Share your VPN Experience
Cisco has made changes for the Security exams by replacing the old CCSP with the new CCNP Security Certification with 4 modules: Secure, Firewall, IPS and VPN. In fact, the old CCSP and the new CCNP Security are very similar. Many candidates have requested us to put up materials for these new exams but it is a time-consuming work. In the mean time, we created the “Share your experience” for the VPN exam. We really hope anyone who read securitytut, 9tut, digitaltut, certprepare, networktut and voicetut contribute to these sections as your experience is invaluable for CCNP Security learners to complete their goals.
Please share with us your experience after taking the VPN 642-647 exam, your materials, the way you learned, your recommendations…
NEW QUESTION 448
When configuring a FlexVPN, which two components must be configured for IKEv2? (Choose two.)
A. persistence
B. prsaofile
C. proposal
D. preference
E. method
Answer: BC
I made it today with 985/1000, everything here is valid.
I am now moving on to Next Exam.
Share latest exam Questions enjoy.
Remove 1 star***
https:/*/priv.sh/d9HamP4
NEW QUESTION 450
Which two descriptions of the characteristics of Cisco GET VPN are true? (Choose two.)
A. provides a tunelless transport mechanism
B. encrypts the data payload and IP header of a packet
C. requires that GRE tunnels exist between participating routers
D. uses a common set of traffiadc encryption keys shared by group members
E. uses VTIs to establish Ipsec tunnels
Answer: AD
@Full Authentic Dumps – you stupid spammer. Get outta here
Why must a network engineer avoid usage of the default X509 certificate when implementing clientless
SSLVPN on an ASA?
A. The certificate is too weak to provide adequate security.
B. The certificate is regenerated at each reboot.
C. The certificate must be managed by the local CA.
D. The default X.509 certificate is not supported for SSLVPN.
Correct Answer: C <== In my opinion, the correct is B.
CM
Agree with CM.. Maybe the choices were rumbled and they forgot to change it.
Why must a network engineer avoid usage of the default X.509 certificate when implementing Clientless VPN on an ASA?
A. The certificate is too weak to provide adequate security
B. The default X.509 certificate is not supported for SSLVPN
C. The certificate is regenerated at each reboot
D. The certificate must be managed by the local CA
Answer is C
@CrazzyMonkey,Bulbulito-Bayagbag
This question has been discussed in the past and it’s B. The certificate is regenerated at each reboot.
Alrighty! Thanks Aouas.. Just wondering, have you take your exam yet?
Refer to the exhibit. Which technology does this configuration demonstrate?
interface GigabitEthernet0/0
namif outside
security-level 0
ip address 192.168.1.1 255.255.255.0
ipv6 address 2001:db8:100::1/64
!
group-policy DfltGrpPolicy attributes
dns-server value 10.48.66.195
vpn-tunnel-protocol ikev2 ssl-client
gateway-fqdn value asa.cisco.com
address-pools value pool4
ipv6-address-pools value pool6
webvpn
anyconnect profiles value VPN type user
!
______________________________________
xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance”
xsi:schemaLocation=”http://schemas.xmlsoap.org/encoding/AnyConnectProfile.xsd”>
…
IPv6,IPv4
…
VPN
asa.cisco.com
A. AnyConnect SSL over IPv4+IPv6
B. AnyConnect FlexVPN over IPv4+IPv6
C. AnyConnect FlexVPN IPv6 over IPv4
D. AnyConnect SSL IPv6 over IPv4
Dump says B. Wouldn’t be A?
Can someone please explain why C is the correct answer
Which statement is true when implementing a router with a dynamic public IP address in a crypto map based site-to-site VPN?
A. The router must be configured with a dynamic crypto map.
B. Certificates are always used for phase 1 authentication.
C. The tunnel establishment will fail if the router is configured as a responder only.
D. The router and the peer router must have NAT traversal enabled.
Correct Answer: C
@BMAN
If the router change its IP address, the initiator will not be able to reach it.
