View Full Cisco CCNP Security 300-730 Exam Dumps and Practice Test Dumps.

 

Question 121

Which technology allows Cisco IPsec VPN peers to authenticate using certificates issued by a trusted certificate authority?

1. NAT
2. PKI
3. DHCP Snooping
4. Port Security

Correct Answer: 2

Explanation

Public Key Infrastructure, or PKI, enables Cisco VPN devices to use digital certificates for peer authentication. A certificate authority issues certificates that bind an identity to a public key. During VPN establishment, the devices can validate each other’s certificates through the configured trust hierarchy. Certificate-based authentication is particularly useful in large VPN environments because administrators do not need to manually configure a unique pre-shared key for every peer relationship. NAT, DHCP Snooping, and Port Security perform different networking or security functions and do not provide certificate-based VPN authentication. PKI therefore provides the trust framework required for scalable certificate authentication.

Question 122

Which IKEv2 component defines the cryptographic algorithms and Diffie-Hellman groups used during the initial negotiation?

1. IKEv2 proposal
2. Tunnel group
3. Access control list
4. DHCP pool

Correct Answer: 1

Explanation

An IKEv2 proposal defines the cryptographic parameters that can be used during IKEv2 negotiation. These parameters can include encryption algorithms, integrity algorithms, and Diffie-Hellman groups, depending on the Cisco platform and configuration model. The proposal is used by the IKEv2 policy or associated configuration to determine acceptable cryptographic combinations. A tunnel group is associated with VPN connection policies, an access control list identifies or controls traffic, and a DHCP pool provides addresses. Correctly matching supported cryptographic parameters between VPN peers is essential for successful IKEv2 negotiation and secure tunnel establishment.

Question 123

Which IKEv2 exchange is used to establish the initial IKE security association?

1. CREATE_CHILD_SA
2. IKE_AUTH
3. IKE_SA_INIT
4. INFORMATIONAL

Correct Answer: 3

Explanation

The IKE_SA_INIT exchange establishes the initial IKE security association between two IKEv2 peers. It negotiates cryptographic algorithms, performs the Diffie-Hellman exchange, and exchanges nonces required to establish shared keying material. The IKE_AUTH exchange follows and is used for authentication and establishment of the first Child SA. CREATE_CHILD_SA can establish additional Child SAs or perform rekeying, while INFORMATIONAL messages are used for notifications, errors, and other control information. Understanding these exchanges is important when troubleshooting IKEv2 negotiations because failures at different stages can indicate different configuration or authentication problems.

Question 124

Which IKEv2 exchange is primarily responsible for authenticating the VPN peers?

1. IKE_AUTH
2. IKE_SA_INIT
3. DELETE
4. NHRP

Correct Answer: 1

Explanation

The IKE_AUTH exchange is responsible for authenticating the IKEv2 peers after the initial IKE_SA_INIT exchange has established shared keying material and negotiated cryptographic parameters. During IKE_AUTH, the peers authenticate using configured methods such as pre-shared keys or digital certificates. The exchange also establishes the first Child SA used for protecting IPsec traffic. IKE_SA_INIT handles the initial cryptographic negotiation and Diffie-Hellman exchange. DELETE is used for terminating security associations, while NHRP is associated with dynamic VPN address resolution. IKE_AUTH is therefore a critical stage in establishing a fully authenticated IKEv2 VPN.

Question 125

Which Cisco technology can dynamically establish encrypted tunnels between branch routers without requiring a separate permanent tunnel configuration between every pair of branches?

1. MACsec
2. DMVPN
3. Port Security
4. Cisco Umbrella

Correct Answer: 2

Explanation

DMVPN provides a scalable architecture for dynamically establishing encrypted tunnels between branch routers. Instead of manually configuring individual point-to-point tunnels between every branch, DMVPN uses multipoint GRE, NHRP, and IPsec to support dynamic connectivity. The hub can provide discovery services while spokes can establish direct tunnels when required, depending on the DMVPN phase. This architecture reduces configuration complexity in networks with many branch locations. MACsec protects Ethernet frames, Port Security controls switch access, and Cisco Umbrella provides cloud-delivered security services. DMVPN is specifically designed for scalable dynamic VPN connectivity.

