Question No : 1
On a FlexVPN hub-and-spoke topology where spoke-to-spoke tunnels are not allowed, which command is needed for the hub to be able to terminate FlexVPN tunnels?

• A.interface virtual-access
• B.ip nhrp redirect
• C.interface tunnel
• D.interface virtual-template

Show Answers

Answer:

Question No : 2
Which feature allows the ASA to handle nonstandard applications and web resources so that they display correctly over a clientless SSL VPN connection?

• A.single sign-on
• B.Smart Tunnel
• C.WebType ACL
• D.plug-ins

Show Answers

Answer:
Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/vpn_clientless_ssl.html#29951

Question No : 3
A Cisco AnyConnect client establishes a SSL VPN connection with an ASA at the corporate office. An engineer must ensure that the client computer meets the enterprise security policy.
Which feature can update the client to meet an enterprise security policy?

• A.Endpoint Assessment
• B.Cisco Secure Desktop
• C.Basic Host Scan
• D.Advanced Endpoint Assessment

Show Answers

Answer:

Question No : 4
In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form.
Which troubleshooting step solves the issue?

• A.Verify the spoke configuration to check if the NHRP redirect is enabled.
• B.Verify that the spoke receives redirect messages and sends resolution requests.
• C.Verify the hub configuration to check if the NHRP shortcut is enabled.
• D.Verify that the tunnel interface is contained within a VR

Show Answers

Answer:
Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-summ-maps.pdf

Question No : 5
1.Topic 1, Site-to-site Virtual Private Networks on Routers and Firewall

Which two parameters help to map a VPN session to a tunnel group without using the tunnel-group list? (Choose two.)

• A.group-alias
• B.certificate map
• C.optimal gateway selection
• D.group-url
• E.AnyConnect client version

Show Answers

Answer:

Question No : 6
Topic 3, Troubleshooting using ASDM and CLI

Refer to the exhibit.



Based on the debug output, which type of mismatch is preventing the VPN from coming up?

• A.interesting traffic
• B.lifetime
• C.preshared key
• D.PFS

Show Answers

Answer:
Explanation:
If the responder's policy does not allow it to accept any part of the proposed Traffic Selectors, it responds with a TS_UNACCEPTABLE Notify message