Q109. An engineer is designing a DMVPN topology for a client. The client wants all branch offices to connect to a hub at their data center and fall back to a different device in case of failure. Which DMVPN design meets these requirements without unnecessary devices or services?

Q110. Which two features are valid backup options for an IOS FlexVPN client? (Choose two.)

Q111. On an ASA with multiple connection profiles for different departments, what is the best design to ensure that AnyConnect users are assigned the correct connection profile based on their department and do not have the ability to choose a different connection profile?

Q112. Refer to the exhibit.

An engineer has configured a spoke to connect to a FlexVPN hub. The tunnel is up, but pings fail when the engineer attempts to reach host 192.168.200.10 behind the spoke, and traffic is sourced from host 192.168.100.3, which is behind the FlexVPN server. Based on packet captures, the engineer discovers that host 192.168.200.10 receives the icmp echo and sends an icmp reply that makes it to the inside interface of the spoke. Based on the output in the exhibit captured on the spoke by the engineer, which action resolves this issue?

Q113. After a network security administrator configures site-to-site IPsec VPN peer, they receive this error message:
1d00h: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Main Mode failed with peer at 150.150.150.1.
What is the solution to this problem?

Q114. Refer to the exhibit. Client 1 cannot communicate with client 2. Both clients are using Cisco AnyConnect and have established a successful SSL VPN connection to the hub ASA.
Which command on the ASA is missing?

Q115. A Cisco IOS router is reconfigured to connect to an additional DMVPN hub that is a part of a different DMVPN phase 3 cloud. After this change was made, users begin to experience problems accessing corporate resources over both tunnels. Before the additional tunnel was created, users could access resources over the first tunnel without any issues. Both tunnels terminate on the same interface of the router and use the same IPsec proposals. Which two actions resolve the issue without affecting spoke-to-spoke traffic in either DMVPN cloud?
(Choose two.)

Q116. Refer to the exhibit.

Which two conclusions should be drawn from the DMVPN phase 2 configuration? (Choose two.)

Q117. Which technology works with IPsec stateful failover?

Q118. Refer to the exhibit.

All internal clients behind the ASA are port address translated to the public outside interface that has an IP address of 3.3.3.3. Client 1 and client 2 have established successful SSL VPN connections to the ASA.
What must be implemented so that “3.3.3.3” is returned from a browser search on the IP address?

Q119. Refer to the exhibit. The network administrator must allow the Cisco AnyConnect Secure Mobility Client to securely access the corporate resources via IKEv2 and print locally. Traffic that is destined for the Internet must still be tunneled to the Cisco ASA. Which configuration does the administrator use to accomplish this goal?

Q120. Which two features provide headend resiliency for Cisco AnyConnect clients? (Choose two.)

Q121. Refer to the exhibit. Which type of mismatch is causing the problem with the IPsec VPN tunnel?

Q122. Refer to the exhibit.

Which VPN technology is used in the exhibit?

Q123. An engineer is configuring clientless SSL VPN. The finance department has a database server that only they should access, but the sales department can currently access it. The finance and the sales departments are configured as separate group-policies. What must be added to the configuration to make sure the users in the sales department cannot access the finance department server?

Q124. Refer to the exhibit. Users cannot connect via AnyConnect SSLVPN. Which action resolves this issue?

Q125. Which feature allows the ASA to handle nonstandard applications and web resources so that they display correctly over a clientless SSL VPN connection?

Q126. In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form. Which troubleshooting step solves the issue?

Q127. Refer to the exhibit.

A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which action brings up the VPN tunnel?

Q128. Which benefit of FlexVPN is a limitation of DMVPN using IKEv1?

Q129. Which statement about GETVPN is true?

Q130. A security engineer is deploying FlexVPN between sites that must use secure authentication method. The engineer must choose the appropriate EAP type that is compatible with FlexVPN.
Which type of EAP must be configured to accomplish the task?

Q131. Drag and Drop Question
Drag and drop the actions from the left into the sequence on the right to configure a FlexVPN site-to-site GRE tunnel that uses IPsec between two Cisco routers by using preshared keys.

Q132. A Cisco AnyConnect client establishes a SSL VPN connection with an ASA at the corporate office. An engineer must ensure that the client computer meets the enterprise security policy. Which feature can update the client to meet an enterprise security policy?

Q133. Which problem is solved by enabling IKEv2 fragmentation on a VPN headend?