View Full Cisco CCNP Security 300-730 Exam Dumps and Practice Test Dumps.

 

Question 141

Which Cisco VPN technology uses multipoint GRE, NHRP, and IPsec to provide scalable dynamic VPN connectivity?

1. GETVPN
2. DMVPN
3. MACsec
4. Cisco Umbrella

Correct Answer: 2

Explanation

Dynamic Multipoint VPN, or DMVPN, combines multipoint GRE, NHRP, and IPsec to provide scalable encrypted connectivity between network sites. NHRP allows routers to dynamically discover the addresses of other tunnel endpoints, while mGRE enables a single tunnel interface to support multiple peers. IPsec provides the cryptographic protection for the traffic. This architecture reduces the need for manually configuring individual point-to-point tunnels between every branch. GETVPN uses a different group-encryption model, MACsec protects Layer 2 Ethernet traffic, and Cisco Umbrella provides cloud-delivered security services. DMVPN is particularly useful for large branch-office networks.

Question 142

Which DMVPN component normally acts as the central NHRP registration point for spoke routers?

1. Hub
2. Certificate Authority
3. Key Server
4. RADIUS Server

Correct Answer: 1

Explanation

In a traditional DMVPN deployment, the hub commonly operates as the NHRP server while the spoke routers act as NHRP clients. Spokes register their tunnel and NBMA address information with the hub. This allows the hub to maintain information about participating spokes and provide address-resolution services. Depending on the DMVPN phase and design, this information can be used to establish more direct spoke-to-spoke communication. A Certificate Authority manages certificates, a GETVPN Key Server distributes group keys, and a RADIUS server provides AAA services. The DMVPN hub therefore plays the central NHRP registration role.

Question 143

Which DMVPN feature allows a spoke to resolve another spoke’s NBMA address before establishing a direct tunnel?

1. NHRP Resolution
2. DHCP Snooping
3. DNS Filtering
4. TACACS+ Authorization

Correct Answer: 1

Explanation

NHRP resolution allows a DMVPN spoke to obtain the NBMA address associated with another spoke. This information is necessary when the originating spoke needs to establish a direct communication path with the remote spoke. The process works through NHRP messages and the information maintained by the NHRP infrastructure. DHCP Snooping protects against rogue DHCP servers, DNS filtering controls domain access, and TACACS+ authorization determines administrative permissions. NHRP resolution is therefore a core mechanism that enables dynamic spoke-to-spoke connectivity in supported DMVPN designs.

Question 144

Which GETVPN component distributes group encryption keys to authorized group members?

1. NHRP Server
2. Key Server
3. DHCP Server
4. RADIUS Server

Correct Answer: 2

Explanation

The GETVPN Key Server is responsible for distributing cryptographic keys and security policies to authorized Group Members. Group Members register with the Key Server and receive the information needed to encrypt and decrypt traffic belonging to the configured security group. This centralized key-management architecture allows GETVPN to support large enterprise networks without requiring individual point-to-point IPsec tunnel relationships between every pair of sites. NHRP servers are associated with DMVPN, DHCP servers provide network configuration, and RADIUS servers provide AAA functions. The Key Server is therefore central to GETVPN’s group-based encryption model.

Question 145

Which GETVPN characteristic allows existing routing information to remain available while traffic is encrypted?

1. Preservation of the original IP header
2. Removal of all IP headers
3. Use of DHCP relay
4. Use of MAC address filtering

Correct Answer: 1

Explanation

GETVPN is designed to encrypt traffic while preserving the original IP header. This differs from traditional IPsec tunnel mode, which encapsulates the original packet inside a new IP packet with a new outer IP header. Preserving the original header allows enterprise routing information to remain visible to the network and supports efficient any-to-any communication across an existing routed infrastructure. DHCP relay, MAC address filtering, and removing IP headers are unrelated to this GETVPN behavior. This characteristic makes GETVPN useful for organizations that need group-based encryption across a private or managed WAN.

Question 146

Which IKEv2 exchange is responsible for establishing the first Child SA after peer authentication?

1. INFORMATIONAL
2. CREATE_CHILD_SA
3. IKE_AUTH
4. IKE_SA_INIT

Correct Answer: 3

Explanation

The IKE_AUTH exchange authenticates the IKEv2 peers and establishes the first Child Security Association used to protect IPsec traffic. IKE_SA_INIT occurs earlier and negotiates cryptographic parameters while establishing shared keying material. CREATE_CHILD_SA can establish additional Child SAs or perform rekey operations after the initial exchange. INFORMATIONAL exchanges carry notifications, errors, and other control information. Understanding the sequence is useful when troubleshooting IKEv2 VPNs because an IKE_SA_INIT failure points toward negotiation problems, while an IKE_AUTH failure can indicate authentication, identity, or authorization issues.

Question 147

Which IKEv2 exchange can be used to rekey an existing Child Security Association?

