisco ISE, provides centralized identity-based network access control. It can support technologies such as 802.1X, profiling, guest access, posture-related capabilities, and policy-based authorization. ISE can use information about users and devices to determine the appropriate access policy and can integrate with Cisco TrustSec for identity-based segmentation. Umbrella focuses on cloud-delivered security services, FMC centrally manages supported firewall platforms, and Secure Client provides endpoint connectivity and security capabilities. ISE is therefore the Cisco solution most directly associated with centralized identity-aware network access control.

Question 297

Which technology provides cryptographic protection for Ethernet frames at Layer 2?

1. MACsec
2. IPsec
3. RADIUS
4. NHRP

Correct Answer: 1

Explanation

MACsec provides cryptographic protection for Ethernet frames at Layer 2. It can provide confidentiality, integrity, and protection against certain types of frame manipulation on supported Ethernet links. IPsec instead protects IP traffic at Layer 3 and is commonly used for routed VPN connectivity. RADIUS is an AAA protocol, while NHRP supports dynamic address resolution in DMVPN. MACsec is particularly useful when organizations need to secure traffic across Ethernet infrastructure while maintaining normal Layer 2 operation. Its Layer 2 position distinguishes it from IPsec, which operates at the IP layer.

Question 298

Which Cisco security feature is specifically designed to protect against rogue DHCP servers on a switched network?

1. Dynamic ARP Inspection
2. IP Source Guard
3. DHCP Snooping
4. Port Security

Correct Answer: 3

Explanation

DHCP Snooping helps protect switched networks from rogue DHCP servers by identifying trusted and untrusted interfaces and controlling DHCP messages accordingly. It can prevent unauthorized DHCP servers from responding to clients and also builds a binding database containing information such as IP address, MAC address, VLAN, and interface. That binding information can then be used by other security features such as Dynamic ARP Inspection and IP Source Guard. DAI focuses on ARP validation, IP Source Guard validates source addressing, and Port Security controls MAC addresses. DHCP Snooping therefore provides the dedicated defense against rogue DHCP infrastructure.

Question 299

Which feature can use DHCP Snooping bindings to help prevent source IP spoofing?

1. URL Filtering
2. IP Source Guard
3. Application Control
4. Security Intelligence

Correct Answer: 2

Explanation

IP Source Guard can use the DHCP Snooping binding database to validate the source IP information of traffic received on a switch interface. If a packet uses a source address that does not match the expected binding, the switch can block the traffic according to the configured security behavior. This helps reduce source IP spoofing from access ports. URL Filtering controls web destinations, Application Control identifies applications, and Security Intelligence uses threat intelligence and reputation information. IP Source Guard therefore complements DHCP Snooping by using trusted address bindings for source validation.

Question 300

Which principle recommends using multiple independent security controls so that failure of one control does not expose the entire network?

1. Single sign-on
2. Defense in depth
3. Split tunneling
4. Route summarization

Correct Answer: 2

Explanation

Defense in depth is a security principle in which multiple layers of protection are deployed so that the failure or bypass of one control does not automatically compromise the entire environment. A layered architecture can combine identity controls, endpoint security, firewalls, intrusion prevention, VPN encryption, segmentation, monitoring, and other mechanisms. Single sign-on addresses authentication convenience, split tunneling is a VPN traffic-routing design, and route summarization is a routing technique. Defense in depth therefore focuses on reducing overall security risk by avoiding dependence on a single protective mechanism and creating multiple opportunities to detect or block threats.