View Full Cisco CCNP Security 300-730 Exam Dumps and Practice Test Dumps.

 

Question 361

Which component in a Cisco Secure Firewall VPN architecture is primarily responsible for defining and enforcing access-control rules for network traffic?

1. Access Control Policy
2. IKEv2 Keyring
3. NHRP
4. Certificate Revocation List

Correct Answer: 1

Explanation

An Access Control Policy is used on Cisco Secure Firewall platforms to define how traffic is evaluated and handled. Rules can use criteria such as source and destination networks, ports, applications, users, zones, and other security attributes. The firewall processes traffic against these rules to determine whether it should be allowed, blocked, or subjected to additional inspection. An IKEv2 keyring is related to VPN peer authentication, NHRP is used primarily with DMVPN, and a Certificate Revocation List provides certificate revocation information. Therefore, the Access Control Policy is the component responsible for controlling network traffic according to defined security requirements.

Question 362

A network administrator wants to use a logical interface as the endpoint for a route-based IPsec VPN. Which technology is most appropriate?

1. Crypto ACL
2. Virtual Tunnel Interface
3. Transform Set
4. Tunnel Group

Correct Answer: 2

Explanation

A Virtual Tunnel Interface (VTI) provides a logical routed interface that can serve as an endpoint for a route-based IPsec VPN. Instead of defining protected traffic through a traditional crypto ACL, routing determines which packets are sent through the VPN tunnel. This approach can simplify VPN designs, especially when dynamic routing protocols need to operate across the encrypted connection. A crypto ACL is traditionally associated with policy-based VPN configurations, while a transform set defines cryptographic parameters. A tunnel group is generally associated with remote-access VPN configuration. Therefore, VTI is the appropriate technology for a route-based IPsec VPN.

Question 363

Which IKEv2 configuration element is used to define encryption, integrity, PRF, and Diffie-Hellman parameters for the initial IKE security association?

1. IKEv2 Profile
2. IKEv2 Keyring
3. IKEv2 Proposal
4. IPsec Transform Set

Correct Answer: 3

Explanation

An IKEv2 proposal defines the cryptographic algorithms used during IKEv2 negotiation. Depending on the platform and configuration, this includes encryption, integrity, pseudorandom function, and Diffie-Hellman parameters. Both VPN peers must have compatible proposals for successful negotiation. An IKEv2 profile controls identity matching and authentication-related behavior, while an IKEv2 keyring stores peer authentication credentials such as pre-shared keys. An IPsec transform set is associated with protecting user data through IPsec rather than defining the initial IKE security association. Therefore, the IKEv2 proposal is the correct configuration element for defining the initial IKE cryptographic parameters.

Question 364

During IKEv2 troubleshooting, which exchange is responsible for authenticating the VPN peers and establishing the first Child Security Association?

1. CREATE_CHILD_SA
2. IKE_SA_INIT
3. INFORMATIONAL
4. IKE_AUTH

Correct Answer: 4

Explanation

IKE_AUTH is the IKEv2 exchange responsible for authenticating the peers after the initial IKE_SA_INIT exchange. It exchanges identity and authentication information and establishes the first Child Security Association used for IPsec-protected traffic. IKE_SA_INIT primarily negotiates cryptographic parameters and performs the initial Diffie-Hellman exchange. CREATE_CHILD_SA is used later to establish additional Child SAs or perform rekeying. INFORMATIONAL exchanges are used for notifications and other management-related messages. Therefore, when troubleshooting peer authentication and the creation of the first IPsec Child SA, the administrator should focus on the IKE_AUTH exchange.

Question 365

Which feature allows a Cisco Secure Firewall administrator to organize network addresses into reusable groups for policy configuration?

1. Network Objects and Object Groups
2. NHRP Mappings
3. IKEv2 Keyrings
4. Security Associations

Correct Answer: 1

Explanation

Network objects and object groups allow administrators to represent individual IP addresses, subnets, ranges, and collections of networks using reusable configuration objects. These objects can then be referenced in multiple firewall policies, making configurations easier to maintain and understand. For example, an administrator can create an object group representing several internal servers and reference that group in access-control rules instead of entering every address separately. NHRP mappings are related to DMVPN, IKEv2 keyrings store VPN authentication information, and security associations contain negotiated security parameters. Therefore, network objects and object groups are the appropriate mechanism for reusable network definitions.