CM
Thanks @CrazzyMonkey
@Bulbulito-Bayagbag,
I have not taken my exam
@Aouas – when you plan to take?
@CrazzyMonkey – today’s ur exam right bro? 25th? Goodluck and dont forget to update us! :)
@Bulbulito-Bayagbag, my exam is on 26th. The folks at my company passed me the wrong date.
An extra day to go over the stuff.
Will update you by the weekend, because if I pass, will not be sober till saturday. Well, if I fail, I will get drunk too.
LOL.
CM
Folks, close attention to DMVPN NHRP D&D of SuperMario’s. It is not correct.
As I have seen somewhere here in this community:
1. The spoke receives MM6 from the hub, and responses with QM1 to the hub to begin quick mode.
2. The received attributes are accepted as the hub receives QM1 and respons with QM2 creating Phase 2 SAs for this session.
3. The ISAKMP and IPsec negotiation is complete, which creates an IPsec session to encrypt GRE traffic between the two peers.
4. The crypto session is up and packets are encapsulated within the GRE over IPsec tunnel.
5. The spoke generates an NHRP registration request, which is sent across the GRE over IPsec tunnel.
6. The Hub receives the NHRP registration request and sents NHRP registration reply after it confirms that the spoke has a valid tunnel and Nonbroadcast Multiaccess address. The spoke receives this NHRP registration reply.
Ref.: https://www.cisco.com/c/en/us/support/docs/security-vpn/dynamic-multi-point-vpn-dmvpn/116957-technote-dmvpn-00.html
For the one below, I`ve seen answers for all options, but A:
Which command configures IKEv2 symmetric? Identity authentication?
A- match identity remote address 0.0.0.0
B-authentication local pre-share
C- authentication pre-share
D- authentication remote rsa-sig
I made it today with 985/1000, everything here is valid.
I am now moving on to Next Exam.
Share latest exam Questions enjoy
Remove 1 star***
https:/*/priv.sh/d9HamP4
NEW QUESTION 450
Which two descriptions of the characteristics of Cisco GET VPN are true? (Choose two.)
A. provides a tunelless transport mechanism
B. encrypts the data payload and IP header of a packet
C. requires that GRE tunnels exist between participating routers
D. uses a common set of traffic encryption keys shared by group members
E. uses VTIs to establish Ipsec tunnels
Answer: AD
@Crazzymate – ok cool mate…
Just wondering, have you seen labs on supermario dumps? I’ve seen one (clientless ssl bookmarks) but doesnt have answer on it.. you guys know where can i find the answer?
Now im wondering how many labs are there available on the actual exam.
nevermind my questions on the lab clientless vpn bookmark thing.. already have the answers from passleader dump..
so from supermario, there just 1 lab with no answers… with passleader, there are 2 labs.
1. clientless ssl vpn – bookmarks
2. flex vpn
just wondering if these are still valid on the exam
@Bulbulito-Bayagbag Where have you got the passleader dump?
Guys sorry I was unable to comment before I did this exam last week and it went really good the supermario dump still valid.
Awesome @SuperLuigi! and Congrats bro!
How’s your exam? DD? Lab?
FLK – what’s your email bro. I’ll send it to you
Sims: Bookmark VPN and IPSEC tunnel with ASDM, D and D of DMVPN and Algorithm of encryption and authentication, the exam its easy if you study…. no new questions
@SuperLuigi
there’s a confusion here with the D&D of dmvpn and encryption/authentication.. what did you follow? Still Supermario?
disregard the encryption/authentication… i mean D&D of DMVPN and GRE over IPSec/IPSec VTI…
the encryption/authentication D&D is pretty much straight forward.
How many questions in the exam?
@SuperLuigi,
Please let us know if you followed the below:
DMVPN NHRP,
– The spoke receives MM6 from the hub, and responses with QM1 to the hub to begin quick mode.
– The received attributes are accepted as the hub receives QM1 and respons with QM2 creating Phase 2 SAs for this session.
