View Full Cisco CCNP Security 300-730 Exam Dumps and Practice Test Dumps.

 

Question 261

Which IKEv2 component defines the cryptographic algorithms and Diffie-Hellman group used during IKE SA negotiation?

1. IKEv2 Keyring
2. IKEv2 Profile
3. IKEv2 Proposal
4. IPsec Transform Set

Correct Answer: 3

Explanation

An IKEv2 proposal defines the cryptographic algorithms used during IKE security association negotiation. It can specify encryption, integrity, and Diffie-Hellman parameters that peers use to establish the IKE SA. The IKEv2 profile provides peer-identification and authentication-related parameters, while the keyring stores authentication credentials such as pre-shared keys. An IPsec transform set is associated with IPsec data-plane protection rather than the initial IKE negotiation. Understanding the separation between IKEv2 proposals and profiles is important when troubleshooting VPN configurations because a mismatch in the proposal can prevent peers from successfully establishing the IKE SA.

Question 262

Which IKEv2 configuration element is primarily used to define peer authentication and identity-matching behavior?

1. IKEv2 Profile
2. IKEv2 Proposal
3. Crypto Map
4. Transform Set

Correct Answer: 1

Explanation

An IKEv2 profile defines parameters associated with peer identity, authentication, and policy matching. It can specify how a peer is identified and which authentication method should be used, such as a pre-shared key or digital certificates. The IKEv2 proposal instead defines cryptographic parameters for IKE negotiation. A crypto map traditionally associates IPsec policy with traffic and a peer, while a transform set defines IPsec protection algorithms in traditional policy-based configurations. Therefore, when configuring or troubleshooting IKEv2 identity and authentication behavior, the IKEv2 profile is a key configuration component.

Question 263

What is the primary purpose of an IKEv2 keyring in a pre-shared-key deployment?

1. Define IPsec traffic selectors
2. Store peer authentication credentials
3. Define encryption algorithms
4. Specify routing information

Correct Answer: 2

Explanation

An IKEv2 keyring stores authentication credentials associated with IKEv2 peers, including pre-shared keys. The keyring can associate credentials with particular peer identities or addresses, allowing the IKEv2 profile to reference the appropriate authentication information. It does not define IPsec traffic selectors, routing information, or the cryptographic algorithms used during IKE negotiation. Those functions are handled by other configuration components. Separating credentials into a keyring helps organize authentication information and can make configurations easier to manage when multiple VPN peers or authentication relationships exist.

Question 264

Which IKEv2 exchange is responsible for negotiating cryptographic parameters and performing the initial Diffie-Hellman exchange?

1. IKE_AUTH
2. CREATE_CHILD_SA
3. INFORMATIONAL
4. IKE_SA_INIT

Correct Answer: 4

Explanation

IKE_SA_INIT is the first major IKEv2 exchange between peers. It negotiates the IKE security parameters and performs the Diffie-Hellman exchange needed to establish shared keying material. The exchange also includes nonces that contribute to key generation. IKE_AUTH follows IKE_SA_INIT and is responsible for authenticating the peers and establishing the initial Child SA. CREATE_CHILD_SA is used for creating additional Child SAs or rekeying existing ones. INFORMATIONAL exchanges are used for various notifications and control functions. Therefore, IKE_SA_INIT is the correct exchange for the initial cryptographic negotiation.

Question 265

Which IKEv2 exchange authenticates the peers after the initial IKE SA negotiation?

1. IKE_AUTH
2. IKE_SA_INIT
3. CREATE_CHILD_SA
4. NHRP Resolution

Correct Answer: 1

Explanation

IKE_AUTH is the IKEv2 exchange used to authenticate the peers after the initial IKE_SA_INIT exchange. During IKE_AUTH, the peers prove their identities using mechanisms such as pre-shared keys or digital certificates. The exchange also establishes the first Child SA used to protect IPsec traffic. IKE_SA_INIT handles initial algorithm negotiation and Diffie-Hellman key exchange, while CREATE_CHILD_SA is used later for additional Child SAs or rekeying. NHRP Resolution belongs to DMVPN rather than IKEv2. Correctly understanding this sequence is useful when diagnosing VPN sessions that reach IKE_SA_INIT but fail during authentication.