Question 366

Which VPN troubleshooting information is most useful for determining whether IPsec packets are actually being encrypted and decrypted?

1. DNS cache entries
2. IPsec encapsulation and decapsulation counters
3. DHCP lease duration
4. Certificate subject name

Correct Answer: 2

Explanation

IPsec encapsulation and decapsulation counters provide valuable evidence about whether protected traffic is actually passing through an IPsec tunnel. Encapsulation counters increase when traffic is encrypted and sent through the VPN, while decapsulation counters increase when encrypted traffic is received and decrypted. If IKE is established but these counters remain unchanged, the administrator should investigate issues such as routing, traffic selectors, ACLs, NAT, or incorrect traffic matching. DNS cache information, DHCP lease duration, and certificate subject names do not directly indicate whether user traffic is being encrypted and decrypted. Therefore, IPsec encapsulation and decapsulation counters are important troubleshooting indicators.

Question 367

In a route-based IPsec VPN, what determines whether a packet is forwarded through the VPN tunnel?

1. Routing table
2. Certificate Authority
3. NHRP registration
4. RADIUS server

Correct Answer: 1

Explanation

In a route-based IPsec VPN, routing determines which traffic is forwarded toward the virtual tunnel interface. The routing table can contain static routes or routes learned through dynamic routing protocols. Once traffic is directed to the appropriate VTI, IPsec protection is applied according to the VPN configuration. This differs from traditional policy-based VPN designs where a crypto ACL identifies interesting traffic. A Certificate Authority is involved in certificate trust, NHRP is primarily associated with DMVPN, and RADIUS provides AAA services. Therefore, the routing table is the key mechanism determining which traffic is sent through a route-based VPN tunnel.

Question 368

Which problem can occur if NAT is applied to traffic before it is evaluated against the intended VPN policy?

1. The certificate chain becomes invalid
2. The IKE proposal is automatically changed
3. The traffic may no longer match the expected VPN selectors
4. NHRP stops responding

Correct Answer: 3

Explanation

NAT can modify source or destination IP addresses before traffic reaches the stage where VPN policies or traffic selectors are evaluated. If the VPN configuration expects the original addresses but NAT changes them, the traffic may fail to match the intended VPN policy. This can result in a tunnel that appears established while application traffic does not pass correctly. Proper NAT exemption or an appropriate NAT rule may be required depending on the platform and deployment. NAT does not automatically change an IKE proposal, invalidate certificate chains, or directly disable NHRP. Therefore, an incorrect NAT operation can cause traffic-selector or VPN-policy matching problems.

Question 369

What is the primary purpose of an IKEv2 keyring in a pre-shared-key VPN configuration?

1. Store peer authentication credentials
2. Define IPsec encryption algorithms
3. Define firewall access rules
4. Maintain NHRP shortcuts

Correct Answer: 1

Explanation

An IKEv2 keyring is used to store authentication credentials associated with VPN peers. In a pre-shared-key deployment, the keyring can contain peer identities and their corresponding shared secrets. During IKEv2 authentication, the appropriate credentials are selected based on the configured peer identity or matching criteria. An IKEv2 proposal defines cryptographic negotiation parameters, while firewall access rules determine how network traffic is permitted or denied. NHRP shortcuts are associated with DMVPN Phase 3 behavior. Therefore, when configuring pre-shared-key authentication for IKEv2 peers, the keyring provides the necessary credential information.

Question 370

Which IKEv2 exchange is commonly used to create an additional Child SA after the initial IKEv2 session has already been established?

