Cisco 300-730 Exam Dumps

Cisco 300-730 Sample Question Answers

Question # 1

An engineer must investigate a connectivity issue and decides to use the packet capture feature onCisco FTD. The goal is to see the real packet going through the Cisco FTD device and see Snortdetection actions as a part of the output. After the capture-traffic command is issued, only thepackets are displayed. Which action resolves this issue?

A. Specify the trace using the -T option after the capture-traffic command 
B. Perform the trace within the Cisco FMC GUI instead of the Cisco FMC CLI
C. Use the verbose option as a part of the capture-traffic command 
D. Use the capture command and specify the trace option to get the required information 

Show Answer

Question # 2

A network administrator wants to block traffic to a known malware site at https:/www.badsite.comand all subdomains while ensuring no packets from any internal client are sent to that site. Whichtype of policy must the network administrator use to accomplish this goal?

A. Access Control policy with URL filtering 
B. Prefilter policy 
C. DNS policy 
D. SSL policy 

Show Answer

Question # 3

A network administrator is deploying a Cisco IPS appliance and needs it to operate initially withoutaffecting traffic flows. It must also collect data to provide a baseline of unwanted traffic before beingreconfigured to drop it. Which Cisco IPS mode meets these requirements?

A. failsafe 
B. inline tap 
C. promiscuous 
D. bypass 

Show Answer

Question # 4

An engineer is creating an URL object on Cisco FMC. How must it be configured so that the object willmatch for HTTPS traffic in an access control policy?

A. Specify the protocol to match (HTTP or HTTPS). 
B. Use the FQDN including the subdomain for the website. 
C. Use the subject common name from the website certificate. 
D. Define the path to the individual webpage that uses HTTPS.

Show Answer

Question # 5

A network engineer must expand a company's Cisco AnyConnect solution. Currently, a Cisco ASA isset up in North America and another will be installed in Europe with a different IP address. Usersshould connect to the ASA that has the lowest Round Trip Time from their network location asmeasured by the AnyConnect client. Which solution must be implemented to meet thisrequirement?

A. VPN Load Balancing 
B. IP SLA 
C. DNS Load Balancing 
D. Optimal Gateway Selection 

Show Answer

Question # 6

Which clientless SSLVPN supported feature works when the http-only-cookie command is enabled? 

A. Citrix load balancer 
B. port reflector 
C. Java rewriter - 
D. script browser 

Show Answer

Question # 7

An administrator is deciding which authentication protocol should be implemented for theirupcoming Cisco AnyConnect deployment. A list of the security requirements from uppermanagement are: the ability to force AnyConnect users to use complex passwords such asC1$c0451035084!, warn users a few days before their password expires, and allow users to changetheir password during a remote access session. Which authentication protocol must be used to meetthese requirements?

A. LDAPS 
B. RADIUS 
C. Kerberos 
D. TACACS+ 

Show Answer

Question # 8

A network administrator wants the Cisco ASA to automatically start downloading the CiscoAnyConnect client without prompting the user to select between WebVPN or AnyConnect. Whichcommand accomplishes this task?

A. anyconnect ssl df-bit-ignore enable 
B. anyconnect ask none default anyconnect
C. anyconnect ask enable default anyconnect 
D. anyconnect modules value default 

Show Answer

Question # 9

Which two protocols does DMVPN leverage to build dynamic VPNs to multiple destinations? (Choose two.)

A. IKEv2 
B. NHRP 
C. mGRE 
D. mBGP 
E. GDOI 

Show Answer

Question # 10

An engineer is implementing the FlexVPN solution on a Cisco IOS router. The router must onlyterminate VPN requests and must not initiate them. Additionally, the interface must support VPNsfrom other routers and Cisco AnyConnect connections. Which interface type must be configured tomeet these requirements?

A. point-to-point GRE tunnel interface 
B. multipoint GRE tunnel interface 
C. static virtual tunnel interface 
D. virtual template interface 

Show Answer

Question # 11

Which command must be configured on the tunnel interface of a FlexVPN spoke to receive a dynamicIP address from the hub?

