View Full Cisco CCNP Security 300-730 Exam Dumps and Practice Test Dumps.

 

Question 201

Which technology is designed to provide scalable hub-and-spoke VPN connectivity while dynamically establishing spoke-to-spoke tunnels?

1. MACsec
2. DMVPN
3. RADIUS
4. SCEP

Correct Answer: 2

Explanation

Dynamic Multipoint VPN, or DMVPN, is designed to provide scalable VPN connectivity using a hub-and-spoke architecture while supporting dynamically created spoke-to-spoke tunnels. DMVPN combines multipoint GRE, NHRP, and IPsec to provide dynamic tunnel establishment and secure communication. NHRP helps spokes discover the addresses of other spokes, while IPsec provides traffic protection. This architecture can reduce the need to manually configure individual point-to-point tunnels between every branch. MACsec provides Layer 2 protection, RADIUS provides AAA services, and SCEP supports certificate enrollment.

Question 202

Which DMVPN component allows a spoke to dynamically discover the NBMA address of another spoke?

1. NHRP
2. IKEv2
3. TACACS+
4. OCSP

Correct Answer: 1

Explanation

Next Hop Resolution Protocol, or NHRP, allows DMVPN routers to dynamically discover the NBMA addresses associated with other VPN peers. A spoke registers its information with the hub, and NHRP can later resolve the address of another spoke when direct communication is required. This dynamic mapping capability is one of the key features that makes DMVPN scalable. IKEv2 negotiates IPsec security relationships, TACACS+ provides administrative AAA, and OCSP checks certificate status. NHRP therefore performs the address-resolution function required for dynamic DMVPN tunnel establishment.

Question 203

What is the primary role of the DMVPN hub in NHRP?

1. Issue digital certificates
2. Maintain registrations from spokes
3. Encrypt all Ethernet frames
4. Perform DNS filtering

Correct Answer: 2

Explanation

In a typical DMVPN deployment, the hub acts as the central NHRP registration point. Spokes register their tunnel and NBMA information with the hub so that the hub can maintain mappings between logical tunnel addresses and underlying transport addresses. These mappings can then support dynamic spoke discovery and tunnel establishment. The hub may also participate in forwarding depending on the DMVPN phase and traffic pattern. Digital certificate issuance belongs to a certificate authority, Ethernet frame protection can be provided by MACsec, and DNS filtering is associated with solutions such as Cisco Umbrella.

Question 204

Which DMVPN feature allows a hub to inform a spoke that a more direct path to another spoke is available?

1. NHRP Redirect
2. DHCP Snooping
3. IKE_AUTH
4. OCSP

Correct Answer: 1

Explanation

NHRP Redirect is an important feature associated with DMVPN Phase 3. When traffic is initially sent through the hub, the hub can send an NHRP redirect message to inform the spoke that a more direct path to the destination spoke may be available. The originating spoke can then use NHRP mechanisms to obtain the necessary information and establish a more direct forwarding path. This helps improve scalability and reduce unnecessary hub forwarding. DHCP Snooping, IKE_AUTH, and OCSP perform unrelated security or network-management functions.

Question 205

Which DMVPN feature allows a spoke to use information learned from NHRP to create a more direct path to another spoke?

1. NHRP Shortcut
2. Certificate Revocation
3. NAT Exemption
4. Application Control

Correct Answer: 1

Explanation

NHRP Shortcut is associated with DMVPN Phase 3 and allows a spoke to use NHRP information to establish a more direct forwarding path toward another spoke. The process commonly works together with NHRP Redirect messages from the hub. Instead of continuing to forward traffic through the hub, the spoke can resolve the destination spoke’s transport information and use the appropriate direct path. Certificate revocation, NAT exemption, and Application Control are unrelated functions. NHRP Shortcut is therefore an important mechanism for improving traffic efficiency in scalable Phase 3 DMVPN deployments.

Question 206

Which three technologies form the traditional foundation of DMVPN?

1. GRE, RADIUS, and CRL
2. mGRE, NHRP, and IPsec
3. DHCP, DNS, and TACACS+
4. MACsec, SCEP, and OCSP

Correct Answer: 2

Explanation

DMVPN traditionally combines multipoint GRE, NHRP, and IPsec. Multipoint GRE provides the tunnel framework capable of supporting multiple peers through a shared tunnel interface. NHRP provides dynamic mappings and peer discovery, allowing spokes to learn the transport addresses of other VPN peers. IPsec provides encryption, integrity, authentication, and related security services for the traffic. Together, these technologies create a scalable VPN architecture. RADIUS, TACACS+, SCEP, OCSP, DHCP, and DNS perform different functions and are not the three fundamental building blocks of traditional DMVPN.

Question 207

Which technology is specifically designed for group encryption where multiple sites can communicate securely without creating a separate point-to-point tunnel for every pair?

