View Full Cisco CCNP Security 300-730 Exam Dumps and Practice Test Dumps.

Question 321

Which IPsec mode is generally used when the original IP header must remain visible for routing between hosts?

1. Tunnel mode
2. Transport mode
3. GRE mode
4. Proxy mode

Correct Answer: 2

Explanation

IPsec transport mode protects the payload of the original IP packet while retaining the original IP header. This makes it suitable for scenarios where the original endpoints remain directly relevant to routing and communication. Transport mode is commonly associated with host-to-host IPsec protection. In contrast, tunnel mode encapsulates the entire original IP packet and adds a new outer IP header, making it common for gateway-to-gateway VPNs. GRE and proxy mode are not IPsec operating modes. Understanding the difference between transport and tunnel mode is important when determining how IP headers are handled during VPN encapsulation.

Question 322

Which IPsec mode is commonly used for site-to-site VPNs between security gateways?

1. Transport mode
2. Tunnel mode
3. Application mode
4. Session mode

Correct Answer: 2

Explanation

IPsec tunnel mode is commonly used for site-to-site VPNs because it encapsulates and protects the entire original IP packet. A new outer IP header identifies the VPN gateways, while the original source and destination addresses remain inside the protected packet. This allows private networks behind the gateways to communicate securely across an untrusted network such as the Internet. Transport mode protects primarily the payload while retaining the original IP header and is more commonly associated with host-to-host scenarios. Application, session, and similar terms do not represent standard IPsec operating modes.

Question 323

Which protocol is responsible for negotiating the security associations used by IPsec?

1. IKE
2. ESP
3. GRE
4. NHRP

Correct Answer: 1

Explanation

Internet Key Exchange, or IKE, negotiates the security associations and cryptographic parameters required for IPsec communication. IKE handles functions such as peer authentication, algorithm negotiation, and key establishment. Once the required security relationships are established, IPsec protocols such as ESP can protect user traffic. GRE provides tunneling without cryptographic security, while NHRP supports dynamic address resolution in DMVPN. IKE therefore operates primarily in the VPN control plane, establishing the information needed for secure IPsec data-plane communication. A failure during IKE negotiation can prevent the IPsec VPN from becoming operational.

Question 324

Which authentication method requires both VPN peers to have matching configured secret material?

1. Digital certificate authentication
2. Pre-shared key authentication
3. EAP-TLS
4. OCSP

Correct Answer: 2

Explanation

Pre-shared key authentication requires both VPN peers to possess matching secret material. During IKE authentication, each peer proves knowledge of the configured secret without transmitting the secret itself across the network. Pre-shared keys are relatively straightforward to configure, especially for smaller VPN deployments, but managing unique keys across many peers can become more difficult as the environment grows. Digital certificates provide a PKI-based alternative that can scale more effectively. EAP-TLS is commonly used for certificate-based network access authentication, while OCSP provides certificate-status information rather than peer authentication.

Question 325

Which authentication method uses a trusted PKI hierarchy to validate the identity of a VPN peer?

1. Pre-shared key
2. Digital certificate
3. Static route
4. DHCP binding

Correct Answer: 2

Explanation

Digital certificate authentication uses PKI to establish and validate the identity of a VPN peer. The receiving device checks the presented certificate, validates its signature and certificate chain, and confirms that the certificate is trusted and appropriate for the authentication process. This approach can scale well because certificates can be issued and managed through a centralized PKI rather than maintaining individual shared secrets for every relationship. Pre-shared keys use manually configured secret material, while static routes and DHCP bindings are unrelated to peer authentication. Certificate-based authentication is therefore a common choice for larger VPN environments.

Question 326

What happens when two IKE peers have incompatible cryptographic proposals?

1. The peers may fail to establish the IKE security association
2. The peers automatically disable encryption
3. The router switches to RADIUS
4. NHRP changes the proposal

Correct Answer: 1

Explanation

IKE peers must agree on compatible cryptographic parameters before an IKE security association can be established. If their proposals do not have at least one mutually supported combination of algorithms and related parameters, the negotiation can fail. Administrators should compare the encryption, integrity, authentication, and Diffie-Hellman settings on both peers when troubleshooting such problems. IKE does not automatically disable encryption to compensate for incompatible proposals, and RADIUS or NHRP does not resolve IKE proposal mismatches. Verifying compatible cryptographic proposals is therefore an important first step when IKE negotiation fails.

Question 327

Which parameter is part of an IKEv2 proposal?

1. Encryption algorithm
2. User accounting record
3. DHCP lease duration
4. Switch port MAC address

Correct Answer: 1

Explanation

An IKEv2 proposal defines cryptographic parameters used during IKE security association negotiation. These parameters can include an encryption algorithm, integrity algorithm, and Diffie-Hellman group. The proposal therefore determines the cryptographic capabilities that the peers can use when establishing the IKE SA. Accounting records belong to AAA systems, DHCP lease duration belongs to DHCP services, and switch port MAC addresses are related to Layer 2 access control. Correctly configuring compatible IKEv2 proposals is important because peers must find a mutually supported cryptographic combination before the IKE negotiation can proceed.