1. CREATE_CHILD_SA
2. IKE_AUTH
3. IKE_SA_INIT
4. NHRP

Correct Answer: 1

Explanation

The CREATE_CHILD_SA exchange can be used to create additional Child Security Associations and to rekey existing Child SAs. Rekeying allows a VPN to replace cryptographic keying material before security associations reach the end of their configured lifetime. This improves security and supports continuous VPN operation without requiring the entire IKE session to be rebuilt unnecessarily. IKE_SA_INIT establishes the initial IKE SA, while IKE_AUTH authenticates peers and establishes the initial Child SA. NHRP is unrelated to IKEv2 key management and is primarily associated with DMVPN address resolution.

Question 148

Which cryptographic algorithm family is commonly used to provide confidentiality in modern IPsec VPN deployments?

1. AES
2. MD5
3. SHA-1
4. HMAC

Correct Answer: 1

Explanation

AES, or Advanced Encryption Standard, is widely used to provide confidentiality in modern IPsec VPN deployments. AES supports several key sizes and can be used with different modes depending on the platform and configuration. Encryption protects the contents of network traffic from unauthorized disclosure while it crosses an untrusted network. Hashing and authentication mechanisms such as SHA-based algorithms and HMAC serve different purposes related to integrity and authentication. MD5 is an older hashing algorithm and is not preferred for modern security designs. AES remains a fundamental encryption algorithm used by many contemporary VPN implementations.

Question 149

Which function does an IPsec integrity algorithm primarily provide?

1. Compression
2. Data modification detection
3. IP address assignment
4. DNS resolution

Correct Answer: 2

Explanation

An IPsec integrity mechanism allows the receiving endpoint to determine whether protected data has been modified during transmission. Cryptographic integrity checks can detect unauthorized changes to packet contents and help authenticate the source of the protected data, depending on the protocol and configuration. Integrity does not encrypt the packet or assign addresses. Compression reduces data size, DHCP-related mechanisms provide IP configuration, and DNS provides name resolution. Maintaining integrity is essential because confidentiality alone does not guarantee that data remains unchanged while traveling across an untrusted network.

Question 150

Which IPsec protocol is generally preferred when both confidentiality and integrity protection are required?

1. AH
2. ESP
3. ARP
4. NHRP

Correct Answer: 2

Explanation

Encapsulating Security Payload, or ESP, is generally preferred when an IPsec deployment requires confidentiality along with integrity and authentication capabilities. ESP can encrypt the protected payload and can also provide integrity and anti-replay protection according to the configured algorithms and options. AH provides authentication and integrity but does not provide encryption. ARP is used for IPv4 address resolution, while NHRP is used for dynamic next-hop resolution in technologies such as DMVPN. Modern IPsec VPN deployments commonly use ESP because it provides the combination of security services required for encrypted VPN communication.

Question 151

Which Cisco feature can inspect encrypted VPN traffic after it has been decrypted by a security appliance?

1. Security inspection policy
2. DHCP Snooping
3. NHRP
4. Port Security

Correct Answer: 1

Explanation

A security inspection policy can apply security controls to traffic after a VPN tunnel has been terminated and the traffic has been decrypted. This is important because encrypted traffic can otherwise pass through the VPN gateway without being examined by appropriate security services. Depending on the Cisco platform and configuration, decrypted traffic can be subjected to access control, intrusion prevention, malware detection, application identification, or other inspection functions. DHCP Snooping, NHRP, and Port Security operate in different parts of the network security architecture. Post-decryption inspection helps maintain security visibility even when traffic enters through an encrypted VPN.

Question 152

Which type of VPN connects a remote employee’s device directly to a corporate VPN gateway?

1. Site-to-site VPN
2. Remote-access VPN
3. GETVPN
4. DMVPN

Correct Answer: 2

Explanation

A remote-access VPN establishes a secure connection between an individual user’s endpoint and a corporate VPN gateway. The user typically runs a VPN client and authenticates before receiving access according to organizational security policies. This differs from site-to-site VPNs, which connect entire networks through VPN gateways. DMVPN is designed for scalable site connectivity, while GETVPN provides group-based encryption for enterprise networks. Remote-access VPNs are commonly used by employees working from home, traveling, or connecting from other external networks. They provide encrypted communication between the user’s device and the organization’s VPN infrastructure.

Question 153

Which Cisco technology can enforce access policies based on the identity and security group of a user or device?

1. Cisco TrustSec
2. NAT
3. NHRP
4. DHCP

Correct Answer: 1

Explanation

Cisco TrustSec provides identity-based segmentation and policy enforcement using Security Group Tags, or SGTs. Users and devices can be associated with security groups, and policy enforcement points can use that information to determine which communications should be permitted. This approach reduces dependence on traditional IP-address-based policies and can simplify segmentation in dynamic environments. NAT translates IP addresses, NHRP supports dynamic VPN address resolution, and DHCP provides network configuration. TrustSec is particularly useful when organizations want to enforce security policies based on user or device identity rather than physical location or subnet alone.