1. GETVPN
2. SSH
3. Port Security
4. URL Filtering

Correct Answer: 1

Explanation

GETVPN is designed for group-based encryption in enterprise networks where multiple sites need secure any-to-any communication. Instead of creating a separate traditional point-to-point IPsec tunnel between every pair of sites, GETVPN uses a group-based security model. A Key Server distributes cryptographic keys and policies to authorized Group Members. GETVPN can preserve the original IP addressing structure, which can be useful in enterprise WAN environments. SSH secures remote management sessions, Port Security controls switch-port MAC addresses, and URL Filtering controls web destinations. GETVPN therefore provides a specialized approach to scalable group encryption.

Question 208

In GETVPN, which device distributes the cryptographic keys and security policies to authorized Group Members?

1. Hub router
2. Key Server
3. RADIUS server
4. Certificate Authority

Correct Answer: 2

Explanation

The GETVPN Key Server is responsible for distributing cryptographic keys and security policies to authorized Group Members. Group Members register with the Key Server and receive the information necessary to participate in the secure group. The Key Server is therefore a central control-plane component of GETVPN. It does not necessarily carry the actual user traffic between group members. A RADIUS server performs AAA functions, while a Certificate Authority issues certificates. The Key Server’s specialized role is to manage the cryptographic material and policies required for group-based IPsec protection.

Question 209

What is a significant characteristic of GETVPN regarding the original IP packet?

1. It normally replaces the original IP addressing with a new tunnel IP header
2. It preserves the original IP addressing structure
3. It removes the original IP header
4. It converts the packet into an Ethernet frame

Correct Answer: 2

Explanation

A notable characteristic of GETVPN is that it can preserve the original IP header and addressing structure while providing IPsec protection. This differs from traditional tunnel-mode site-to-site VPNs, where the original IP packet is encapsulated inside a new IP packet with an outer IP header. Preserving the original addressing can be useful in enterprise WAN environments where routing and multicast behavior need to remain visible across the secured network. GETVPN therefore fits scenarios requiring scalable group encryption without the same tunnel-overlay behavior of traditional site-to-site IPsec.

Question 210

Which IPsec protocol provides encryption and can also provide integrity and authentication for protected traffic?

1. AH
2. ESP
3. ARP
4. ICMP

Correct Answer: 2

Explanation

Encapsulating Security Payload, or ESP, provides IPsec protection that can include confidentiality through encryption as well as integrity and authentication. ESP also supports anti-replay protection through sequence numbers and replay windows. This makes ESP the commonly used IPsec protocol for modern VPN deployments. Authentication Header, or AH, provides integrity and authentication but does not provide encryption. ARP maps IPv4 addresses to MAC addresses, while ICMP supports network-control and diagnostic messaging. ESP is therefore the IPsec protocol most commonly associated with comprehensive encrypted VPN traffic protection.

Question 211

Which IPsec protocol does not provide encryption of the protected payload?

1. ESP
2. AH
3. TLS
4. SSH

Correct Answer: 2

Explanation

Authentication Header, or AH, provides integrity and authentication for IP packets but does not provide confidentiality through encryption. Its purpose is to help verify that packets have not been modified and that they originate from an authenticated source. ESP is more commonly used in VPN deployments because it can provide encryption in addition to integrity and authentication. TLS and SSH are separate security protocols used for applications such as secure web traffic and remote management. AH is therefore distinct because it protects packet authenticity and integrity without encrypting the payload.

Question 212

Which cryptographic algorithm is commonly used to provide strong encryption for modern IPsec VPNs?

1. AES
2. MD5
3. SHA-1
4. CRC32

Correct Answer: 1

Explanation

AES, or Advanced Encryption Standard, is widely used for encryption in modern IPsec VPN deployments. AES supports different key sizes and is commonly used in configurations such as AES-128 or AES-256, depending on platform capabilities and security requirements. Encryption protects the confidentiality of VPN traffic by making the transmitted data unreadable to unauthorized parties. MD5 and SHA-family algorithms are primarily associated with hashing or integrity functions rather than encryption, while CRC32 is an error-detection mechanism rather than a cryptographic protection method. AES is therefore a common choice for IPsec confidentiality.

Question 213

Which algorithm family is primarily associated with cryptographic integrity rather than data encryption?

1. AES
2. SHA
3. RSA encryption only
4. DES encryption

Correct Answer: 2

Explanation

SHA, or Secure Hash Algorithm, is a family of cryptographic hash functions commonly used as part of integrity mechanisms. In VPN security, hashing can help detect whether protected information has been altered in transit. Encryption algorithms such as AES are designed primarily to provide confidentiality, while SHA functions generate cryptographic digests used for integrity-related purposes. The exact algorithms available depend on the Cisco platform and security configuration. Understanding the difference between encryption and integrity algorithms is important when interpreting IPsec proposals and troubleshooting mismatched security parameters between VPN peers.

Question 214

Which Diffie-Hellman function is primarily used during IKE negotiation?