Question 126

Which protocol is used by DMVPN to map private tunnel addresses to NBMA addresses?

1. RADIUS
2. IKE
3. NHRP
4. TACACS+

Correct Answer: 3

Explanation

NHRP, or Next Hop Resolution Protocol, is a fundamental component of DMVPN. It allows routers to dynamically resolve the NBMA address associated with another tunnel endpoint. This mapping enables a DMVPN spoke to discover how to reach another spoke and can support direct spoke-to-spoke tunnel establishment. The hub commonly acts as the NHRP server while spokes register their information. RADIUS and TACACS+ provide AAA functions, while IKE negotiates IPsec security associations. NHRP is therefore responsible for the dynamic next-hop resolution that allows DMVPN to scale without manually defining every remote tunnel endpoint.

Question 127

Which DMVPN phase uses NHRP redirect and shortcut mechanisms to optimize spoke-to-spoke communication?

1. Phase 3
2. Phase 1
3. Phase 0
4. Phase 2

Correct Answer: 1

Explanation

DMVPN Phase 3 introduces NHRP redirect and shortcut mechanisms that improve spoke-to-spoke traffic forwarding. Initially, traffic can be routed through the hub. The hub can then send an NHRP redirect to the originating spoke, informing it that a more direct path may be available. The spoke can use NHRP information to create or use a direct path to the destination spoke. Phase 1 primarily relies on hub-and-spoke communication, while Phase 2 supports direct spoke-to-spoke tunnels using NHRP resolution. Phase 3 provides additional routing and forwarding optimization for scalable DMVPN networks.

Question 128

Which Cisco VPN solution is specifically designed for group encryption across an enterprise IP network while preserving the original IP packet structure?

1. Remote-access SSL VPN
2. GETVPN
3. Port Security
4. MACsec

Correct Answer: 2

Explanation

GETVPN is designed for group-based encryption across enterprise networks. Unlike traditional point-to-point IPsec tunnels, GETVPN can preserve the original IP header while encrypting traffic between group members. This characteristic allows existing routing information to remain visible to the network and makes GETVPN suitable for environments where large numbers of sites require any-to-any encrypted communication. A centralized Key Server manages group security policies and distributes cryptographic information to group members. Remote-access SSL VPN supports individual users, Port Security controls switch interfaces, and MACsec protects Layer 2 Ethernet frames rather than providing the same group VPN architecture.

Question 129

What is the primary role of a GETVPN Group Member?

1. Issue digital certificates
2. Provide DNS resolution
3. Encrypt and decrypt protected group traffic
4. Assign DHCP addresses

Correct Answer: 3

Explanation

A GETVPN Group Member is a network device that participates in the encrypted group and protects traffic according to the policies and keys distributed by the Key Server. It can encrypt outbound traffic and decrypt inbound traffic for other authorized group members. The Group Member does not normally serve as the centralized authority for distributing group keys; that function belongs to the Key Server. Certificate authorities issue certificates, DNS servers resolve domain names, and DHCP servers provide network configuration. Understanding the distinction between the Key Server and Group Members is important when designing and troubleshooting GETVPN deployments.

Question 130

Which Cisco VPN technology is commonly used to provide secure remote access for individual employees?

1. GETVPN
2. DMVPN
3. Remote-access VPN
4. MACsec

Correct Answer: 3

Explanation

A remote-access VPN allows individual users to securely connect to organizational resources from remote locations. The user’s endpoint typically runs a VPN client such as Cisco Secure Client, which establishes an encrypted session with a supported VPN gateway. Authentication and authorization policies can determine which internal resources the user may access. GETVPN is primarily designed for group-based enterprise network encryption, while DMVPN is commonly used for scalable site-to-site connectivity. MACsec protects Ethernet frames at Layer 2. Remote-access VPN is therefore the appropriate architecture when individual users need secure connectivity from external networks.