– The ISAKMP and IPsec negotiation is complete, which creates an IPsec session to encrypt GRE traffic between the two peers.
– The crypto session is up and packets are encapsulated within the GRE over IPsec tunnel.
– The spoke generates an NHRP registration request, which is sent across the GRE over IPsec tunnel.
– The Hub receives the NHRP registration request and sents NHRP registration reply after it confirms that the spoke has a valid tunnel and Nonbroadcast Multiaccess address. The spoke receives this NHRP registration reply.
www .cisco .com/c/en/us/support/docs/security-vpn/dynamic-multi-point-vpn-dmvpn/116957-technote-dmvpn-00 .html
authentication – encryption
ESP-SHA-HMAC -> Authentication
ESP-MD5 -> Authentication
ESP-AES-HMAC -> Encryption
ESP-3DES -> Encryption
I understand the Bookmarks lab, but which is the IPSec tunnel with ASDM ?
do you mean the simlet that you have to answer some questions using the ASDM?
@Bulbulito-Bayagbag flk3105 at g m a i l . c o m. Thx bro.
ANy hint on this one?
Which command configures IKEv2 symmetric? Identity authentication?
A- match identity remote address 0.0.0.0
B-authentication local pre-share
C- authentication pre-share
D- authentication remote rsa-sig
Which technology can rate-limit the number of tunnels on a DMVPN hub when system utilization is above a
specified percentage?
A. NHRP Event Publisher
A. NHRP Event Publisher
B. interface state control
C. CAC
D. NHRP Authentication
E. ip nhrp connect
Correct Answer: C
Is that correct?
@CrazzyMonkey
CAC or C is correct
It is most likely that Call Admission Control will be used on a DMVPN hub to rate limit the number of DMVPN tunnels that are attempting to be built at the same time. The rate limiting is accomplished by configuring a system resource limit under Call Admission Control, which configures the router to drop new ISAKMP session requests (new DMVPN tunnels) when the system utilization is above a specified percentage. The dropped session requests allow the DMVPN hub router to complete the current ISAKMP session requests, and when the system utilization drops, it can process the previously dropped sessions when they are reattempted.
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-s/sec-conn-dmvpn-15-s-book/sec-conn-dmvpn.html
@BB hey, i was able to find some vce files with a vce player download. Not sure if you want them, but i can send you the link if you like, lmk.
@just barely – just wondering bro, your vce player… can it run supermario’s vce file?
no, i tried it doesn’t run it, errors out. but the download has 2 vce files, that so far seems to have the same questions.
@just barely cool. can you send the link here of those 2 vce files that has the same questions off supermario please? thanks in advance bro
h t t p s ://drive*google*com/open?id=1_OD5CTFWjTk2V0jVUTAjPXd1vkrzn1U7
I follow the supermario answers on the D and D for the DMVPN and that is correct.
check out the packet flow visualization:
https://www.cisco.com/c/en/us/support/docs/security-vpn/dynamic-multi-point-vpn-dmvpn/116957-technote-dmvpn-00.html
and about the simlet , yes its the same
@just barely – thanks man
@SuperLuigi – thanks for confirming bro. So just to confirming, supermario dumps is enough to pass or you have another dumps that you used?
@Bulbulito-Bayagbag, thanks for confirming.
@SuperLuigi, congrats man, and thanks for sharing your experience.
CM
Which command configures IKEv2 symmetric? Identity authentication?
A- match identity remote address 0.0.0.0
B-authentication local pre-share
C- authentication pre-share
D- authentication remote rsa-sig
Although the dump says it`s C, I would go with B.
Which command will prevent a group policy from inheriting a filter ACL in a clientless SSL VPN?
A. vpn-filter none
B. no vpn-filter
C. filter value none
D. filter value ACLname
A or C? Dump says A…
CM
Ok guys, they rescheduled my exam and it was today. Whew! Luckily i passed it. Haha.. 914/1000.. thank you Lord! 🙏🏻👆
Anyways, so to share my exam.. it’s all in supermario pdf/vce… it’s still valid and 101% legit..