1. IKE_SA_INIT
2. IKE_AUTH
3. CREATE_CHILD_SA
4. EAP-Request

Correct Answer: 3

Explanation

The CREATE_CHILD_SA exchange is used in IKEv2 to create additional Child Security Associations after the initial IKE security association has already been established. It can also be used when rekeying existing Child SAs. This allows a VPN connection to establish additional IPsec security relationships without repeating the complete initial IKE negotiation. IKE_SA_INIT performs the initial cryptographic negotiation and Diffie-Hellman exchange, while IKE_AUTH authenticates the peers and establishes the first Child SA. EAP messages may participate in certain authentication methods but are not the exchange responsible for creating additional Child SAs. Thus, CREATE_CHILD_SA is correct.

Question 371

Which technology is designed to provide encryption for Ethernet frames at Layer 2?

1. IPsec
2. MACsec
3. GRE
4. NHRP

Correct Answer: 2

Explanation

MACsec provides cryptographic protection for Ethernet frames at Layer 2. It can provide confidentiality, integrity, and protection against certain forms of frame manipulation on supported Ethernet links. MACsec is particularly useful for securing traffic between directly connected network devices or endpoints where Layer 2 protection is required. IPsec operates at the IP layer and is commonly used for routed VPN connectivity. GRE provides tunneling but does not inherently provide encryption, while NHRP supports address discovery in DMVPN environments. Therefore, MACsec is the technology specifically designed for Layer 2 Ethernet frame security.

Question 372

A company wants to authenticate wireless users through 802.1X while using a centralized authentication server. Which protocol is commonly used between the network access device and AAA server?

1. RADIUS
2. FTP
3. SNMP
4. NTP

Correct Answer: 1

Explanation

RADIUS is commonly used to provide centralized AAA services for network access technologies such as 802.1X. In an 802.1X deployment, the wireless access point or switch acts as the authenticator and communicates with the RADIUS server, while the endpoint acts as the supplicant. The RADIUS server processes authentication information and can return authorization attributes depending on the deployment. FTP is a file-transfer protocol, SNMP is primarily used for network management and monitoring, and NTP synchronizes system clocks. Therefore, RADIUS is the appropriate protocol for centralized AAA communication in a typical 802.1X environment.

Question 373

Which EAP method commonly uses digital certificates for strong mutual authentication between an endpoint and an authentication server?

1. PAP
2. CHAP
3. EAP-TLS
4. MS-CHAPv2

Correct Answer: 3

Explanation

EAP-TLS uses Transport Layer Security and digital certificates to provide strong authentication. In many enterprise deployments, the client presents a certificate and the authentication server also presents a certificate, allowing mutual authentication based on trusted PKI infrastructure. This approach reduces dependence on passwords and provides cryptographic identity verification. PAP and CHAP are older authentication approaches with different credential mechanisms, while MS-CHAPv2 relies on password-based authentication rather than certificate-based mutual authentication. Proper certificate enrollment, trust chains, and certificate validation are important for successful EAP-TLS deployments. Therefore, EAP-TLS is the appropriate choice when certificate-based authentication is required.

Question 374

Which Cisco technology can assign Security Group Tags to users or devices for identity-based segmentation?

1. Cisco Secure Client
2. Cisco Umbrella
3. Cisco ISE
4. NHRP

Correct Answer: 3

Explanation

Cisco Identity Services Engine (ISE) can associate identities and authorization policies with Security Group Tags (SGTs) in Cisco TrustSec environments. SGTs provide a logical security classification that can be used to enforce access policies based on the security group of a user or device rather than relying solely on IP addresses. This enables identity-based segmentation across supported network infrastructure. Cisco Secure Client is primarily an endpoint client, Cisco Umbrella provides cloud-delivered DNS-layer security, and NHRP supports address resolution in DMVPN. Therefore, Cisco ISE is a key component for assigning identity-based authorization information such as SGTs.

Question 375

Which certificate mechanism provides an online method for checking whether a certificate has been revoked?

1. SCEP
2. CRL
3. OCSP
4. PKCS#12

Correct Answer: 3

Explanation

Online Certificate Status Protocol (OCSP) provides a mechanism for checking the current revocation status of a digital certificate by querying an OCSP responder. Instead of downloading a periodically published list containing many revoked certificates, a client can request the status of a specific certificate. A Certificate Revocation List (CRL), by comparison, is a periodically published list of revoked certificates. SCEP is commonly used to automate certificate enrollment, while PKCS#12 is a format that can package certificates and private keys. Therefore, OCSP is the appropriate technology when an online certificate revocation status check is required.