Question 266

Which IKEv2 exchange is used to create additional Child SAs or rekey existing Child SAs?

1. IKE_AUTH
2. CREATE_CHILD_SA
3. IKE_SA_INIT
4. NHRP Redirect

Correct Answer: 2

Explanation

CREATE_CHILD_SA is used in IKEv2 to establish additional Child SAs and to rekey existing Child SAs. Child SAs provide the IPsec security associations that protect user data. After the initial IKE SA and first Child SA are established, additional Child SAs can be negotiated without repeating the complete initial IKE negotiation. IKE_SA_INIT establishes the initial IKE SA, while IKE_AUTH authenticates peers and establishes the first Child SA. NHRP Redirect is a DMVPN mechanism. CREATE_CHILD_SA is therefore important for ongoing VPN operation and IPsec key management.

Question 267

Which VPN design uses a virtual tunnel interface so that VPN traffic can be forwarded using normal routing decisions?

1. Policy-based IPsec
2. Route-based IPsec
3. Port Security
4. GETVPN

Correct Answer: 2

Explanation

Route-based IPsec uses a virtual tunnel interface, commonly called a VTI, to represent the VPN connection as a logical routed interface. Traffic can be forwarded through this interface based on the routing table rather than being selected exclusively by a traditional crypto ACL. This approach can simplify routing and support dynamic routing protocols across the VPN in appropriate designs. Policy-based IPsec traditionally uses crypto maps and ACLs to identify interesting traffic. Port Security is a Layer 2 access-control feature, while GETVPN is designed for group encryption. Route-based IPsec is therefore the appropriate model when a routed tunnel interface is desired.

Question 268

What is a major operational benefit of using a VTI for a route-based VPN?

1. It eliminates the need for routing
2. It allows VPN traffic to be treated as routed interface traffic
3. It replaces IKE with RADIUS
4. It automatically creates certificates

Correct Answer: 2

Explanation

A VTI provides a logical interface through which VPN traffic can be routed. This means the routing table can determine which traffic should use the VPN interface, similar to other routed interfaces. This can simplify configurations compared with policy-based designs that require traffic-selection ACLs for each protected flow. A VTI does not eliminate routing, replace IKE with RADIUS, or automatically create certificates. IKE is still used for establishing the required security relationships in supported deployments. VTIs are especially useful when organizations want to integrate VPN connectivity with conventional routing architectures and dynamic routing protocols.

Question 269

Which traditional IPsec configuration element identifies the traffic that should be protected by a crypto map?

1. Security Group Tag
2. Access control list
3. Certificate chain
4. DHCP binding

Correct Answer: 2

Explanation

In traditional policy-based Cisco IPsec configurations, an access control list is commonly used by a crypto map to identify interesting traffic that should receive IPsec protection. The ACL defines the source and destination traffic selectors associated with the VPN. When matching traffic is detected, the crypto map can apply the configured IPsec policy and forward the traffic through the appropriate tunnel. Security Group Tags provide identity-based segmentation, certificate chains establish certificate trust, and DHCP bindings support switch security features. Therefore, the ACL is a key component in identifying traffic for traditional crypto-map-based IPsec VPNs.

Question 270

Which configuration element traditionally associates an IPsec policy with a remote VPN peer and interface?

1. Crypto map
2. IKEv2 keyring
3. NHRP map
4. RADIUS server

Correct Answer: 1

Explanation

A crypto map traditionally associates IPsec policy information with a remote peer and identifies the traffic that should be protected. The crypto map can include peer information, security parameters, and a reference to the ACL identifying interesting traffic. It is then applied to the appropriate interface in policy-based IPsec deployments. An IKEv2 keyring stores authentication credentials, NHRP mappings are associated with DMVPN operation, and RADIUS supports AAA. Although modern route-based VPN designs can use VTIs instead of traditional crypto maps, crypto maps remain important for understanding policy-based Cisco IPsec configurations.