Lab:
1. Clienless SSL VPN – BOOKMARKS (HQ-Server is for http, DMZ-Server-FTP is for ftp)
Simlet:
1. ASDM (VPN command – show crypto isakmp key, show crypto ipsec sa and show crypto isakmp sa)
D&D:
1. Encryption/Authentication (beware of this, you should know what’s for encryption and authentication coz in supermario, encryption box was above, authentication box was at the bottom.. on the actual exam, they interchanged it.
2. DMVPN phase/process (followed supermario’s answer)
3. VPN States (Sanity Check, QM_Idle, MM_NO_STATE, atts not accepted etc)
Goodluck to all! 👌🏻
Also, i’ve noticed… most of the questions on my exam (90%) was on the last part of supermario’s dump.. like from question numbers 200-448..
Anyways, as long as you understand and studied supermario’s dumps then you should be all good! 👌🏻
@ Bulbulito-Bayagbag can you share the dumps to my ID.
Can someone pls share the valid dump or at least the new questions of 300-209…
thank you BB, GL with the rest of your studies!
@Bulbulito-Bayagbag
can you share the dump please.
mjdeanx *@* g m a i l*com
Today I have done my test and get 965/1000..
Exam Very easy all questions in Dumps.
not difficult at all, do not worry.
Remove 1 star***
https:/*/priv.sh/d9HamP4
Which command will prevent a group policy from inheriting a filter ACL in a clientless SSL VPN?
A. vpn-filter none
B. no vpn-filter
C. filter vasluwqe none
D. filter value ACLname
A or C? Dump says A…
CM
Supermario’s dumps – vce and pdf link below.. (remove the spaces and *)
h tt p s ://od.lk****/f***l/MThfMTE2NTQ4M18
@{email not allowed} and @mj
there you go.. download and save it to your computers
@toghajiniatgmaildotcom and @mj
there you go.. download and save it to your computers
another one – this is PassLeader.. though it has less questions than supermarios.. it’s only around 420+ questions.. supermario has 440+… but on supermario’s dump.. there’s no answer for the LAB – BOOKMARKS… but in here, there’s is. so you might want to review this also…
(remote the spaces and *)
h tt p s ://od.lk*****/f*****l/MThfMTE2NTQ4NF8
@bb how were the questions from examtopics? close to what was on the exam?
@just barely
It’s all in supermario pdf/vce… most of the questions came from the last pages like questions 200-440+.. but just to be sure, you review all questions. I had 1 lab, 1 simlet and 3 D&Ds. See below.
Lab:
1. Clienless SSL VPN – BOOKMARKS (HQ-Server is for http, DMZ-Server-FTP is for ftp)
Simlet:
1. ASDM (VPN command – show crypto isakmp key, show crypto ipsec sa and show crypto isakmp sa)
D&D:
1. Encryption/Authentication (beware of this, you should know what’s for encryption and authentication coz in supermario, encryption box was above, authentication box was at the bottom.. on the actual exam, they interchanged it. so dont just memorize the answers, you need to understand it)
2. DMVPN phase/process (followed supermario’s answer)
3. VPN States (Sanity Check, QM_Idle, MM_NO_STATE, atts not accepted etc)
just barely AND Bulbulito-Bayagbag BOTH ARE FAKE FAKE FAKE
just barely AND Bulbulito-Bayagbag BOTH ARE FAKE FAKE FAKE
@Bulbulito-Bayagbag
Hi do you meet any of these questions in the exam yesterday?
1.Which command displays the NBMA IP addresses when DMVPN is configured with tunnel
protection?
A. show crypto session
B. show ip nhrp
C. show ip interface tunnel
D. show crypto socket
Answer: B
2.Your company network security policy requires that all network traffic be tunneled to the corporate
office. End users must be able to access local LAN resources when they connect to the corporate
network. Which two configurations do you implement in Cisco AnyConnect? (Choose two.)