Question 131

Which Cisco Secure Client feature provides endpoint-based remote-access VPN connectivity?

1. VPN module
2. DHCP Snooping
3. NHRP
4. MACsec

Correct Answer: 1

Explanation

The VPN functionality within Cisco Secure Client allows endpoints to establish secure remote-access connections to supported Cisco VPN gateways. The client can provide authentication, encrypted communication, and enforcement of administrator-defined VPN policies. Organizations can also deploy additional Secure Client modules depending on their security requirements. DHCP Snooping is a switch-based security mechanism, NHRP is used in dynamic VPN architectures, and MACsec provides Layer 2 frame protection. The VPN module is therefore the endpoint component responsible for creating the user’s secure remote-access connection.

Question 132

Which feature can prevent VPN traffic from being translated by NAT when the traffic is intended for an internal remote network?

1. NAT exemption
2. DHCP Snooping
3. Port Security
4. URL Filtering

Correct Answer: 1

Explanation

NAT exemption allows specified traffic to bypass network address translation. In many Cisco VPN deployments, traffic between internal networks and remote VPN networks must retain its original source and destination addresses so that security policies and routing operate correctly. NAT exemption can be configured to identify this VPN traffic and exclude it from translation. DHCP Snooping protects against rogue DHCP servers, Port Security controls MAC addresses on switch ports, and URL Filtering controls web destinations. Correct NAT handling is important for site-to-site and remote-access VPN deployments because unintended translation can cause tunnel traffic to fail or behave unexpectedly.

Question 133

Which IPsec mode is generally used when only the IP payload needs protection while the original IP header remains visible?

1. Tunnel mode
2. Transport mode
3. Group mode
4. Proxy mode

Correct Answer: 2

Explanation

IPsec transport mode protects the IP payload while leaving the original IP header available for routing. This mode is commonly associated with host-to-host IPsec communication where both endpoints participate directly in IPsec. Tunnel mode instead encapsulates the entire original IP packet and adds a new outer IP header, making it common for gateway-to-gateway VPNs. Group mode and proxy mode are not standard IPsec operating modes. Understanding the difference between transport and tunnel mode is important when troubleshooting packet captures, routing behavior, and security policies in IPsec deployments.

Question 134

Which cryptographic mechanism is commonly used by IKE to establish shared secret keying material without directly transmitting the secret key?

1. Diffie-Hellman
2. RADIUS
3. TACACS+
4. DNSSEC

Correct Answer: 1

Explanation

Diffie-Hellman is a key-agreement mechanism used by IKE to establish shared secret keying material between peers over an untrusted network. The peers exchange public values and use their private values to independently calculate shared secret material. The actual secret is not directly transmitted across the network. IKE then uses the resulting keying material together with negotiated algorithms and authentication methods to establish secure security associations. RADIUS and TACACS+ are AAA protocols, while DNSSEC protects DNS data. Diffie-Hellman is therefore a fundamental cryptographic mechanism used during IPsec/IKE negotiation.

Question 135

Which IKEv2 feature allows additional Child SAs to be created after the initial IKE SA has been established?

1. IKE_SA_INIT
2. CREATE_CHILD_SA
3. IKE_AUTH
4. NHRP

Correct Answer: 2

Explanation

The CREATE_CHILD_SA exchange in IKEv2 can establish additional Child Security Associations after the initial IKE SA exists. It can also be used for rekeying existing Child SAs and, depending on the exchange, for performing certain key-management operations. IKE_SA_INIT establishes the initial IKE security association and negotiates fundamental cryptographic parameters. IKE_AUTH authenticates the peers and establishes the first Child SA. NHRP is unrelated to IKEv2 exchanges and is instead used in DMVPN. CREATE_CHILD_SA therefore provides an important mechanism for managing additional IPsec security associations during the lifetime of an IKEv2 session.