A. ip address negotiated 
B. ip unnumbered 
C. ip address dhcp 
D. ip address pool 

Show Answer

Question # 12

An administrator is setting up Cisco AnyConnect on a Cisco ASA with the requirement thatAnyConnect automatically establishes a VPN when a company-owned laptop is connected to theinternet outside of the corporate network. Which configuration meets these requirements?

A. SBL with user certificate authentication 
B. TND with machine certificate authentication 
C. SBL with machine certificate authentication
D. TND with user certificate authentication 

Show Answer

Question # 13

An engineer is requesting an SSL certificate for a VPN load-balancing cluster in which two Cisco ASAsprovide clientless SSLVPN access. The FQDN that users will enter to access the clientless VPN isasa.example.com, and users will be redirected to either asa1.example.com or asa2.example.com.The cluster FQDN and individual Cisco ASAs FQDNs resolve to IP addresses 192.168.0.1, 192.168.0.2,and 192.168.0.3 respectively. The issued certificate must be able to be used to validate the identityof either ASA in the cluster without returning any certificate validation errors. Which fields must beincluded in the certificate to meet these requirements?

A. CN=*.example.com, SAN=asa.example.com 
B. CN=192.168.0.1, SAN=asa1.example.com, asa2.example.com 
C. CN=asa.example.com, SAN=asa.example.com, asa1.example.com, asa2.example.com 
D. CN=192.168.0.1, SAN=192.168.0.1, 192.168.0.2, 192.168.0.3 

Show Answer

Question # 14

A network engineer must configure the Cisco ASA so that Cisco AnyConnect clients establishing anSSL VPN connection create an additional tunnel for real-time traffic that is sensitive to packet delays.If this additional tunnel experiences any issues, it must fall back to a TLS connection. Which two CiscoAnyConnect features must be configured to accomplish this task? (Choose two.)

A. DTLS 
B. DSCP Preservation 
C. DPD
D. SSL Rekey 
E. OMTU 

Show Answer

Question # 15

A network administrator is troubleshooting a FlexVPN tunnel. The hub router is unable to ping thespoke router's tunnel interface IP address of 192.168.1.2, even though the tunnel is showing up. Theoutput of the debug ip packet CLI command on the hub router shows the following entry.IP: tableid=0123456789 s=192.168.1.1 (local), d=192.168.1.2 (loopback2), routed via FIB.What must be configured to fix this issue?

A. A matching IKEv2 pre-shared key on the hub and spoke routers in the crypto keyring configuration. 
B. An outbound ACL on the dynamic VTI of the hub router that allows ICMP traffic to 192.168.1.2. 
C. An IKEv2 authorization policy must be configured on the spoke router to advertise the interface route.
D. A route map must be configured on hub router to set the next hop for 192.168.1.2 to the dynamic VTI.

Show Answer

Question # 16

Over which two transport mediums is FlexVPN deployed? (Choose two.) 

A. 5G 
B. VPLS 
C. internet 
D. MPLS 
E. DWDM 

Show Answer

Question # 17

Users are getting untrusted server warnings when they connect to the URL https://asa.lab from theirbrowsers. This URL resolves to 192.168.10.10, which is the IP address for a Cisco ASA configured for aclientless VPN. The VPN was recently set up and issued a certificate from an internal CA server. Userscan connect to the VPN by ignoring the message, however, when users access other webservers thatuse certificates issued by the same internal CA server, they do not experience this issue. Whichaction resolves this issue?

A. Import the CA that signed the certificate into the machine trusted root CA store. 
B. Reissue the certificate with asa.lab in the subject alternative name field. 
C. Import the CA that signed the certificate into the user trusted root CA store. 
D. Reissue the certificate with 192.168.10.10 in the subject common name field. 

Show Answer

Question # 18

A DMVPN spoke is configured with IKEv1 to secure the tunnel. Despite having a configuration similarto other working spokes, the tunnel is not coming up. Packet captures on the spoke show packetsleaving the spoke router, but not making it to the hub router. Which solution resolves this issue?

A. Configure the spoke and hub to use the same IKE version. 
B. Ensure that devices between the hub and spoke are not blocking ESP traffic. 
C. Ensure that devices between the hub and spoke are not blocking GRE traffic. 
D. Enable the tunnel interface with the no shutdown command. 

Show Answer