A. Split-exclude tunneling
B. Local LAN access
C. Static routes
D. Client Bypass Protocol
E. Tunnel all
Answer: BE
3.Which two methods customize the installation of the Cisco AnyConnect client? (Choose two.)
A. installation profiles
B. command-line parameters
C. client profiles
D. resource profiles
E. installer transforms
Answer: BE
4.Which description of how DTLS improves application performance is true?
A. uses connection-oriented sessions
B. creates less overhead by using UDP
C. avoids bandwidth and latency issues
D. uses a flow control mechanism
Answer: C
5.Which cryptographic method provides passphrase protection while importing or exporting keys?
A. AES
B. RSA
C. Serpent
D. Blowfish
Answer: B
6.You are configuring a Cisco ASA for Clientless SSL VPN. Which command do you run to prevent
web browsing from the Cisco SSL VPN portal page?
A. url-list disable
B. http server disable
C. http-proxy 0.0.0.0
D. url-entry disable
Answer: D
7.What is a functional difference between IKEV1 and IKEV2 on a router?
A. HSRP
B. RRI
C. DPD
D. Stateful Failover
Answer: C
8.Which two descriptions of the characteristics of Cisco GET VPN are true? (Choose two.)
A. provides a tunelless transport mechanism
B. encrypts the data payload and IP header of a packet
C. requires that GRE tunnels exist between participating routers
D. uses a common set of traffic encryption keys shared by group members
E. uses VTIs to establish Ipsec tunnels
Answer: AD
9.When using Clientless SSL VPN on a Cisco ASA, which authentication method is required for single
sign-on?
A. TACACS
B. LOCAL
C. RADIUS
D. SAML 2.0
Answer: D
6.You are configuring a Cisco ASA for Clientless SSL VPN. Which command do you run to prevent
web browsing from the Cisco SSL VPN portal page?
A. url-list sdisable
B. http servesdr disable
C. http-proxy 0.0.0.0
D. url-entry disable
Answer: D
7.What is a functional difference between IKEV1 and IKEV2 on a router?
A. HSRP
B. RRI
C. DPD
D. Stateful Failover
Answer: C
haha. telling me I’m a fake? suck my d*ck bro! lol…
QUESTION 389
An Engineer must configure GETVPN to transfer over the network between corporate offices.
which two options are the advantages to choose GETVPN over EZVPN? (TWO)
A. GETVPN is highly scalable any to any mesh topology
B. GETVPN has QoS support
C. GETVPN has unique session keys for improved security
D. GETVPN supports multicast
E. GET VPN supports a hub-and -spoke topology
Dump says Correct Answer: BD
I think it’s AB or AD
https://www.cisco.com/c/en/us/products/collateral/security/group-encrypted-transport-vpn/deployment_guide_c07_554713.html
What do you think?
hi @mj.. see below
1.Which command displays the NBMA IP addresses when DMVPN is configured with tunnel
protection?
A. show crypto session
B. show ip nhrp
C. show ip interface tunnel
D. show crypto socket
Answer: B
— this shows on my exam, my answer is B
2.Your company network security policy requires that all network traffic be tunneled to the corporate
office. End users must be able to access local LAN resources when they connect to the corporate
network. Which two configurations do you implement in Cisco AnyConnect? (Choose two.)
A. Split-exclude tunneling
B. Local LAN access
C. Static routes
D. Client Bypass Protocol
E. Tunnel all
Answer: BE
— this shows on my exam, my answer are AB
3.Which two methods customize the installation of the Cisco AnyConnect client? (Choose two.)
A. installation profiles
B. command-line parameters
C. client profiles
D. resource profiles
E. installer transforms
Answer: BE
— This didnt show up on my exam. You can just follow what you see on supermario’s or if someone here has explanations on this, you can verify it too..
4.Which description of how DTLS improves application performance is true?