Question 328

Which IKEv2 configuration element can match a remote peer based on identity information?

1. IKEv2 Profile
2. Transform Set
3. DHCP Snooping
4. Crypto ACL

Correct Answer: 1

Explanation

An IKEv2 profile can define peer identity matching and authentication-related behavior. This allows the device to determine which authentication and policy settings should apply to a particular peer based on information such as identity or address, depending on the configuration. A transform set defines traditional IPsec data-plane protection, DHCP Snooping provides switch security, and a crypto ACL identifies interesting traffic in policy-based IPsec. The IKEv2 profile therefore plays an important role in connecting peer identity information with the appropriate IKEv2 authentication and policy configuration.

Question 329

Which IKEv2 component is commonly used to associate a peer with a pre-shared key?

1. IKEv2 Keyring
2. URL Filter
3. Security Intelligence
4. NHRP Redirect

Correct Answer: 1

Explanation

An IKEv2 keyring can store pre-shared keys and associate them with peer information. The IKEv2 profile can then reference the appropriate authentication information during IKE negotiation. This provides a structured method for managing peer-specific authentication credentials, particularly when multiple VPN peers use different keys. URL Filtering controls web access, Security Intelligence provides reputation-based security controls, and NHRP Redirect is associated with DMVPN Phase 3. The keyring therefore provides the credential-storage function needed for pre-shared-key-based IKEv2 authentication.

Question 330

Which exchange occurs before IKE_AUTH during a normal IKEv2 negotiation?

1. CREATE_CHILD_SA
2. IKE_SA_INIT
3. NHRP Resolution
4. RADIUS Accounting

Correct Answer: 2

Explanation

IKE_SA_INIT occurs before IKE_AUTH in the normal IKEv2 exchange sequence. During IKE_SA_INIT, the peers negotiate cryptographic parameters and perform the initial Diffie-Hellman exchange. After this exchange, IKE_AUTH authenticates the peers and establishes the first Child SA. CREATE_CHILD_SA is used later for additional Child SAs or rekeying. NHRP Resolution belongs to DMVPN, while RADIUS Accounting is part of AAA. Knowing the sequence is useful during troubleshooting because the stage where negotiation stops can help identify whether the problem involves cryptographic negotiation, peer authentication, or Child SA establishment.

Question 331

Which IKEv2 exchange can be used to rekey an existing Child SA?

1. IKE_AUTH
2. IKE_SA_INIT
3. CREATE_CHILD_SA
4. NHRP Registration

Correct Answer: 3

Explanation

CREATE_CHILD_SA is used in IKEv2 to create additional Child SAs and to rekey existing Child SAs. Rekeying allows cryptographic keys and security associations to be refreshed without requiring the entire VPN relationship to be rebuilt from the beginning. IKE_SA_INIT is associated with the initial IKE SA negotiation, while IKE_AUTH performs peer authentication and establishes the initial Child SA. NHRP Registration belongs to DMVPN. Understanding CREATE_CHILD_SA is important when troubleshooting long-running VPN connections where the initial tunnel establishes correctly but later rekey operations fail.

Question 332

Which security association protects actual user traffic after IKE negotiation has completed?

1. IKE SA
2. Child SA
3. RADIUS SA
4. NHRP SA

Correct Answer: 2

Explanation

In IKEv2, Child SAs are used to protect IPsec data traffic. They contain the security parameters and keying information required for the IPsec protection of user packets. The IKE SA protects and manages the IKE control-plane relationship between the peers, while Child SAs provide the data-plane security relationships. RADIUS and NHRP do not represent the IPsec data-plane security association in this context. If an IKE SA is established but the expected Child SA is not present, administrators should investigate the IPsec policy, traffic selectors, authentication, and other configuration parameters affecting Child SA establishment.

Question 333

Which IPsec feature provides protection against modification of packets while they are in transit?

1. Integrity
2. Compression
3. NAT
4. Routing

Correct Answer: 1

Explanation

Integrity protection allows a receiving device to determine whether protected data has been modified during transmission. Cryptographic integrity mechanisms calculate authentication information based on the protected packet and associated parameters. The receiver verifies this information before accepting the packet. If verification fails, the packet can be discarded because it may have been altered. Compression reduces data size, NAT changes IP addresses, and routing determines packet paths. Integrity is therefore a fundamental IPsec security service and works alongside confidentiality and anti-replay mechanisms to protect VPN traffic from different types of threats.

Question 334

Which IPsec security service prevents unauthorized parties from reading protected VPN payloads?

