This page was exported from Lead2pass New Updated Exam Questions [ https://www.getfreevce.com ]

Export date:Sun Dec 22 12:20:03 2024 / +0000 GMT

___________________________________________________


Title: [Lead2pass New] Easily Pass 300-209 Exam By Training Lead2pass New Cisco VCE Dumps (201-220)

---------------------------------------------------


2017 November Cisco Official New Released 300-209 Dumps in Lead2pass.com!  100% Free Download! 100% Pass Guaranteed!  How to 100% pass 300-209 exam? Lead2pass 300-209 dump is unparalleled in quality and is 100% guaranteed to make you pass 300-209 exam. All the 300-209 exam questions are the latest. Here are some free share of Cisco 300-209 dumps. Following questions and answers are all new published by Cisco Official Exam Center: https://www.lead2pass.com/300-209.html  QUESTION 201Which three configurations are required for both IPsec VTI and crypto map-based VPNs? (Choose three.) A.&nbsp;&nbsp;&nbsp; transform setB.&nbsp;&nbsp;&nbsp; ISAKMP policyC.&nbsp;&nbsp;&nbsp; ACL that defines traffic to encryptD.&nbsp;&nbsp;&nbsp; dynamic routing protocolE.&nbsp;&nbsp;&nbsp; tunnel interfaceF.&nbsp;&nbsp;&nbsp; IPsec profileG.&nbsp;&nbsp;&nbsp; PSK or PKI trustpoint with certificateAnswer: ABG QUESTION 202Which statement regarding hashing is correct? A.&nbsp;&nbsp;&nbsp; MD5 produces a 64-bit message digest.B.&nbsp;&nbsp;&nbsp; SHA-1 produces a 160-bit message digest.C.&nbsp;&nbsp;&nbsp; MD5 takes more CPU cycles to compute than SHA-1.D.&nbsp;&nbsp;&nbsp; Changing 1 bit of the input to SHA-1 can change up to 5 bits in the output. Answer: B QUESTION 203Refer to the exhibit. Which type of mismatch is causing the problem with the IPsec VPN tunnel?&nbsp; A.&nbsp;&nbsp;&nbsp; PSKB.&nbsp;&nbsp;&nbsp; Phase 1 policyC.&nbsp;&nbsp;&nbsp; transform setD.&nbsp;&nbsp;&nbsp; crypto access list Answer: A QUESTION 204Which three changes must be made to migrate from DMVPN Phase 2 to Phase 3 when EIGRP is configured? (Choose three.) A.&nbsp;&nbsp;&nbsp; Enable EIGRP next-hop-self on the hub.B.&nbsp;&nbsp;&nbsp; Disable EIGRP next-hop-self on the hub.C.&nbsp;&nbsp;&nbsp; Enable EIGRP split-horizon on the hub.D.&nbsp;&nbsp;&nbsp; Add NHRP redirects on the hub.E.&nbsp;&nbsp;&nbsp; Add NHRP shortcuts on the spoke.F.&nbsp;&nbsp;&nbsp; Add NHRP shortcuts on the hub. Answer: BDE QUESTION 205Which algorithm provides both encryption and authentication for data plane communication? A.&nbsp;&nbsp;&nbsp; SHA-96B.&nbsp;&nbsp;&nbsp; SHA-384C.&nbsp;&nbsp;&nbsp; 3DESD.&nbsp;&nbsp;&nbsp; AES-256E.&nbsp;&nbsp;&nbsp; AES-GCMF.&nbsp;&nbsp;&nbsp; RC4 Answer: E QUESTION 206Which three configurations are prerequisites for stateful failover for IPsec? (Choose three.) A.&nbsp;&nbsp;&nbsp; Only the IKE configuration that is set up on the active device must be duplicated on the standby device; the IPsec configuration is copied automatically.B.&nbsp;&nbsp;&nbsp; Only crypto map configuration that is set up on the active device must be duplicated on the standby device.C.&nbsp;&nbsp;&nbsp; The IPsec configuration that is set up on the active device must be duplicated on the standby device.D.&nbsp;&nbsp;&nbsp; The active and standby devices can run different versions of the Cisco IOS software but need to be the same type of device.E.