Question 376

What is the main purpose of a Certificate Revocation List in a PKI environment?

1. To publish revoked certificates
2. To negotiate IKE encryption
3. To assign IP addresses to VPN clients
4. To create NHRP mappings

Correct Answer: 1

Explanation

A Certificate Revocation List (CRL) is a digitally signed list published by a Certificate Authority containing certificates that have been revoked before their normal expiration date. Applications and network devices can consult the CRL to determine whether a certificate should no longer be trusted. Revocation may occur because a private key was compromised, an identity changed, or another security condition requires invalidation. CRLs differ from OCSP, which provides an online status query for individual certificates. CRLs do not negotiate IKE parameters, assign VPN client addresses, or create NHRP mappings. Therefore, publishing revoked certificates is the primary purpose of a CRL.

Question 377

Which Cisco feature is specifically intended to identify and control applications within firewall traffic policies?

1. URL Filtering
2. Application Control
3. DHCP Snooping
4. Port Security

Correct Answer: 2

Explanation

Application Control allows a Cisco Secure Firewall policy to identify network applications and apply policy decisions based on application traffic. This provides more granular control than simply filtering by IP address and port because applications can be recognized according to their traffic characteristics. URL Filtering focuses on web destinations and categories, while DHCP Snooping protects networks from rogue DHCP behavior and builds IP-MAC bindings. Port Security controls MAC addresses allowed on switch ports. Application-based policy can be combined with other firewall criteria to enforce security requirements. Therefore, Application Control is the appropriate feature for identifying and controlling applications.

Question 378

Which Cisco Secure Firewall capability uses reputation information to block known malicious IP addresses, domains, or other security indicators?

1. Security Intelligence
2. MACsec
3. IKEv2 Keyring
4. NHRP

Correct Answer: 1

Explanation

Security Intelligence provides reputation-based controls that can help identify and block known malicious indicators such as IP addresses, domains, and URLs, depending on the platform and configuration. It can be used as an additional security layer before or alongside other firewall inspection and access-control mechanisms. MACsec provides Layer 2 encryption and integrity, an IKEv2 keyring stores VPN authentication credentials, and NHRP supports address discovery in DMVPN. Security Intelligence is therefore focused on threat reputation and blocking known malicious indicators rather than VPN negotiation or Layer 2 encryption.

Question 379

Which security feature is designed to actively detect and block malicious network traffic based on configured inspection rules?

1. DNS caching
2. IPS
3. NTP
4. SCEP

Correct Answer: 2

Explanation

An Intrusion Prevention System (IPS) analyzes network traffic for known malicious patterns, exploits, and suspicious behaviors and can actively block traffic when configured to do so. This distinguishes IPS from traditional intrusion detection systems, which primarily detect and alert without necessarily taking preventive action. IPS inspection can provide an additional security layer after traffic has been permitted by basic access-control rules. DNS caching improves name-resolution efficiency, NTP provides time synchronization, and SCEP automates certificate enrollment. Therefore, IPS is the appropriate technology when the requirement is to detect malicious traffic and actively prevent it from reaching protected resources.

Question 380

A VPN tunnel shows that IKE negotiation is established, but users cannot access the remote network. Which troubleshooting approach should be considered first?

1. Replace all digital certificates
2. Disable all firewall inspection
3. Verify Child SAs, routing, NAT, and traffic-policy matching
4. Reconfigure the DNS server

Correct Answer: 3

Explanation

An established IKE session confirms that the peers have successfully completed the relevant IKE negotiation, but it does not guarantee that application traffic can pass through the VPN. The administrator should next verify that the required Child Security Associations exist and that traffic selectors are correct. Routing should be checked to ensure traffic is directed toward the VPN, while NAT and firewall policies should be examined for unintended address translation or blocking. IPsec encapsulation and decapsulation counters can also help confirm whether traffic is entering and leaving the tunnel. Therefore, checking Child SAs, routing, NAT, and traffic-policy matching is an appropriate troubleshooting approach.