Question 154

Which protocol is commonly used to authenticate users connecting through an 802.1X-enabled wireless network?

1. TACACS+
2. RADIUS
3. NHRP
4. IKE

Correct Answer: 2

Explanation

RADIUS is commonly used as the AAA protocol between wireless infrastructure and a centralized authentication server such as Cisco ISE in 802.1X deployments. The wireless controller or access point acts as the authenticator, while the authentication server validates user or device credentials using an appropriate EAP method. RADIUS can also return authorization information that determines the user’s network access. TACACS+ is more commonly associated with administrative access to network devices. NHRP supports dynamic VPN resolution, while IKE negotiates IPsec security associations. RADIUS is therefore a standard choice for centralized enterprise wireless authentication.

Question 155

Which security control can prevent unauthorized devices from connecting through a switch access port based on MAC addresses?

1. URL Filtering
2. Port Security
3. IKE
4. OCSP

Correct Answer: 2

Explanation

Port Security allows a switch administrator to control which MAC addresses can use a specific access interface. The feature can limit the number of MAC addresses permitted and can use statically configured or dynamically learned secure addresses. If a violation occurs, the switch can apply a configured action such as restricting or shutting down the interface, depending on the selected violation mode. URL Filtering controls web destinations, IKE handles VPN negotiation, and OCSP checks certificate status. Port Security therefore provides a direct Layer 2 mechanism for limiting unauthorized devices on switch access ports.

Question 156

Which certificate-related service provides real-time online status information about whether a certificate has been revoked?

1. CRL
2. OCSP
3. SCEP
4. PKI

Correct Answer: 2

Explanation

Online Certificate Status Protocol, or OCSP, allows a system to query a certificate authority or responder for the current status of a specific digital certificate. This can provide more current information than waiting for a periodically published Certificate Revocation List. A CRL is a published list of revoked certificates, while SCEP is commonly used for certificate enrollment and PKI is the broader framework for certificate management. OCSP can therefore help VPN devices and other security systems determine whether a certificate remains valid for authentication purposes without relying solely on the certificate’s expiration date.

Question 157

Which certificate enrollment protocol can automate certificate requests between network devices and a certificate authority?

1. SCEP
2. SSH
3. RADIUS
4. NHRP

Correct Answer: 1

Explanation

Simple Certificate Enrollment Protocol, or SCEP, can automate the process of requesting and obtaining digital certificates from a certificate authority. This is especially useful when many routers, firewalls, VPN gateways, or other network devices require certificates for authentication. Automated enrollment reduces manual certificate-management tasks and helps organizations deploy PKI at scale. SSH provides secure remote management, RADIUS provides AAA services, and NHRP supports dynamic VPN address resolution. SCEP is therefore associated specifically with certificate enrollment and provisioning rather than VPN traffic forwarding or network access authentication.

Question 158

Which Cisco firewall policy feature can identify traffic according to the application being used?

1. Application Control
2. DHCP Snooping
3. Port Security
4. NHRP

Correct Answer: 1

Explanation

Application Control enables Cisco security platforms to identify applications and apply security policies based on application identity. This provides greater visibility than relying only on IP addresses and transport-layer ports. Administrators can use application-based rules to allow, block, or inspect specific types of application traffic according to organizational requirements. DHCP Snooping protects against rogue DHCP services, Port Security controls Layer 2 access, and NHRP provides dynamic next-hop resolution for DMVPN. Application Control is particularly useful when modern applications use dynamic ports or common protocols and traditional port-based filtering alone cannot accurately identify the application.

Question 159

Which Cisco security feature uses reputation information to block known malicious IP addresses and domains?

1. Security Intelligence
2. Port Security
3. DHCP Snooping
4. NHRP

Correct Answer: 1

Explanation

Security Intelligence uses threat intelligence and reputation information to identify known malicious indicators such as IP addresses and domains. Security policies can use this information to block or otherwise control traffic associated with known threats. This provides an additional layer of protection before or alongside more detailed traffic inspection. Port Security protects switch interfaces from unauthorized MAC addresses, DHCP Snooping protects DHCP operations, and NHRP supports dynamic VPN address resolution. Reputation-based blocking can help reduce exposure to known malicious infrastructure and complement other firewall, intrusion prevention, and application security controls.

Question 160

Which AAA function determines whether an authenticated administrator is permitted to execute a specific command?

1. Authentication
2. Accounting
3. Authorization
4. Encryption

Correct Answer: 3

Explanation

Authorization determines what an authenticated administrator is allowed to do on a network device. With appropriate AAA configuration, authorization can restrict users to specific privilege levels or even individual commands. TACACS+ is commonly used for granular command authorization in network administration environments. Authentication verifies the administrator’s identity, while accounting records administrative activity such as commands or sessions. Encryption protects data from unauthorized disclosure. Separating these AAA functions allows organizations to verify identity, enforce least-privilege administrative access, and maintain records of actions performed on network infrastructure.