Question 271

Which command is commonly used to display the status of IKEv2 security associations on a Cisco IOS-based device?

1. show ip route
2. show crypto ikev2 sa
3. show access-lists
4. show interfaces status

Correct Answer: 2

Explanation

The show crypto ikev2 sa command is commonly used to inspect IKEv2 security associations. It can provide information about the state of IKE negotiations, peer relationships, and established IKE SAs. This is particularly useful when troubleshooting VPN establishment issues. If the IKE SA is not established, administrators can investigate authentication, proposal, identity, reachability, or other configuration issues. The routing table, ACL output, and interface status commands provide valuable information for other troubleshooting areas but do not directly display IKEv2 security association state. Therefore, show crypto ikev2 sa is the appropriate command for this purpose.

Question 272

Which command can help verify IPsec encapsulation and decapsulation activity on a Cisco IOS-based VPN device?

1. show crypto ipsec sa
2. show users
3. show ip protocols
4. show aaa servers

Correct Answer: 1

Explanation

The show crypto ipsec sa command provides information about IPsec security associations and traffic counters. Encapsulated and decapsulated packet counters can help determine whether traffic is actually being protected and received through the VPN. This is useful when IKE appears established but application traffic is not working. If encapsulation counters increase while decapsulation remains unchanged, administrators may investigate return-path routing, remote-side configuration, ACLs, NAT, or other connectivity issues. The other commands provide information about different system functions. Therefore, show crypto ipsec sa is an important troubleshooting command for IPsec data-plane verification.

Question 273

An IKEv2 SA is established, but no user traffic passes through the VPN. Which area should be checked next?

1. Only the certificate expiration date
2. IPsec Child SAs, routing, NAT, and traffic policies
3. Only the switch MAC address table
4. Only the DNS cache

Correct Answer: 2

Explanation

When the IKEv2 SA is established but application traffic does not pass, the control-plane negotiation has succeeded, but the data plane may still have a problem. Administrators should check whether the IPsec Child SAs are established and whether encapsulation and decapsulation counters increase. Routing should be verified on both sides, along with NAT behavior and firewall or security policies. Incorrect traffic selectors can also prevent the expected packets from entering the tunnel. Checking only certificates, MAC tables, or DNS would not adequately investigate the most common causes. A systematic data-plane troubleshooting approach is therefore appropriate.

Question 274

What can happen if VPN traffic is translated by NAT when the IPsec policy expects the original addresses?

1. The traffic may no longer match the intended VPN policy
2. IKE automatically changes the routing table
3. RADIUS disables authentication
4. NHRP creates a certificate

Correct Answer: 1

Explanation

NAT can change packet source or destination addresses before traffic reaches the point where an IPsec policy evaluates it. If the VPN configuration expects the original addresses, the translated packet may no longer match the intended protected-traffic selectors. This can prevent traffic from entering the VPN tunnel as expected. NAT exemption or another appropriate NAT policy can be used in designs where VPN traffic should bypass translation. IKE does not automatically fix routing because of NAT, RADIUS is an AAA protocol, and NHRP is unrelated to certificate creation. Therefore, NAT interaction is an important VPN troubleshooting consideration.

Question 275

Which technique is commonly used to prevent selected VPN traffic from being translated by NAT?

1. Security Group Tagging
2. NAT exemption
3. Port Security
4. URL Filtering

Correct Answer: 2

Explanation

NAT exemption can be configured so that selected traffic, such as traffic between internal networks connected through a VPN, is not translated. This is important when the IPsec policy expects the original source and destination addresses. If traffic is translated unexpectedly, the resulting addresses may not match the VPN selectors or the remote network’s expected addressing. Security Group Tags provide identity-based classification, Port Security controls switch MAC addresses, and URL Filtering controls web destinations. NAT exemption therefore addresses the interaction between address translation and VPN traffic processing in appropriate network designs.