Question 136

Which authentication method uses a shared secret configured on both VPN peers?

1. Digital certificate
2. Pre-shared key
3. OCSP
4. SCEP

Correct Answer: 2

Explanation

A pre-shared key, or PSK, is a secret value configured on both VPN peers and used to authenticate the IKE relationship. The peers must have matching values for authentication to succeed. PSKs are relatively simple to deploy in smaller environments but can become difficult to manage as the number of VPN peers grows. Digital certificates provide a more scalable alternative through PKI. OCSP is used for checking certificate status, while SCEP can automate certificate enrollment. Pre-shared keys remain widely supported and can be appropriate when the VPN environment is small or when certificate infrastructure is not available.

Question 137

Which mechanism can be used to validate whether a digital certificate has been revoked using a periodically published list?

1. CRL
2. NHRP
3. DHCP
4. NAT

Correct Answer: 1

Explanation

A Certificate Revocation List, or CRL, is a periodically published list containing certificates that have been revoked before their normal expiration date. VPN devices and other PKI-enabled systems can retrieve the CRL and check whether a certificate is listed as revoked. Revocation may occur when a private key is compromised, a device is decommissioned, or another security event invalidates the certificate. OCSP provides another certificate-status mechanism through online queries. NHRP handles VPN address resolution, DHCP provides IP configuration, and NAT translates addresses. CRLs are therefore an important component of certificate-based authentication and trust management.

Question 138

Which Cisco technology provides centralized authentication, authorization, and accounting for network administrators?

1. Cisco ISE
2. TACACS+
3. Cisco Umbrella
4. NHRP

Correct Answer: 2

Explanation

TACACS+ is commonly used to provide centralized AAA services for network administrators. It can authenticate administrative users, determine their authorization levels, and record administrative activity. A major capability is granular command authorization, which allows organizations to control which commands individual administrators can execute on network devices. Cisco ISE can also participate in broader identity and access-control architectures, but TACACS+ is specifically a protocol commonly used for device administration AAA. Cisco Umbrella provides cloud security services, while NHRP supports dynamic VPN address resolution. TACACS+ therefore fits centralized administrative access control.

Question 139

Which VPN security feature ensures that packets received from a VPN peer have not been modified in transit?

1. Confidentiality
2. Integrity
3. Compression
4. Address translation

Correct Answer: 2

Explanation

Integrity protection allows a VPN endpoint to verify that protected traffic has not been modified while traveling across the network. IPsec can provide integrity through cryptographic authentication mechanisms associated with ESP or AH. The receiving device calculates or verifies the integrity value and can reject packets that fail validation. Confidentiality protects information from being read by unauthorized parties, while compression reduces data size and address translation changes network addressing. Integrity is particularly important because encryption alone does not necessarily prove that a packet was not altered. Secure VPN designs commonly combine confidentiality, integrity, authentication, and anti-replay protection.

Question 140

Which component of an IPsec security association contains negotiated information such as encryption algorithms and keys?

1. IPsec Security Association
2. DHCP Snooping binding
3. MAC address table
4. DNS record

Correct Answer: 1

Explanation

An IPsec Security Association, or SA, contains the parameters required to protect traffic between VPN peers. Depending on the implementation, these parameters include cryptographic algorithms, keys, security protocol information, lifetimes, and other security attributes. IKE negotiates and establishes the information used to create the security associations. DHCP Snooping bindings contain client addressing information, MAC address tables support Layer 2 forwarding, and DNS records map names to network information. Understanding the contents and lifecycle of IPsec SAs is important for VPN troubleshooting because mismatched or expired security associations can prevent protected traffic from being established correctly.