- (Exam Topic 1)
A network engineer is configuring DMVPN and entered the crypto isakmp key cisc0380739941 address 1.1.1.1 command on hostA. The tunnel is not being established to hostB. What action is needed to authenticate the VPN?

1. A. Change isakmp to ikev2 in the command on hostA.
2. B. Enter the command with a different password on hostB.
3. C. Enter the same command on hostB.
4. D. Change the password on hostA to the default password.

Correct Answer: C

- (Exam Topic 3)
A small organization needs to reduce the VPN bandwidth load on their headend Cisco ASA in order to
ensure that bandwidth is available for VPN users needing access to corporate resources on the10.0.0.0/24 local HQ network. How is this accomplished without adding additional devices to the
network?

1. A. Use split tunneling to tunnel traffic for the 10.0.0.0/24 network only.
2. B. Configure VPN load balancing to distribute traffic for the 10.0.0.0/24 network,
3. C. Configure VPN load balancing to send non-corporate traffic straight to the internet.
4. D. Use split tunneling to tunnel all traffic except for the 10.0.0.0/24 network.

Correct Answer: A

- (Exam Topic 3)
In which scenario is endpoint-based security the solution?

1. A. inspecting encrypted traffic
2. B. device profiling and authorization
3. C. performing signature-based application control
4. D. inspecting a password-protected archive

Correct Answer: C

- (Exam Topic 3)
An organization is selecting a cloud architecture and does not want to be responsible for patch management of the operating systems. Why should the organization select either Platform as a Service or Infrastructure as a Service for this environment?

1. A. Platform as a Service because the customer manages the operating system
2. B. Infrastructure as a Service because the customer manages the operating system
3. C. Platform as a Service because the service provider manages the operating system
4. D. Infrastructure as a Service because the service provider manages the operating system

Correct Answer: C

- (Exam Topic 1)
An administrator wants to ensure that all endpoints are compliant before users are allowed access on the corporate network. The endpoints must have the corporate antivirus application installed and be running the latest build of Windows 10.
What must the administrator implement to ensure that all devices are compliant before they are allowed on the network?

1. A. Cisco Identity Services Engine and AnyConnect Posture module
2. B. Cisco Stealthwatch and Cisco Identity Services Engine integration
3. C. Cisco ASA firewall with Dynamic Access Policies configured
4. D. Cisco Identity Services Engine with PxGrid services enabled

Correct Answer: A