Question 276

Which DMVPN component allows spokes to dynamically discover the NBMA address of another spoke?

1. NHRP
2. RADIUS
3. SCEP
4. TACACS+

Correct Answer: 1

Explanation

NHRP, or Next Hop Resolution Protocol, is a fundamental component of DMVPN. It allows DMVPN routers to dynamically discover the NBMA address associated with another tunnel endpoint. This information can support dynamic spoke-to-spoke communication without requiring every spoke to have static mappings for every other spoke. The DMVPN hub commonly acts as the central NHRP server and maintains registrations from spokes. RADIUS and TACACS+ provide AAA services, while SCEP supports certificate enrollment. NHRP is therefore essential for dynamically resolving the physical or NBMA addresses used by DMVPN tunnel peers.

Question 277

Which DMVPN phase introduced NHRP Redirect and Shortcut functionality to improve dynamic spoke-to-spoke communication?

1. Phase 1
2. Phase 2
3. Phase 3
4. Phase 0

Correct Answer: 3

Explanation

DMVPN Phase 3 introduced mechanisms involving NHRP Redirect and NHRP Shortcut to improve dynamic spoke-to-spoke forwarding. The hub can send an NHRP Redirect to inform a spoke that a more direct path to the destination exists. The spoke can then use NHRP information to establish or use a more direct path instead of continuing to send the traffic through the hub. Phase 1 primarily uses hub-and-spoke communication, while Phase 2 supports direct spoke-to-spoke tunnels using NHRP resolution. Phase 3 adds the redirect and shortcut behavior that improves scalability and routing flexibility.

Question 278

What is the primary purpose of an NHRP Redirect message in DMVPN Phase 3?

1. To distribute digital certificates
2. To inform a spoke that a more direct path may be available
3. To authenticate an IKE peer
4. To encrypt GETVPN traffic

Correct Answer: 2

Explanation

An NHRP Redirect message is used in DMVPN Phase 3 to inform a spoke that traffic may be taking a suboptimal path through the hub and that a more direct path may be available. The spoke can then perform the necessary NHRP resolution to learn information about the direct destination and establish an appropriate shortcut. This mechanism helps reduce unnecessary hub transit and can improve traffic efficiency in large DMVPN deployments. Certificate enrollment, IKE authentication, and GETVPN encryption are unrelated functions. NHRP Redirect is therefore an important component of Phase 3 DMVPN optimization.

Question 279

Which three technologies form the fundamental architecture of DMVPN?

1. RADIUS, TACACS+, and SCEP
2. mGRE, NHRP, and IPsec
3. MACsec, DHCP Snooping, and DAI
4. ISE, Umbrella, and FMC

Correct Answer: 2

Explanation

DMVPN combines multipoint GRE, NHRP, and IPsec to provide scalable dynamic VPN connectivity. mGRE allows a tunnel interface to support multiple destinations, reducing the need for separate point-to-point tunnel interfaces. NHRP dynamically resolves tunnel endpoint information and supports dynamic spoke relationships. IPsec provides encryption and security for the tunneled traffic. These technologies work together to create the DMVPN architecture. RADIUS and TACACS+ are AAA technologies, while MACsec, DHCP Snooping, DAI, ISE, Umbrella, and FMC serve different security functions. Understanding the three DMVPN building blocks is essential when troubleshooting or designing DMVPN networks.

Question 280

Which GETVPN component centrally distributes group encryption keys and security policies to group members?

1. Group Member
2. NHRP Server
3. Key Server
4. RADIUS Server

Correct Answer: 3

Explanation

In GETVPN, the Key Server is responsible for centrally distributing cryptographic keys and relevant security policies to authorized group members. Group Members use the information provided by the Key Server to encrypt and decrypt traffic belonging to the protected group. GETVPN is designed for group-based encryption and can preserve the original IP addressing information, which can be useful for network designs where routing visibility must remain intact. NHRP is associated with DMVPN, while RADIUS provides AAA services. The Key Server therefore plays the central role in GETVPN key and policy distribution.