1. Authentication
2. Confidentiality
3. Accounting
4. Authorization

Correct Answer: 2

Explanation

Confidentiality protects the contents of VPN traffic from unauthorized disclosure. In IPsec, confidentiality is typically provided through encryption algorithms such as AES. The encrypted payload cannot be interpreted by an observer who does not possess the appropriate cryptographic key. Authentication verifies the identity of peers, authorization determines permissions, and accounting records activity. These functions are important but do not directly prevent someone from reading intercepted data. Confidentiality is therefore the IPsec security service specifically responsible for keeping protected traffic unreadable to unauthorized observers.

Question 335

Which IPsec security service helps detect duplicate or replayed packets?

1. Anti-replay protection
2. URL Filtering
3. Authorization
4. Application Control

Correct Answer: 1

Explanation

Anti-replay protection helps IPsec detect packets that are duplicated or retransmitted from an earlier valid communication session. IPsec uses packet sequence numbers and a replay window to determine whether packets are acceptable. This prevents an attacker from simply capturing a valid encrypted packet and repeatedly sending it to the destination. URL Filtering and Application Control address web and application policy, while Authorization determines what an authenticated identity is allowed to access. Anti-replay protection therefore addresses a specific threat that is not solved by confidentiality or integrity alone.

Question 336

Which protocol is commonly used to provide centralized AAA for network access devices?

1. RADIUS
2. NHRP
3. GRE
4. ESP

Correct Answer: 1

Explanation

RADIUS is widely used to provide centralized AAA services for network access devices such as switches and wireless access points. It can support authentication and authorization for technologies such as 802.1X and can also provide accounting information. RADIUS allows organizations to centralize access-control decisions instead of maintaining independent credentials on every network device. NHRP supports DMVPN, GRE provides tunneling, and ESP provides IPsec protection. RADIUS is therefore particularly important in enterprise environments where centralized user or device authentication is required for network access.

Question 337

Which AAA protocol is commonly used when network administrators require detailed command authorization?

1. RADIUS
2. TACACS+
3. DHCP
4. SCEP

Correct Answer: 2

Explanation

TACACS+ is commonly used for network administrator AAA because it supports detailed authorization of administrative actions, including command-level control. This allows an organization to authenticate administrators centrally and determine which commands each administrator is permitted to execute. Accounting can also record administrative activity for auditing. RADIUS is widely used for network access and 802.1X, DHCP provides IP configuration services, and SCEP handles certificate enrollment. TACACS+ is therefore particularly suitable when organizations need granular control and auditing of administrative access to network infrastructure.

Question 338

Which Cisco security solution can integrate user identity, device information, and access policies for centralized network authorization?

1. Cisco ISE
2. Cisco Umbrella
3. Cisco Secure Client
4. Cisco NHRP

Correct Answer: 1

Explanation

Cisco Identity Services Engine, or ISE, can combine user identity, device information, authentication results, and policy context to make centralized network-access authorization decisions. It supports technologies such as 802.1X, device profiling, guest access, and Cisco TrustSec integration. This allows organizations to create policies based on more than just an IP address. Umbrella provides DNS-layer and cloud security services, Secure Client provides endpoint connectivity and security functionality, and NHRP is a VPN address-resolution mechanism. ISE is therefore the Cisco solution most directly associated with centralized identity-aware network authorization.

Question 339

Which technology allows network security policies to be based on Security Group Tags rather than only IP addresses?

1. Cisco TrustSec
2. DHCP Snooping
3. MACsec
4. SCEP

Correct Answer: 1

Explanation

Cisco TrustSec uses Security Group Tags to provide identity-based segmentation and policy enforcement. Instead of relying solely on IP addresses, devices or users can be associated with security groups, and traffic can be controlled according to the source and destination group identities. This can simplify policy management in environments where IP addresses change frequently or do not accurately represent business roles. DHCP Snooping protects against rogue DHCP services, MACsec provides Layer 2 cryptographic protection, and SCEP handles certificate enrollment. TrustSec therefore provides the identity-centric segmentation framework associated with Security Group Tags.

Question 340

Which security architecture combines multiple controls such as identity, firewalling, VPN encryption, segmentation, and monitoring?

1. Single-layer security
2. Defense in depth
3. Open access architecture
4. Flat network design

Correct Answer: 2

Explanation

Defense in depth uses multiple independent or complementary security controls to protect an environment. For example, identity-based access control can restrict who connects to the network, segmentation can limit lateral movement, firewalls can enforce traffic policies, VPN encryption can protect traffic across untrusted networks, and monitoring can detect suspicious behavior. The purpose is to avoid relying on one security mechanism as the sole protective layer. If one control is bypassed or misconfigured, other controls can still provide protection or detection. Defense in depth is therefore a fundamental security architecture principle for layered network protection.