[PDF&VCE] 2016 100% Valid 300-209 Dumps Guarantee 100% Pass 300-209 Certification Exam (21-40)

2016 October Cisco Official New Released 300-209 Dumps in Lead2pass.com!

100% Free Download! 100% Pass Guaranteed!

Pass 300-209 exam with the latest Lead2pass 300-209 dumps: Lead2pass 300-209 exam questions and answers in PDF are prepared by our experts. Moreover, they are based on the recommended syllabus that covering all the 300-209 exam objectives.

Following questions and answers are all new published by Cisco Official Exam Center: http://www.lead2pass.com/300-209.html

QUESTION 21
Which statement is true when implementing a router with a dynamic public IP address in a crypto map based site-to-site VPN?

A.    The router must be configured with a dynamic crypto map.
B.    Certificates are always used for phase 1 authentication.
C.    The tunnel establishment will fail if the router is configured as a responder only.
D.    The router and the peer router must have NAT traversal enabled.

Answer: C

QUESTION 22
Which two statements are true when designing a SSL VPN solution using Cisco AnyConnect? (Choose two.)

A.    The VPN server must have a self-signed certificate.
B.    A SSL group pre-shared key must be configured on the server.
C.    Server side certificate is optional if using AAA for client authentication.
D.    The VPN IP address pool can overlap with the rest of the LAN networks.
E.    DTLS can be enabled for better performance.

Answer: DE

QUESTION 23
Refer to the exhibit. Given the partial configuration shown, which two statements are correct? (Choose two.) 
 

A.    The tunnel will use the routing protocol configured for GigabitEthemet 1/1 for all tunnel
communication with the peer.
B.    The IP route statement to reach the remote network behind the DMVPN peer is incorrect, it
should be ip route 192.168.2.0 255.255.255.0 tunnel 0.
C.    This is an example of a static point-to-point VTI tunnel.
D.    The tunnel will use esp-sha-hmac encryption in ESP tunnel mode.
E.    The tunnel will use 128-bit AES encryption in ESP tunnel mode.

Answer: CE

QUESTION 24
What are two benefits of DMVPN Phase 3? (Choose two.)

A.    Administrators can use summarization of routing protocol updates from hub to spokes.
B.    It introduces hierarchical DMVPN deployments.
C.    It introduces non-hierarchical DMVPN deployments.
D.    It supports L2TP over IPSec as one of the VPN protocols.

Answer: AB

QUESTION 25
Which are two main use cases for Clientless SSL VPN? (Choose two.)

A.    In kiosks that are part of a shared environment
B.    When the users do not have admin rights to install a new VPN client
C.    When full tunneling is needed to support applications that use TCP, UDP, and ICMP
D.    To create VPN site-to-site tunnels in combination with remote access

Answer: AB

QUESTION 26
Which technology can rate-limit the number of tunnels on a DMVPN hub when system utilization is above a specified percentage?

A.    NHRP Event Publisher
B.    interface state control
C.    CAC
D.    NHRP Authentication
E.    ip nhrp connect

Answer: C

QUESTION 27
Which technology supports tunnel interfaces while remaining compatible with legacy VPN implementations?

A.    FlexVPN
B.    DMVPN
C.    GET VPN
D.    SSL VPN

Answer: A

QUESTION 28
Which IKEv2 feature minimizes the configuration of a FlexVPN on Cisco IOS devices?

A.    IKEv2 Suite-B
B.    IKEv2 proposals
C.    IKEv2 profiles
D.    IKEv2 Smart Defaults

Answer: D

QUESTION 29
When an IPsec SVTI is configured, which technology processes traffic forwarding for encryption?

A.    ACL
B.    IP routing
C.    RRI
D.    front door VPN routing and forwarding

Answer: B

QUESTION 30
Which Cisco IOS VPN feature simplifies IPsec VPN configuration and design by using on-demand virtual access interfaces that are cloned from a virtual template configuration?

A.    GET VPN
B.    dynamic VTI
C.    static VTI
D.    GRE tunnels
E.    GRE over IPsec tunnels
F.    DMVPN

Answer: B

QUESTION 31
A Cisco IOS SSL VPN gateway is configured to operate in clientless mode so that users can access file shares on a Microsoft Windows 2003 server. Which protocol is used between the Cisco IOS router and the Windows server?

