View Full Cisco CCNP Security 300-730 Exam Dumps and Practice Test Dumps.

 

Question 381

Which component determines the identity of a remote VPN peer during IKEv2 authentication based on configured matching criteria?

1. IKEv2 Profile
2. Transform Set
3. Crypto ACL
4. IPsec SA

Correct Answer: 1

Explanation

An IKEv2 profile contains parameters that control how an IKEv2 peer is identified and authenticated. It can include identity matching criteria and authentication methods that determine which configuration applies to a particular peer. This is especially important when a device supports multiple peers or different authentication policies. A transform set defines IPsec data-plane cryptographic parameters, while a crypto ACL identifies traffic for traditional policy-based IPsec. An IPsec Security Association contains negotiated parameters after successful negotiation rather than determining the peer configuration itself. Therefore, the IKEv2 profile is the appropriate component for peer identity matching and authentication policy selection.

Question 382

Which protocol is primarily responsible for negotiating cryptographic parameters before IPsec protects user traffic?

1. ESP
2. IKE
3. GRE
4. RADIUS

Correct Answer: 2

Explanation

Internet Key Exchange (IKE) is responsible for negotiating authentication, cryptographic parameters, and security associations used by IPsec. In IKEv2, the negotiation includes exchanges such as IKE_SA_INIT and IKE_AUTH. Once the necessary security associations are established, IPsec protocols such as ESP can protect user data. ESP itself provides data-plane security rather than performing the complete peer negotiation process. GRE provides tunneling without inherent encryption, while RADIUS is commonly used for centralized AAA. Therefore, IKE is the protocol responsible for negotiating the security parameters needed before IPsec protects user traffic.

Question 383

Which IPsec protocol provides confidentiality by encrypting the protected payload?

1. AH
2. ESP
3. ICMP
4. ARP

Correct Answer: 2

Explanation

Encapsulating Security Payload (ESP) provides confidentiality by encrypting protected IPsec traffic. Depending on the configuration and algorithms used, ESP can also provide integrity, authentication, and anti-replay protection. Authentication Header (AH), in contrast, provides integrity and authentication but does not provide encryption-based confidentiality. ICMP is a network-layer control protocol used for functions such as error reporting and diagnostics, while ARP maps IPv4 addresses to MAC addresses on local networks. Therefore, ESP is the IPsec protocol that provides confidentiality through encryption and is commonly used for VPN data protection.

Question 384

What is the primary function of an IPsec Security Association?

1. Assign IP addresses to VPN clients
2. Store negotiated security parameters for protected traffic
3. Provide DNS filtering
4. Discover DMVPN NBMA addresses

Correct Answer: 2

Explanation

An IPsec Security Association defines the security parameters used to protect traffic between VPN peers. These parameters can include cryptographic algorithms, keys, security protocol information, and other negotiated values required for secure communication. Security Associations are established through the IKE negotiation process and are then used by IPsec to protect data traffic. They do not assign client IP addresses, provide DNS filtering, or perform DMVPN address discovery. VPN client addressing is handled by remote-access configuration, DNS filtering can be provided by services such as Cisco Umbrella, and NHRP performs DMVPN address discovery. Therefore, storing negotiated security parameters is the primary function of an IPsec SA.

Question 385

Which DMVPN component is responsible for dynamically resolving a tunnel peer’s protocol address to its NBMA address?

1. IKEv2
2. RADIUS
3. NHRP
4. SCEP

Correct Answer: 3

Explanation

Next Hop Resolution Protocol (NHRP) is a key component of DMVPN and allows routers to dynamically resolve logical tunnel addresses to the underlying NBMA addresses. This capability enables DMVPN spokes to discover the physical or transport address of other peers and establish more direct communication when supported by the configured DMVPN phase. The hub commonly acts as an NHRP server, maintaining registrations from spokes. IKEv2 is used for VPN security negotiation, RADIUS provides AAA services, and SCEP supports certificate enrollment. Therefore, NHRP performs the dynamic address-resolution function required by DMVPN.

Question 386

Which DMVPN phase introduces NHRP Redirect and Shortcut mechanisms to optimize spoke-to-spoke communication?

1. Phase 1
2. Phase 2
3. Phase 3
4. Phase 4

Correct Answer: 3

Explanation

DMVPN Phase 3 introduces NHRP Redirect and NHRP Shortcut mechanisms that can improve spoke-to-spoke traffic forwarding. In a typical Phase 3 design, a hub can send an NHRP Redirect when it detects that traffic between spokes could use a more direct path. The relevant spoke can then use NHRP information to establish or use a direct spoke-to-spoke path. Phase 1 primarily relies on hub-and-spoke communication, while Phase 2 allows direct spoke-to-spoke communication using NHRP resolution. Therefore, Phase 3 is associated with the Redirect and Shortcut mechanisms.

Question 387

Which technology allows multiple IPsec-protected sites to participate in a group encryption model using centralized key management?

