A government agency uses GETVPN over a private WAN. The agency requires that all traffic be encrypted, but also needs to use network monitoring tools that rely on the original source and destination IP addresses. The agency is concerned about key compromise and wants to ensure that a compromised key does not expose past traffic. Which combination of GETVPN features should be used?

DMVPN with spoke-to-spoke tunnels

ESP with null encryption and anti-replay

When would a client-based SSL VPN be more appropriate than a clientless SSL VPN?

When the user needs access to a full network layer connection, such as a remote desktop or a non-web application.

When the user only needs to access a single web-based email portal.

When the organization wants to support only browser-based access.

When the user wants to avoid installing any software on their device.

A utility company runs a SCADA network that uses multicast for real-time telemetry between multiple sites. The sites are connected over a private MPLS WAN. The security team needs to encrypt the multicast traffic without changing the multicast routing behavior or adding per-tunnel overhead. Which VPN technology is best suited?

DMVPN with spoke-to-spoke tunnels

Which statement best describes the purpose of a Virtual Tunnel Interface (VTI) in a site-to-site VPN deployment?

It is a virtual router that performs NAT before encryption.

It is a software client that establishes a remote access VPN from an end-user device.

It creates a logical interface that routes encrypted traffic through an IPsec tunnel without requiring a crypto map.

It provides a physical interface that connects directly to the ISP for the VPN tunnel.

A regional bank operates 120 branch offices that each connect to a central data center. The bank expects to add 30 new branches per year and frequently needs to open direct branch-to-branch communication for temporary audit sessions. The network team wants to avoid configuring static peer statements on every router whenever a new branch is added. Which VPN deployment should the team choose?

DMVPN with a hub-and-spoke topology and dynamic spoke-to-spoke tunnels

Site-to-site IPsec with static crypto maps on each branch router

FlexVPN with a full-mesh of static IKEv2 profiles

GETVPN with a group key server and multicast-enabled spokes

CiscoCertified Network Professional Security

Domain 1Objective 6

1.6 Describe Site-To-Site and Remote Access VPN Deployment Types Such as Virtual Tunnel Interfaces, Standards-Based IPsec, SSL VPN, DMVPN, FlexVPN, and GETVPN 350-701 Practice Questions (Page 5)

Part of the Security Concepts domain, which accounts for 20% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

20%of the exam

Questions 21–25

21expert · hard
A government agency uses GETVPN over a private WAN. The agency requires that all traffic be encrypted, but also needs to use network monitoring tools that rely on the original source and destination IP addresses. The agency is concerned about key compromise and wants to ensure that a compromised key does not expose past traffic. Which combination of GETVPN features should be used?
Select an answer first
22foundation · easy
When would a client-based SSL VPN be more appropriate than a clientless SSL VPN?
Select an answer first
23application · medium
A utility company runs a SCADA network that uses multicast for real-time telemetry between multiple sites. The sites are connected over a private MPLS WAN. The security team needs to encrypt the multicast traffic without changing the multicast routing behavior or adding per-tunnel overhead. Which VPN technology is best suited?
Select an answer first
24foundation · easy
Which statement best describes the purpose of a Virtual Tunnel Interface (VTI) in a site-to-site VPN deployment?
Select an answer first
25application · medium
A regional bank operates 120 branch offices that each connect to a central data center. The bank expects to add 30 new branches per year and frequently needs to open direct branch-to-branch communication for temporary audit sessions. The network team wants to avoid configuring static peer statements on every router whenever a new branch is added. Which VPN deployment should the team choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

1.6 Describe Site-To-Site and Remote Access VPN Deployment Types Such as Virtual Tunnel Interfaces, Standards-Based IPsec, SSL VPN, DMVPN, FlexVPN, and GETVPN 350-701 Practice Questions (Page 5)

Questions 21–25

When would a client-based SSL VPN be more appropriate than a clientless SSL VPN?

Which statement best describes the purpose of a Virtual Tunnel Interface (VTI) in a site-to-site VPN deployment?

Keep studying — Security Concepts