A. uses connection-oriented sessions
B. creates less overhead by using UDP
C. avoids bandwidth and latency issues
D. uses a flow control mechanism
Answer: C
— This didnt show up on my exam. You can just follow what you see on supermario’s or if someone here has explanations on this, you can verify it too..
5.Which cryptographic method provides passphrase protection while importing or exporting keys?
A. AES
B. RSA
C. Serpent
D. Blowfish
Answer: B
— this shows on my exam, my answer is B
6.You are configuring a Cisco ASA for Clientless SSL VPN. Which command do you run to prevent
web browsing from the Cisco SSL VPN portal page?
A. url-list disable
B. http server disable
C. http-proxy 0.0.0.0
D. url-entry disable
Answer: D
— this shows on my exam, my answer is D
7.What is a functional difference between IKEV1 and IKEV2 on a router?
A. HSRP
B. RRI
C. DPD
D. Stateful Failover
Answer: C
— This didnt show up on my exam. You can just follow what you see on supermario’s or if someone here has explanations on this, you can verify it too..
8.Which two descriptions of the characteristics of Cisco GET VPN are true? (Choose two.)
A. provides a tunelless transport mechanism
B. encrypts the data payload and IP header of a packet
C. requires that GRE tunnels exist between participating routers
D. uses a common set of traffic encryption keys shared by group members
E. uses VTIs to establish Ipsec tunnels
Answer: AD
— this shows on my exam, my answer are AD
9.When using Clientless SSL VPN on a Cisco ASA, which authentication method is required for single
sign-on?
A. TACACS
B. LOCAL
C. RADIUS
D. SAML 2.0
Answer: D
— this shows on my exam, my answer is D (actual exam show only SAML.. not 2.0)
lol..what would we be fake about?
@Bulbulito-Bayagbag Thank you
anyone have the newly added questions in 300-209 exam? Pls help..
@luna
You can google the new questions, i think passleader has it uploaded on their site but not complete. But dont worry, most of the questions on the actual exams are on supermario v4 dumps so be sure to study that ok? Goodluck! 👌🏻
Why must a network engineer avoid usage of the default X509 certificate when implementing clientless SSLVPN on an ASA?
A. The certificate is too weak to provide adequate security.
B. The certificate is regenerated at each reboot.
C. The certificate must be managed by the local CA.
D. The default X.509 certificate is not supported for SSLVPN.
Dump points to C. Why not B?
Which command will allow a referenced ASA interface to become accessible across a site-to-site VPN?
A. access-list 101 extended permit ICMP any any
B. crypto map vpn 10 match address 101
C. crypto map vpn interface inside
D. management-access
Correct Answer: D?
Questions I can remember (Supermario`s) from my exam:
3
30
38
61
75
83
116
122
126
166
170
177
184 – HotSpot
200
208
222
228
232
245
247
252
258 – Clienless SSL VPN – BOOKMARKS
259
262
265
271
337
342
384
414 – D&D
427 – D&D
432
436
441
442
445 – D&D after 445
448
Hi!
The new PassLeader 300-209 dumps (Updated Recently) now are available, here are part of 300-209 exam questions (FYI):
[Get the download link at the end of this post]
NEW QUESTION 446
You must implement DMVPN Phase 3 by using EIGRP as the dynamic routing protocol for the tunnel overlay. Which action do you take to allow EIGRP to advertise all routes between the hub and all the spokes?
A. Summarize routes from the hub to the spokes.
B. Disable split-horizon for EIGRP on the hub.
C. Configure the hub to set itself as the next hop when advertising networks to the spoke.
D. Add a distribute list to permit the spoke subnets and deny all other networks.
Answer: B
NEW QUESTION 448
When configuring a FlexVPN, which two components must be configured for IKEv2? (Choose two.)
A. persistence
B. profile
C. proposal
D. preference
E. method
Answer: BC
NEW QUESTION 449
What is a functional difference between IKEV1 and IKEV2 on a router?