&nbsp;&nbsp;&nbsp; The active and standby devices must run the same version of the Cisco IOS software and should be the same type of device.F.&nbsp;&nbsp;&nbsp; Only the IPsec configuration that is set up on the active device must be duplicated on the standby device; the IKE configuration is copied automatically.G.&nbsp;&nbsp;&nbsp; The IKE configuration that is set up on the active device must be duplicated on the standby device. Answer: CEG QUESTION 207Which two statements comparing ECC and RSA are true? (Choose two.) A.&nbsp;&nbsp;&nbsp; ECC can have the same security as RSA but with a shorter key size.B.&nbsp;&nbsp;&nbsp; ECC lags in performance when compared with RSA.C.&nbsp;&nbsp;&nbsp; Key generation in ECC is slower and less CPU intensive than RSA..D.&nbsp;&nbsp;&nbsp; ECC cannot have the same security as RSA, even with an increased key size.E.&nbsp;&nbsp;&nbsp; Key generation in ECC is faster and less CPU intensive. Answer: AE QUESTION 208Which two are features of GETVPN but not DMVPN and FlexVPN? (Choose two.) A.&nbsp;&nbsp;&nbsp; one IPsec SA for all encrypted trafficB.&nbsp;&nbsp;&nbsp; no requirement for an overlay routing protocolC.&nbsp;&nbsp;&nbsp; design for use over public or private WAND.&nbsp;&nbsp;&nbsp; sequence numbers that enable scalable replay checkingE.&nbsp;&nbsp;&nbsp; enabled use of ESP or AHF.&nbsp;&nbsp;&nbsp; preservation of IP protocol in outer header Answer: AB QUESTION 209A customer requires all traffic to go through a VPN. However, access to the local network is also required. Which two options can enable this configuration? (Choose two.) A.&nbsp;&nbsp;&nbsp; split excludeB.&nbsp;&nbsp;&nbsp; use of an XML profileC.&nbsp;&nbsp;&nbsp; full tunnel by defaultD.&nbsp;&nbsp;&nbsp; split tunnelE.&nbsp;&nbsp;&nbsp; split include Answer: AB QUESTION 210As network consultant, you are asked to suggest a VPN technology that can support a multivendor environment and secure traffic between sites. Which technology should you recommend? A.&nbsp;&nbsp;&nbsp; DMVPNB.&nbsp;&nbsp;&nbsp; FlexVPNC.&nbsp;&nbsp;&nbsp; GET VPND.&nbsp;&nbsp;&nbsp; SSL VPN Answer: B QUESTION 211Which protocol must be enabled on the inside interface to use cluster encryption in SSL VPN load balancing? A.&nbsp;&nbsp;&nbsp; TLSB.&nbsp;&nbsp;&nbsp; DTLSC.&nbsp;&nbsp;&nbsp; IKEv2D.&nbsp;&nbsp;&nbsp; ISAKMP Answer: D QUESTION 212Refer to the exhibit. Which type of VPN implementation is displayed? &nbsp;A.&nbsp;&nbsp;&nbsp; IKEv2 reconnectB.&nbsp;&nbsp;&nbsp; IKEv1 clusterC.&nbsp;&nbsp;&nbsp; IKEv2 load balancerD.&nbsp;&nbsp;&nbsp; IKEv1 clientE.&nbsp;&nbsp;&nbsp; IPsec high availabilityF.&nbsp;&nbsp;&nbsp; IKEv2 backup gateway Answer: C QUESTION 213An engineer is troubleshooting a DMVPN spoken router and sees a CRPTO-4-IKMP_BAD_MESSAGE debug message that a spoke router "failed its sanity check or is malformed" Which issue does the error message indicate? A.&nbsp;&nbsp;&nbsp; mismatched preshared keyB.&nbsp;&nbsp;&nbsp; unsupported transform propsalC.&nbsp;&nbsp;&nbsp; invalid IP packet SPID.&nbsp;&nbsp;&nbsp; incompatible transform set Answer: A QUESTION 214Which PKI enrollment method allows the user to separate authentication and enrollment actions and also provides an option to specify HTTP/TFTP commands to perform file retrieval from the server? A.&nbsp;&nbsp;&nbsp; enrollment profileB.&nbsp;&nbsp;&nbsp; enrollment terminalC.&nbsp;&nbsp;&nbsp; enrollment urlD.