A.    HTTPS
B.    NetBIOS
C.    CIFS
D.    HTTP

Answer: C

QUESTION 32
You are configuring a Cisco IOS SSL VPN gateway to operate with DVTI support. Which command must you configure on the virtual template?

A.    tunnel protection ipsec
B.    ip virtual-reassembly
C.    tunnel mode ipsec
D.    ip unnumbered

Answer: D

QUESTION 33
Which protocol supports high availability in a Cisco IOS SSL VPN environment?

A.    HSRP
B.    VRRP
C.    GLBP
D.    IRDP

Answer: A

QUESTION 34
When you configure IPsec VPN High Availability Enhancements, which technology does Cisco recommend that you enable to make reconvergence faster?

A.    EOT
B.    IP SLAs
C.    periodic IKE keepalives
D.    VPN fast detection

Answer: C

QUESTION 35
Which hash algorithm is required to protect classified information?

A.    MD5
B.    SHA-1
C.    SHA-256
D.    SHA-384

Answer: D

QUESTION 36
Which cryptographic algorithms are approved to protect Top Secret information?

A.    HIPPA DES
B.    AES-128
C.    RC4-128
D.    AES-256

Answer: D

QUESTION 37
Which Cisco firewall platform supports Cisco NGE?

A.    FWSM
B.    Cisco ASA 5505
C.    Cisco ASA 5580
D.    Cisco ASA 5525-X

Answer: D

QUESTION 38
Which algorithm is replaced by elliptic curve cryptography in Cisco NGE?

A.    3DES
B.    AES
C.    DES
D.    RSA

Answer: D

QUESTION 39
Which encryption and authentication algorithms does Cisco recommend when deploying a Cisco NGE supported VPN solution?

A.    AES-GCM and SHA-2
B.    3DES and DH
C.    AES-CBC and SHA-1
D.    3DES and SHA-1

Answer: A

QUESTION 40
An administrator wishes to limit the networks reachable over the Anyconnect VPN tunnels. Which configuration on the ASA will correctly limit the networks reachable to 209.165.201.0/27 and 209.165.202.128/27?

A.    access-list splitlist standard permit 209.165.201.0 255.255.255.224
access-list splitlist standard permit 209.165.202.128 255.255.255.224 !
group-policy GroupPolicy1 internal
group-policy GroupPolicy1 attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list value splitlist
B.    access-list splitlist standard permit 209.165.201.0 255.255.255.224
access-list splitlist standard permit 209.165.202.128 255.255.255.224 !
group-policy GroupPolicy1 internal
group-policy GroupPolicy1 attributes
split-tunnel-policy tunnelall
split-tunnel-network-list value splitlist
C.    group-policy GroupPolicy1 internal
group-policy GroupPolicy1 attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list ipv4 1 209.165.201.0 255.255.255.224
split-tunnel-network-list ipv4 2 209.165.202.128 255.255.255.224
D.    access-list splitlist standard permit 209.165.201.0 255.255.255.224
access-list splitlist standard permit 209.165.202.128 255.255.255.224 !
crypto anyconnect vpn-tunnel-policy tunnelspecified
crypto anyconnect vpn-tunnel-network-list splitlist
E.    crypto anyconnect vpn-tunnel-policy tunnelspecified
crypto anyconnect split-tunnel-network-list ipv4 1 209.165.201.0 255.255.255.224
crypto anyconnect split-tunnel-network-list ipv4 2 209.165.202.128 255.255.255.224

Answer: A

Comparing with others’, you will find our 300-209 exam questions are more helpful and precise since all the 300-209 exam content is regularly updated and has been checked for accuracy by our team of Cisco expert professionals.

300-209 new questions on Google Drive: https://drive.google.com/open?id=0B3Syig5i8gpDODI1TDlUT1lBV00

2016 Cisco 300-209 exam dumps (All 237 Q&As) from Lead2pass:

http://www.lead2pass.com/300-209.html [100% Exam Pass Guaranteed]