1. GETVPN
2. MACsec
3. SSL
4. DHCP Snooping

Correct Answer: 1

Explanation

Group Encrypted Transport VPN (GETVPN) is designed for group encryption environments where multiple network devices communicate securely while maintaining their original IP addressing. A centralized Key Server distributes security policies and cryptographic information to authorized Group Members. Unlike traditional point-to-point IPsec tunnels, GETVPN is designed for group-based communication and can preserve the original IP header. MACsec provides Layer 2 protection, SSL/TLS is used for secure application communications, and DHCP Snooping protects against rogue DHCP activity. Therefore, GETVPN is the technology specifically designed for centralized group encryption.

Question 388

In a GETVPN deployment, which device distributes group security policies and keys to authorized group members?

1. Spoke Router
2. Key Server
3. RADIUS Client
4. NHRP Server

Correct Answer: 2

Explanation

The GETVPN Key Server is responsible for distributing security policies and cryptographic key information to authorized Group Members. Group Members use the information provided by the Key Server to encrypt and decrypt traffic belonging to the configured security group. This centralized model simplifies key management for large group-based VPN environments. A spoke router is commonly associated with DMVPN terminology, while a RADIUS client communicates with an AAA server for authentication and authorization. An NHRP server is used in DMVPN to maintain protocol-to-NBMA mappings. Therefore, the Key Server performs the centralized key and policy distribution role in GETVPN.

Question 389

Which IPsec mode is commonly used when an entire original IP packet must be protected and a new outer IP header added?

1. Transport mode
2. Tunnel mode
3. Authentication mode
4. Access mode

Correct Answer: 2

Explanation

IPsec tunnel mode encapsulates the entire original IP packet inside a new IPsec-protected packet. A new outer IP header is added so that the VPN gateways can route the encapsulated traffic across an untrusted network such as the Internet. This mode is commonly used for site-to-site VPN connections between security gateways. Transport mode, by contrast, protects the payload of the original IP packet while retaining the original IP header and is often used for host-to-host communication. Authentication mode and access mode are not IPsec operating modes. Therefore, tunnel mode is the correct choice when the entire original packet is protected.

Question 390

Which IPsec mode normally retains the original IP header while protecting the packet payload?

1. Tunnel mode
2. Transport mode
3. GETVPN mode
4. DMVPN mode

Correct Answer: 2

Explanation

IPsec transport mode protects the payload of an IP packet while retaining the original IP header. Because the original addressing information remains visible for routing, transport mode is commonly associated with host-to-host IPsec communication. Tunnel mode instead encapsulates the complete original IP packet and adds a new outer IP header, making it commonly suitable for gateway-to-gateway site-to-site VPNs. GETVPN and DMVPN are VPN technologies or architectures rather than IPsec operating modes. Therefore, transport mode is the appropriate answer when the requirement is to retain the original IP header while protecting the payload.

Question 391

Which mechanism helps prevent an attacker from successfully replaying previously captured IPsec packets?

1. Sequence numbers and replay protection
2. DNS filtering
3. DHCP Snooping
4. URL categorization

Correct Answer: 1

Explanation

IPsec uses sequence numbers and replay-protection mechanisms to help detect packets that are retransmitted maliciously or arrive outside the acceptable replay window. Each protected packet can contain a sequence number, allowing the receiving device to identify duplicate or inappropriate packets. This protects against an attacker capturing valid encrypted traffic and attempting to send the same packets again. DNS filtering protects against malicious domain resolution, DHCP Snooping protects against rogue DHCP servers, and URL categorization controls web destinations. Therefore, sequence numbers combined with replay protection provide the mechanism designed to mitigate IPsec replay attacks.

Question 392

Which authentication method generally provides better scalability for a large number of VPN peers than manually configured shared secrets?

1. Static routes
2. Digital certificates
3. DHCP reservations
4. MAC addresses

Correct Answer: 2

Explanation

Digital certificates can provide scalable authentication for large VPN environments because identities can be managed through a Public Key Infrastructure rather than manually configuring a separate shared secret for every peer relationship. A Certificate Authority can issue certificates, while certificate chains establish trust between participating devices. This can simplify authentication management as the number of VPN peers increases. Static routes determine traffic paths, DHCP reservations assign addresses, and MAC addresses identify Layer 2 interfaces. None of these provide scalable cryptographic peer authentication. Therefore, digital certificates are commonly used when a VPN deployment requires scalable peer authentication.

Question 393

What is the primary role of a Certificate Authority in a PKI environment?

1. Assign DHCP addresses
2. Issue and sign digital certificates
3. Create IPsec tunnels directly
4. Perform NHRP resolution

Correct Answer: 2

Explanation

A Certificate Authority (CA) is a trusted PKI entity responsible for issuing and digitally signing certificates. The signature allows devices to verify that a certificate was issued by a trusted authority and that its contents have not been altered. In VPN deployments, certificates can be used for peer authentication and can scale better than manually configured pre-shared keys. The CA does not directly create IPsec tunnels, assign DHCP addresses, or perform NHRP resolution. Those functions belong to other network components and protocols. Therefore, issuing and signing digital certificates is the primary role of a Certificate Authority.

Question 394

Which protocol can automate certificate enrollment for network devices using a PKI infrastructure?