&nbsp;&nbsp;&nbsp; enrollment selfsigned Answer: A QUESTION 215Refer to the exhibit. A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which action can bring up the VPN tunnel? &nbsp; A.&nbsp;&nbsp;&nbsp; Increase the maximum SA limit on the local Cisco ASA.B.&nbsp;&nbsp;&nbsp; Correct the crypto access list on both Cisco ASA devices.C.&nbsp;&nbsp;&nbsp; Remove the maximum SA limit on the remote Cisco ASA.D.&nbsp;&nbsp;&nbsp; Reduce the maximum SA limit on the local Cisco ASA.E.&nbsp;&nbsp;&nbsp; Correct the IP address in the local and remote crypto maps.F.&nbsp;&nbsp;&nbsp; Increase the maximum SA limit on the remote Cisco ASA. Answer: AExplanation:Since unknown request rejected by CAC. CAC is use to limit SA. QUESTION 216Refer to the exhibit. Which type of VPN is being configured, based on the partial configuration snippet? &nbsp;A.&nbsp;&nbsp;&nbsp; DMVPN with dual hubB.&nbsp;&nbsp;&nbsp; GET VPN with dual group memberC.&nbsp;&nbsp;&nbsp; FlexVPN backup gatewayD.&nbsp;&nbsp;&nbsp; GET VPN with COOP key serverE.&nbsp;&nbsp;&nbsp; FlexVPN load balancer Answer: D QUESTION 217Which configuration is used to build a tunnel between a Cisco ASA and ISR? A.&nbsp;&nbsp;&nbsp; crypto mapB.&nbsp;&nbsp;&nbsp; DMVPNC.&nbsp;&nbsp;&nbsp; GET VPND.&nbsp;&nbsp;&nbsp; GRE with IPsecE.&nbsp;&nbsp;&nbsp; GRE without IPsec Answer: A QUESTION 218Refer to the exhibit. What is the problem with the IKEv2 site-to-site VPN tunnel? &nbsp; A.&nbsp;&nbsp;&nbsp; incorrect PSKB.&nbsp;&nbsp;&nbsp; crypto access list mismatchC.&nbsp;&nbsp;&nbsp; incorrect tunnel groupD.&nbsp;&nbsp;&nbsp; crypto policy mismatchE.&nbsp;&nbsp;&nbsp; incorrect certificate Answer: B QUESTION 219Which two statements regarding IKEv2 are true per RFC 4306? (Choose two.) A.&nbsp;&nbsp;&nbsp; It is compatible with IKEv1.B.&nbsp;&nbsp;&nbsp; It has at minimum a nine-packet exchange.C.&nbsp;&nbsp;&nbsp; It uses aggressive mode.D.&nbsp;&nbsp;&nbsp; NAT traversal is included in the RFC.E.&nbsp;&nbsp;&nbsp; It uses main mode.F.&nbsp;&nbsp;&nbsp; DPD is defined in RFC 4309.G.&nbsp;&nbsp;&nbsp; It allows for EAP authentication. Answer: DG QUESTION 220Which DAP endpoint attribute checks for the matching MAC address of a client machine? A.&nbsp;&nbsp;&nbsp; deviceB.&nbsp;&nbsp;&nbsp; processC.&nbsp;&nbsp;&nbsp; antispywareD.&nbsp;&nbsp;&nbsp; BIA Answer: A Always up-to-date Lead2pass 300-209 VCE - everything you need for your Cisco 300-209 exam to pass. Our Cisco 300-209 software allows you to practise exam dumps in real 300-209 exam environment. Welcome to choose. More 300-209 new questions (with images) on Google Drive: https://drive.google.com/open?id=0B3Syig5i8gpDYnF5Vk16OS1tc1E  2017 Cisco 300-209 exam dumps (All 319 Q&amp;As) from Lead2pass:  https://www.lead2pass.com/300-209.html [100% Exam Pass Guaranteed]

---------------------------------------------------


Images: 

---------------------------------------------------




---------------------------------------------------


Post date: 2017-11-01 07:07:10

Post date GMT: 2017-11-01 07:07:10

Post modified date: 2017-11-01 07:07:10

Post modified date GMT: 2017-11-01 07:07:10



____________________________________________________________________________________________


Export of Post and Page as text file has been powered by [ Universal Post Manager ] plugin from www.gconverters.com