[Renovate] 300-209 simos books

The 300-209 online tests are downloadable with regard to free. You simply need to click the actual mouse and all of the Cisco Cisco certification practice materials and training tests will likely be presented for you. You can save lots of time and money with no buying and learning the related 300-209 books. The particular Examcollection gives anyone an excellent and current Cisco Cisco 300-209 study manual in the two audio and video type. You can download the actual Cisco Cisco test engine from Examcollection to be able to prepare for your 300-209 exam. All the Cisco 300-209 certification exam questions and answers will promise you this kind of high level that makes you profitable. There are free Cisco 300-209 demos and sample questions inside Pdf format obtainable on the Examcollection site. There are many 300-209 applications which will enable you to to completely prepare for your Cisco Cisco certification exam.

2016 Oct 300-209 vce:

Q111. CORRECT TEXT 

Scenario 

You are the network security administrator for your organization. Your company is growing and a remote branch office is being created. You are tasked with configuring your headquarters Cisco ASA to create a site-to-site IPsec VPN connection to the branch office Cisco ISR. The branch office ISR has already been deployed and configured and you need to complete the IPsec connectivity configurations on the HQ ASA to bring the new office online. 

Use the following parameters to complete your configuration using ASDM. For this exercise, not all ASDM screens are active. 

. Enable IKEv1 on outside I/F for Site-to-site VPN 

. Add a Connection Profile with the following parameters: 

. Peer IP: 203.0.113.1 

. Connection name: 203.0.113.1 

. Local protected network: 10.10.9.0/24 

. Remote protected network: 10.11.11.0/24 

. Group Policy Name: use the default policy name supplied 

. Preshared key: cisco 

. Disable IKEv2 

. Encryption Algorithms: use the ASA defaults 

. Disable pre-configured NAT for testing of the IPsec tunnel 

. Disable the outside NAT pool rule 

. Establish the IPsec tunnel by sending ICMP pings from the Employee PC to the Branch Server at IP address 10.11.11.20 

. Verify tunnel establishment in ASDM VPN Statistics> Sessions window pane 

You have completed this exercise when you have successfully configured, established, and verified site-to-site IPsec connectivity between the ASA and the Branch ISR. 

Topology 

Answer: Review the explanation for detailed answer steps. 

Explanation: 

First, click on Configuration ->Site-to-Site VPN to bring up this screen: 

Click on “allow IKE v1 Access” for the outside per the instructions as shown below: 

Then click apply at the bottom of the page. This will bring up the following pop up message: 

Click on Send. 

Next, we need to set up the connection profile. From the connection profile tab, click on “Add” 

Then, fill in the information per the instructions as shown below: 

Hit OK and you should see this: 

To test this, we need to disable NAT. Go to Configuration -> Firewall -> NAT rules and you should see this: 

Click on Rule 1 to get the details and you will see this: 

We need to uncheck the “Enable rule” button on the bottom. It might also be a good idea to uncheck the “Translate DNS replies that match the rule” but it should not be needed. Then, go back to the topology: 

Click on Employee PC, and you will see a desktop with a command prompt shortcut. Use this to ping the IP address of 10.11.11.20 and you should see replies: 

We can also verify by viewing the VPN Statistics -> Sessions and see the bytes in/out incrementing as shown below: 


Q112. Which three types of SSO functionality are available on the Cisco ASA without any external SSO servers? (Choose three.) 

A. SAML 

B. HTTP POST 

C. HTTP Basic 

D. NTLM 

E. Kerberos 

F. OAuth 2.0 

Answer: B,C,D 


Q113. Which two qualify as Next Generation Encryption integrity algorithms? (Choose two.) 

A. SHA-512 

B. SHA-256 

C. SHA-192 

D. SHA-380 

E. SHA-192 

F. SHA-196 

Answer: A,B 


Q114. What does NHRP stand for? 

A. Next Hop Resolution Protocol 

B. Next Hop Registration Protocol C. Next Hub Routing Protocol 

D. Next Hop Routing Protocol 

Answer:


Q115. Which statement describes a prerequisite for single-sign-on Netegrity Cookie Support in an IOC SSL VPN? 

A. The Cisco AnyConnect Secure Mobility Client must be installed in flash. 

B. A SiteMinder plug-in must be installed on the Cisco SSL VPN gateway. 

C. A Cisco plug-in must be installed on a SiteMinder server. 

D. The Cisco Secure Desktop software package must be installed in flash. 

Answer:


Latest cisco ccnp security 300-209 simos:

Q116. Which VPN solution is best for a collection of branch offices connected by MPLS that frequenty make VoIP calls between branches? 

A. GETVPN 

B. Cisco AnyConnect 

C. site-to-site 

D. DMVPN 

Answer:


Q117. Refer to the exhibit. 

A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which action can bring up the VPN tunnel? 

A. Increase the maximum SA limit on the local Cisco ASA. 

B. Correct the crypto access list on both Cisco ASA devices. 

C. Remove the maximum SA limit on the remote Cisco ASA. 

D. Reduce the maximum SA limit on the local Cisco ASA. 

E. Correct the IP address in the local and remote crypto maps. 

F. Increase the maximum SA limit on the remote Cisco ASA. 

Answer:


Q118. Which two IKEv1 policy options must match on each peer when you configure an IPsec site-to-site VPN? (Choose two.) 

A. priority number 

B. hash algorithm 

C. encryption algorithm 

D. session lifetime 

E. PRF algorithm 

Answer: B,C 


Q119. Which technology does a multipoint GRE interface require to resolve endpoints? 

A. ESP 

B. dynamic routing 

C. NHRP 

D. CEF 

E. IPSec 

Answer:


Q120. Scenario: 

You are the senior network security administrator for your organization. Recently and junior engineer configured a site-to-site IPsec VPN connection between your headquarters Cisco ASA and a remote branch office. 

You are now tasked with verifying the IKEvl IPsec installation to ensure it was properly configured according to designated parameters. Using the CLI on both the Cisco ASA and branch ISR, verify the IPsec configuration is properly configured between the two sites. 

NOTE: the show running-config command cannot be used for this exercise. 

Topology: 

Which transform set is being used on the branch ISR? 

A. Default 

B. ESP-3DES ESP-SHA-HMAC 

C. ESP-AES-256-MD5-TRANS mode transport 

D. TSET 

Answer:

Explanation: 

This can be seen from the “show crypto ipsec sa” command as shown below: 



see more 300-209 dumps