A. HSRP
B. RRI
C. DPD
D. Stateful Failover
Answer: C
NEW QUESTION 450
Which two descriptions of the characteristics of Cisco GET VPN are true? (Choose two.)
A. provides a tunelless transport mechanism
B. encrypts the data payload and IP header of a packet
C. requires that GRE tunnels exist between participating routers
D. uses a common set of traffic encryption keys shared by group members
E. uses VTIs to establish Ipsec tunnels
Answer: AD
NEW QUESTION 451
When using Clientless SSL VPN on a Cisco ASA, which authentication method is required for single sign-on?
A. TACACS
B. LOCAL
C. RADIUS
D. SAML 2.0
Answer: D
NEW QUESTION 452
……
~~~New PassLeader 300-209 dumps FYI~~~
od.lk/fl/NjFfMTUyNjc0N18
(454q~~~NEW VERSION DUMPS!!!)
[(copy that short link and open it in your web browser!!!)]
More:
1. PassLeader 300-206 dumps FYI:
od.lk/fl/NjFfMTUyNjc0M18
(486q~~~NEW VERSION DUMPS!!!)
~~~~~~~~~~~~~~~~~~~~~~~
2. PassLeader 300-208 dumps FYI:
od.lk/fl/NjFfMTUyNjc0NV8
(502q~~~NEW VERSION DUMPS!!!)
~~~~~~~~~~~~~~~~~~~~~~~
3. PassLeader 300-210 dumps FYI:
od.lk/fl/NjFfMTUyNjc0OV8
(502q~~~NEW VERSION DUMPS!!!)
~~~~~~~~~~~~~~~~~~~~~~~
Good Luck!!!
[(copy those links and open them in your web browser!!!)]
Did you have the LAB configuration sim or no?
On my exam, the LAB was Clienless SSL VPN – BOOKMARKS. Very easy
@LULA_PRESO,
Which simlets did you have?
@aouas, check question 184.
Show commands:
show crypto isakmp key
show crypto isakmp sa
show crypto ipsec sa
Folks, I was reviewing Q55 and the question says to create tunnel 0, but the steps show the creation of tunnel 1. Does that make sense?
Thanks a lot.
@Bulbulito-Bayagbag , @LULA_PRESO Thank you guys very much!
NEW QUESTION 446
You must implement DMVPN Phase 3 by using EIGRP as the dynamic routing protocol for the tunnel overlay. Which action do you take to allow EIGRP to advertise all routes between the hub and all the spokes?
A. Summarize routes from the hub to the spokes.
B. Disable split-horizon for EIGRP on the hub.
C. Configure the hub to set itself as the next hop when advertising networks to the spoke.
D. Add a distribute list to permit the spoke subnets and deny all other networks.
Answer: B
NEW QUESTION 448
When configuring a FlexVPN, which two components must be configured for IKEv2? (Choose two.)
A. persistence
B. profile
C. proposal
D. preference
E. method
Answer: BC
NEW QUESTION 449
What is a functional difference between IKEV1 and IKEV2 on a router?
A. HSRP
B. RRI
C. DPD
D. Stateful Failover
Answer: C
NEW QUESTION 450
Which two descriptions of the characteristics of Cisco GET VPN are true? (Choose two.)
A. provides a tunelless transport mechanism
B. encrypts the data payload and IP header of a packet
C. requires that GRE tunnels exist between participating routers
D. uses a common set of traffic encryption keys shared by group members
E. uses VTIs to establish Ipsec tunnels
Answer: AD
NEW QUESTION 451
When using Clientless SSL VPN on a Cisco ASA, which authentication method is required for single sign-on?
A. TACAqaCS
B. LOCAL
C. RADIUS
D. SAML 2.0
Answer: D
8.Which two descriptions of the characteristics of Cisco GET VPN are true? (Choose two.)
A. provides a tunelless transport mechanism
B. encrypts the data payload and IP header of a packet
C. requires that GRE sqtunnels exist between participating routers
D. uses a common set of traffic encryption keys shared by group members
E. uses VTIs to establish Ipsec tunnels
Answer: AD
@LULA_PRESO,
Could you please let us know how did you fill the Drag and Drop for the IPsec tunnels, QUESTION 427 ?