1. SCEP
2. NHRP
3. ESP
4. GRE

Correct Answer: 1

Explanation

Simple Certificate Enrollment Protocol (SCEP) is commonly used to automate certificate enrollment for network devices. It allows devices to request certificates from a Certificate Authority and supports deployment scenarios where manually generating and installing certificates on many devices would be inefficient. SCEP can therefore simplify PKI deployment for VPN authentication and other certificate-based security services. NHRP is associated with DMVPN address resolution, ESP protects IPsec data, and GRE provides tunneling without inherent encryption. Therefore, SCEP is the appropriate protocol for automated certificate enrollment in a supported PKI environment.

Question 395

Which AAA function determines what network resources or administrative actions an authenticated user is permitted to access?

1. Accounting
2. Authentication
3. Authorization
4. Encryption

Correct Answer: 3

Explanation

Authorization determines what an authenticated user or device is permitted to do. In an AAA architecture, authentication verifies the identity of the user, authorization determines the permissions or services available to that identity, and accounting records activity or usage information. For network administration, authorization can determine which commands an administrator is allowed to execute. Encryption is a security mechanism but is not one of the three AAA functions. Understanding the separation between authentication and authorization is important when troubleshooting access-control issues. Therefore, authorization is the AAA function responsible for determining permitted resources and actions.

Question 396

Which AAA protocol is commonly preferred for detailed command authorization of network administrators?

1. RADIUS
2. TACACS+
3. NTP
4. SCEP

Correct Answer: 2

Explanation

TACACS+ is commonly used for network device administrative AAA and provides detailed control over authorization, including command authorization. This allows an organization to centrally determine which administrative commands specific users or groups are permitted to execute. RADIUS is widely used for network access authentication, including 802.1X, although its capabilities and deployment models differ from TACACS+. NTP provides time synchronization, while SCEP automates certificate enrollment. Therefore, TACACS+ is commonly selected when centralized administrative authentication, authorization, and accounting with detailed command control are required.

Question 397

Which security technology provides cloud-delivered DNS-layer protection by enforcing security policies on DNS requests?

1. Cisco Umbrella
2. Cisco TrustSec
3. MACsec
4. Port Security

Correct Answer: 1

Explanation

Cisco Umbrella provides cloud-delivered security services that can enforce policies at the DNS layer. DNS requests can be evaluated against security intelligence and policy information, allowing malicious or unwanted destinations to be blocked before a connection is established. This can provide an additional layer of protection for users and devices, including those operating outside traditional network perimeters depending on the deployment. Cisco TrustSec focuses on identity-based segmentation, MACsec protects Layer 2 Ethernet traffic, and Port Security controls MAC addresses on switch ports. Therefore, Cisco Umbrella is the technology associated with cloud-delivered DNS-layer security.

Question 398

Which switch security feature can validate ARP packets against trusted IP-to-MAC bindings?

1. IP Source Guard
2. Dynamic ARP Inspection
3. Port Security
4. DHCP Relay

Correct Answer: 2

Explanation

Dynamic ARP Inspection (DAI) validates ARP packets by comparing their IP-to-MAC information against trusted binding information, commonly obtained from the DHCP Snooping binding database. This helps protect against ARP spoofing and related man-in-the-middle attacks. IP Source Guard focuses on validating source IP information in traffic entering a switch port. Port Security controls allowed MAC addresses, while DHCP Relay forwards DHCP messages between clients and DHCP servers. DAI therefore provides the specific ARP validation function described in the question and is commonly deployed together with DHCP Snooping.

Question 399

Which feature helps prevent a host from using an unauthorized source IP address on a switch port?

1. IP Source Guard
2. URL Filtering
3. IKEv2 Profile
4. OCSP

Correct Answer: 1

Explanation

IP Source Guard helps prevent source-address spoofing by validating the source IP information of traffic entering a switch port. In common deployments, it uses bindings learned through DHCP Snooping to determine which IP and MAC combinations are legitimate for a particular interface. Traffic that does not match the expected binding can be restricted or dropped according to the configuration. URL Filtering controls web destinations, an IKEv2 profile manages VPN identity and authentication parameters, and OCSP checks certificate revocation status. Therefore, IP Source Guard is the appropriate Layer 2 security feature for controlling unauthorized source IP addresses.

Question 400

A security administrator wants to limit the number of MAC addresses that can be learned on an access switch port. Which feature should be configured?

1. Dynamic ARP Inspection
2. DHCP Snooping
3. Port Security
4. Cisco Umbrella

Correct Answer: 3

Explanation

Port Security allows an administrator to restrict which MAC addresses can be associated with a switch port and can limit the maximum number of MAC addresses that are permitted. This is useful for controlling unauthorized devices and reducing certain types of Layer 2 attacks. Depending on configuration, violations can trigger actions such as dropping traffic or generating notifications. Dynamic ARP Inspection validates ARP packets, DHCP Snooping protects against rogue DHCP servers and creates bindings, and Cisco Umbrella provides DNS-layer security. Therefore, Port Security is the appropriate feature when the requirement is to limit the number of MAC addresses on an access port.