1. Establish a shared secret without directly transmitting the secret
2. Assign IP addresses to VPN clients
3. Filter malicious DNS domains
4. Create VLANs

Correct Answer: 1

Explanation

Diffie-Hellman is a key-agreement mechanism used during IKE negotiation to allow two peers to derive shared secret material over an untrusted network without directly transmitting the resulting secret. The peers exchange public values based on selected Diffie-Hellman parameters and independently calculate shared keying material. The resulting secrets can then be used as part of the cryptographic process for securing VPN communications. Diffie-Hellman does not assign IP addresses, perform DNS filtering, or create VLANs. It is therefore a fundamental component of secure key establishment in IPsec VPN architectures.

Question 215

Which authentication option allows an IPsec peer to prove its identity using a certificate issued by a trusted Certificate Authority?

1. Pre-shared key
2. Digital certificate authentication
3. DHCP authentication
4. MAC address authentication

Correct Answer: 2

Explanation

Digital certificate authentication allows an IPsec peer to prove its identity using a certificate issued by a trusted Certificate Authority. The receiving peer validates the certificate and its trust chain before accepting the identity. Certificate-based authentication is especially useful in larger deployments because each device can have its own certificate rather than requiring administrators to manage shared secrets between every pair of devices. Pre-shared keys use manually configured secrets, while DHCP and MAC address mechanisms are not substitutes for cryptographic VPN peer authentication. PKI therefore provides a scalable foundation for certificate-based VPN authentication.

Question 216

Which component establishes trust in a certificate by validating the chain back to a trusted root?

1. Certificate chain
2. NHRP database
3. Crypto ACL
4. DHCP binding

Correct Answer: 1

Explanation

A certificate chain establishes a path of trust from an end-entity certificate through intermediate certificate authorities to a trusted root CA. During certificate validation, the receiving device checks signatures and other certificate properties to determine whether the certificate can be trusted. This mechanism allows organizations to use hierarchical PKI structures rather than manually trusting every individual certificate. NHRP databases support DMVPN address resolution, crypto ACLs identify traffic for traditional IPsec policies, and DHCP bindings associate addresses with clients. Certificate-chain validation is therefore a key part of secure certificate-based VPN authentication.

Question 217

Which Cisco technology provides identity-based network access control and can integrate with 802.1X authentication?

1. Cisco ISE
2. Cisco Umbrella
3. Cisco Secure Client
4. Cisco FMC

Correct Answer: 1

Explanation

Cisco Identity Services Engine, or Cisco ISE, provides centralized identity-based network access control and supports technologies such as 802.1X. ISE can authenticate users and devices, apply authorization policies, support profiling, and provide contextual information for network-access decisions. It can also integrate with other Cisco security technologies for identity-based enforcement. Cisco Umbrella focuses on cloud-delivered security and DNS-layer protection, Secure Client provides endpoint capabilities, and FMC centrally manages supported firewall platforms. ISE is therefore the Cisco solution most directly associated with centralized identity-aware network access control.

Question 218

Which protocol is commonly used by Cisco ISE and network devices for centralized 802.1X authentication?

1. RADIUS
2. NHRP
3. IKE
4. SCEP

Correct Answer: 1

Explanation

RADIUS is commonly used between network access devices and Cisco ISE for centralized authentication and authorization in 802.1X deployments. The network access device acts as the authenticator, while ISE can act as the centralized authentication server. RADIUS can carry authentication-related information and authorization attributes used to determine the access granted to a user or device. NHRP is used for DMVPN address resolution, IKE handles IPsec key management, and SCEP supports certificate enrollment. RADIUS is therefore a key protocol for centralized network-access authentication involving Cisco ISE.

Question 219

Which Cisco security technology uses Security Group Tags (SGTs) to support identity-based segmentation?

1. Cisco TrustSec
2. Cisco Umbrella
3. Cisco Secure Client
4. Cisco Secure Firewall Management Center

Correct Answer: 1

Explanation

Cisco TrustSec uses Security Group Tags, or SGTs, to support identity-based segmentation and policy enforcement. Instead of relying only on traditional IP addresses, TrustSec can associate users, devices, or traffic with security-group identities. Policies can then control communication between different security groups. Cisco ISE can participate in assigning or managing identity and authorization information, while TrustSec provides the SGT-based enforcement framework. Umbrella focuses on DNS-layer security, Secure Client provides endpoint functionality, and FMC provides centralized firewall management. TrustSec is therefore directly associated with SGT-based segmentation.

Question 220

Which security principle is demonstrated when multiple independent controls such as VPN encryption, firewall filtering, and identity-based access are used together?

1. Single sign-on
2. Defense in depth
3. Split tunneling
4. Route redistribution

Correct Answer: 2

Explanation

Defense in depth is a security principle in which multiple layers of protection are deployed so that the failure or bypass of one control does not automatically expose the entire environment. For example, an organization may combine VPN encryption, firewall access-control policies, intrusion prevention, identity-based access control, endpoint security, and DNS-layer protection. Each layer addresses different threats or attack stages. Single sign-on concerns authentication convenience, split tunneling controls VPN traffic paths, and route redistribution exchanges routes between routing processes. Defense in depth therefore describes the layered security approach created by combining independent protective mechanisms.