@LULA_PRESO,
and the D&D QUESTION 414.
I think that both of them are wrong in the supermario’s pdf.
Below what i have found as correct
1dnd:DMVPN NHRP,
– The spoke receives MM6 from the hub, and responses with QM1 to the hub to begin quick mode.
– The received attributes are accepted as the hub receives QM1 and respons with QM2 creating Phase 2 SAs for this session.
– The ISAKMP and IPsec negotiation is complete, which creates an IPsec session to encrypt GRE traffic between the two peers.
– The crypto session is up and packets are encapsulated within the GRE over IPsec tunnel.
– The spoke generates an NHRP registration request, which is sent across the GRE over IPsec tunnel.
– The Hub receives the NHRP registration request and sents NHRP registration reply after it confirms that the spoke has a valid tunnel and Nonbroadcast Multiaccess address. The spoke receives this NHRP registration reply.
GRE over IPSec:
1- has a higher MTU
2- is designed to be completely stateless
IPsec VTI:
1- Limited to IP unicast and multicast traffic
2- can use dynamic routing protocol.
@aouas, I filled them both just like you did.
@LULA_PRESO,
good to know that i am on the right way because supermario is wrong on that 2 questions
QUESTION 445 is correct in supermario’s pdf. right?
Also, Clientless SSL VPN – BOOKMARKS lab, is as have been described here and is passleader dump. right?
@aouas,
Regarding the D&D 445, I also believe that the solution showed in Supermarios is correct.
And yes, the Bookmarks lab is pretty easy, even to implement and test in a simple LAB.
I’ve validated SuperMario’s dump and it’s still valid.
I’ll post few more new questions stay connected.
-Varma
Passed with 900+ score. Most questions were in superman file. I answered them as they were listed in pdf. Maybe 2-3 new questions that i didn’t see in the supermario file. Same as bb test was:
Lab:
1. Clienless SSL VPN – BOOKMARKS (HQ-Server is for http, DMZ-Server-FTP is for ftp)
Simlet:
1. ASDM
D&D:
1. Encryption/Authentication
2. DMVPN phase/process (followed supermario’s answer)
3. VPN States (Sanity Check, QM_Idle, MM_NO_STATE, atts not accepted etc)
@just barely
Do you remember the new questions ?
Kindly share your exp. Plan to take exam on mid October. THanks
passed with score 9xx
Most questions were in supermario dump
==============================
D&D: followed supermario’s answer in all
1. Encryption/Authentication
2. DMVPN phase/process
3. VPN States (Sanity Check, QM_Idle etc)
==============
Lab:
1. Clienless SSL VPN – BOOKMARKS
Simlet:
1. ASDM
the questions i remember (supermario dump)
Q261
Q254
Q224
Q220
Hi Luna,
Can you share Supermariodump?
@Japs
(remote the spaces and *)
h tt p s ://od.lk*****/f*****l/MThfMTE2NTQ4NF8
Hi Luna. Thank you
luna IS FAKE FAKE FAKE FAKE
luna IS FAKE FAKE FAKE FAKE /………………..
Passed yesterday 300-209 with 888 points and the limit was 846 points… Mario dump is valid (300-209 448Q SuperMario v4) so hurry people. Almost all questions was from dump.
and forget on fake links… Just Mario dump is enough for passing.
the guy who’s sayin’ im fake should stfu and prolly he is one of scammers that sell dumps lmao
Which command configures IKEv2 symmetric identity authentication?
A. match identity remote address 0.0.0.0
B. authentication local pre-share
C. authentication pre-share
D. authentication remote rsa-sig
B or C?
could anyone share the latest dumps (300-209 448Q SuperMario v4) to my mail {email not allowed}.
Thanks
Belal
Race, please provide me your mail i will send you :-)