It is more faster and easier to pass the Cisco 300-209 exam by using Pinpoint Cisco Implementing Cisco Secure Mobility Solutions (SIMOS) questuins and answers. Immediate access to the Up to the minute 300-209 Exam and find the same core area 300-209 questions with professionally verified answers, then PASS your exam with a high score now.

Q41. Which two examples of transform sets are contained in the IKEv2 default proposal? (Choose two.) 

A. aes-cbc-192, sha256, 14 

B. 3des, md5, 5 

C. 3des, sha1, 1 

D. aes-cbc-128, sha, 5 

Answer: B,D 


Q42. Which three types of SSO functionality are available on the Cisco ASA without any external SSO servers? (Choose three.) 

A. SAML 

B. HTTP POST 

C. HTTP Basic 

D. NTLM 

E. Kerberos 

F. OAuth 2.0 

Answer: B,C,D 


Q43. After implementing the IKEv2 tunnel, it was observed that remote users on the 192.168.33.0/24 network are unable to access the internet. Which of the following can be done to resolve this problem? 

A. Change the Diffie-Hellman group on the headquarter ASA to group5forthe dynamic crypto map 

B. Change the remote traffic selector on the remote ASA to 192.168.22.0/24 

C. Change to an IKEvI configuration since IKEv2 does not support a full tunnel with static peers 

D. Change the local traffic selector on the headquarter ASA to 0.0.0.0/0 

E. Change the remote traffic selector on the headquarter ASA to 0.0.0.0/0 

Answer:

Explanation: 

The traffic selector is used to determine which traffic should be protected (encrypted over the IPSec tunnel). We want this to be specific, otherwise Internet traffic will also be sent over the tunnel and most likely dropped on the remote side. Here, we just want to protect traffic from 192.168.33.0/24 to 192.168.22.0/24. 


Q44. Which two statements about the Cisco ASA Clientless SSL VPN solution are true? (Choose two.) 

A. When a client connects to the Cisco ASA WebVPN portal and tries to access HTTP resources through the URL bar, the client uses the local DNS to perform FQDN resolution. 

B. The rewriter enable command under the global webvpn configuration enables the rewriter functionality because that feature is disabled by default. 

C. A Cisco ASA with an AnyConnect Premium Peers license can simultaneously allow Clientless SSL VPN sessions and AnyConnect client sessions. 

D. Content rewriter functionality in the Clientless SSL VPN portal is not supported on Apple mobile devices. 

E. Clientless SSLVPN provides Layer 3 connectivity into the secured network. 

Answer: C,D 


Q45. Which Cisco ASDM option configures forwarding syslog messages to email? 

A. Configuration > Device Management > Logging > E-Mail Setup 

B. Configuration > Device Management > E-Mail Setup > Logging Enable 

C. Select the syslogs to email, click Edit, and select the Forward Messages option. 

D. Select the syslogs to email, click Settings, and specify the Destination Email Address option. 

Answer:


Q46. Scenario: 

You are the senior network security administrator for your organization. Recently and junior engineer configured a site-to-site IPsec VPN connection between your headquarters Cisco ASA and a remote branch office. 

You are now tasked with verifying the IKEvl IPsec installation to ensure it was properly configured according to designated parameters. Using the CLI on both the Cisco ASA and branch ISR, verify the IPsec configuration is properly configured between the two sites. 

NOTE: the show running-config command cannot be used for this exercise. 

Topology: 

Which transform set is being used on the branch ISR? 

A. Default 

B. ESP-3DES ESP-SHA-HMAC 

C. ESP-AES-256-MD5-TRANS mode transport 

D. TSET 

Answer:

Explanation: 

This can be seen from the “show crypto ipsec sa” command as shown below: 


Q47. Based on the provided ASDM configuration for the remote ASA, which one of the following is correct?

A. An access-list must be configured on the outside interface to permit inbound VPN traffic 

B. A route to 192.168.22.0/24 will not be automatically installed in the routing table 

C. The ASA will use a window of 128 packets (64x2) to perform the anti-replay check _ 

D. The tunnel can also be established on TCP port 10000 

Answer:

Explanation: 

Cisco IP security (IPsec) authentication provides anti-replay protection against an attacker duplicating encrypted packets by assigning a unique sequence number to each encrypted packet. The decryptor keeps track of which packets it has seen on the basis of these numbers. Currently, the default window size is 64 packets. Generally, this number (window size) is sufficient, but there are times when you may want to expand this window size. The IPsec Anti-Replay Window: Expanding and Disabling feature allows you to expand the window size, allowing the decryptor to keep track of more than 64 packets. 


Q48. Which IKEv2 feature minimizes the configuration of a FlexVPN on Cisco IOS devices? 

A. IKEv2 Suite-B 

B. IKEv2 proposals 

C. IKEv2 profiles 

D. IKEv2 Smart Defaults 

Answer:


Q49. Refer to the exhibit. 

What technology does the given configuration demonstrate? 

A. Keyring used to encrypt IPSec traffic 

B. FlexVPN with IPV6 

C. FlexVPN with AnyConnect 

D. Crypto Policy to enable IKEv2 

Answer:


Q50. Refer to the exhibit. 

Which two statements about the given configuration are true? (Choose two.) 

A. Defined PSK can be used by any IPSec peer. 

B. Any router defined in group 2 will be allowed to connect. 

C. It can be used in a DMVPN deployment 

D. It is a LAN-to-LAN VPN ISAKMP policy. 

E. It is an AnyConnect ISAKMP policy. 

F. PSK will not work as configured 

Answer: A,C