Chapter 7

1.

1 point

Which three items can be specified by ISAKMP policy parameters? (Choose three.)

the encapsulation method to be used

the hashing method to be used

the ACL that is used to identify interesting traffic

the amount of time the crypto interface should be active before being renegotiated

the encryption method to be used

the authentication method to be used

2.

1 point

Refer to the exhibit. A network administrator is tuning IPsec to encapsulate the GRE tunnel between R1 and R2.Assuming all other IPsec configurations are correct, which two crypto map access lists will complete this task?(Choose two.)

R2(config-ext-nacl)# permit gre host 209.165.202.129 host 64.100.32.1

R1(config-ext-nacl)# permit gre host 172.16.248.1 host 172.16.248.2

R1(config-ext-nacl)# permit gre host 209.165.202.129 host 64.100.32.1

R2(config-ext-nacl)# permit gre host 172.16.248.2 host 172.16.248.1

R2(config-ext-nacl)# permit gre host 64.100.32.1 host 209.165.202.129

3.

1 point

Which three protocols are involved in the establishment of an IPsec VPN tunnel? (Choose three.)

Generic Routing Encapsulation (protocol 47)

Internet Security Association and Key Management Protocol (TCP port 500)

Authentication Header (protocol 51)

Internet Security Association and Key Management Protocol (UDP port 500)

Encapsulating Security Protocol (protocol 50)

Tunnel Profile (TCP port 604)

4.

1 point

How is NAT tuned to handle traffic that is sent through a VPN tunnel between a mobile worker and internalcorporate resources?

Traffic should bypass translation with a deny access list statement or route-map.

Traffic should bypass translation with a permit access list statement or route-map.

Translation is allowed by a deny access list statement or route map.

Translation is allowed by a permit access list statement or route map.

5.

1 point

Which two solutions can a hybrid fiber cable service provider apply when there is constant congestion on theline? (Choose two.)

Allocate less bandwidth to affected customers.

Run fiber to each home.

Run fiber deeper into the neighborhood.

Allocate another downstream channel

Allocate another upstream channel

6.

1 point

Refer to the exhibit. Which two statements are true about the exhibited static routes? (Choose two.)

If a route to 10.0.0.0/8 is received via RIP, R1 will prefer the dynamic route over both configured staticroutes.

If a route to 10.0.0.0/8 is received via RIP, both static routes will appear in the routing table

If no dynamic route to 10.0.0.0/8 exists, both static routes will appear in the R1 routing table.

The static route to 10.0.0.0/8 via 1.1.1.1 will be preferred to the route via 2.2.2.2.

If no dynamic route to 10.0.0.0/8 exists, R1 will use 2.2.2.2 as the next hop because it has a higherpreference.

7.

1 point

Which two UDP ports must be permitted inbound through the Internet-facing interface on a firewall to establishan IPsec tunnel and NAT-T? (Choose two.)

51

22

500

4500

50

8.

1 point

Which two statements are correct about IPsec crypto maps? (Choose two.)

Packets that do not meet the criteria as specified in the crypto map are dropped.

The crypto map is applied to the inbound interface that receives the packets before being transmitted overthe VPN tunnel.

The crypto map is applied to the outbound interface that the router is peering with

A crypto map is used to negotiate and exchange authentication and encryption parameters with its peer.

The crypto map defines the IPsec tunnel endpoint or peer.

9.

1 point

Refer to the exhibit. A network administrator is configuring NAT on router Remote. The configuration should allow users on network 172.16.16.0/21 to access Internet sites as well as resources on the HQ LAN network 172.16.0.0/21 through the VPN tunnel. How should the administrator configure access list 101 to accomplishthis task?

Remote(config)# access-list 101 deny 172.16.16.0 0.0.7.255 172.16.0.0 0.0.7.255 Remote(config)# access-list 101 permit ip 172.16.16.0 0.0.7.255 any

Remote(config)# access-list 101 permit ip 172.16.16.0 0.0.7.255 any Remote(config)# access-list 101 deny 172.16.0.0 0.0.7.255 172.16.16.0 0.0.7.255

Remote(config)# access-list 101 permit ip 172.16.16.0 0.0.7.255 any Remote(config)# access-list 101 deny 172.16.16.0 0.0.7.255 172.16.0.0 0.0.7.255

Remote(config)# access-list 101 deny 172.16.16.0 0.0.7.255 any Remote(config)# access-list 101 permit ip 172.16.16.0 0.0.7.255 an

Remote(config)# access-list 101 deny 172.16.16.0 0.0.7.255 209.165.202.129 0.0.0.3 Remote(config)# access-list 101 permit ip 172.16.16.0 0.0.7.255 any

10.

1 point

What is a limitation of IPsec by design?

IPsec only forwards unicast traffic.

IPsec does not support encryption for traffic over a GRE tunnel.

IPsec forwards unicast and multicast traffic, but not broadcast traffic.

IPsec tunneling does not support the encapsulation of RFC 1918 addresses.

11.

1 point

Branch office network design faces several challenges. Which of these challenges has the goal of obtainingcentralized control of network security and management?

bandwidth and network requirements

deployment plan

management costs

mobility

consolidated data centers

12.

1 point

Which is a clientless VPN solution for mobile workers?

SSH

IPSec

GRE

SSL

13.

1 point

Refer to the exhibit. Based on the partial configuration that is shown, which static route would be the primarydefault path?

ip route 0.0.0.0 0.0.0.0 212.68.6.1 70

ip route 0.0.0.0 0.0.0.0 192.68.6.1 50

ip route 0.0.0.0 0.0.0.0 172.16.20.2 40

ip route 0.0.0.0 0.0.0.0 202.16.20.2 60

14.

1 point

What are three characteristics of broadband access? (Choose three.)

enhanced voice and video services

built-in security

high-speed access

always on

wide area of coverage

guaranteed quality of service

15.

1 point

In the routing design for a branch office, which area will have an affect on convergence, load balancing, andscalability

service mix

resiliency

routing protocols

connectivity technologies

security and compliance

mobility requirements

16.

1 point

Refer to the exhibit. A network administrator has configured a GRE tunnel between R1 and R2 as shown. Aftercompleting the tunnel configurations, the administrator notices that the tunnel interfaces on both routers aredown. All other interfaces are up and the pings through the ISP to the serial interface of each router aresuccessful. What is the cause of the problem?

Tunnel destination configurations are incorrect.

Tunnel source configurations are incorrect.

The MTU size has not been increased to 1492.

GRE IP encapsulation has not been configured.

17.

1 point

Which statement is true about the deployment of Context-Based Access Control (CBAC) and Zone-BasedFirewall (ZBF)?

They cannot be deployed on the same router.

They can be deployed on the same interface but not in the same direction.

They can be deployed on the same router but not on the same interface.

They can be deployed on the same interface but cannot filter the same protocol.

18.

1 point

Which is a Cisco IOS firewall solution that relies on access control lists?

Zone-Based Firewall (ZBF

Context-Based Access Control (CBAC)

Cisco Easy VPN server

Cisco Security Manager

19.

1 point

Which IPsec service verifies that the data was not altered during transmission?

confidentiality

encryption

encapsulation

integrity

authorization

20.

1 point

Which three statements would help an end user develop a better understanding of DSL technology? (Choosethree.)

DSL is available in any location that has a telephone.

Transfer rates vary by the length of the local loop.

DSL data subscribers are connected to a network segment, all sharing the upstream and downstreambandwidth.

ADSL typically has a higher download bandwidth than available upload bandwidth.

All varieties of DSL provide the same bandwidth, although they use different technologies to achieve uploadand download.

DSL speeds can exceed the speeds available with a typical T1 line.