2.1 Cisco AnyConnect Client-Based, Remote-Access VPN Technologies on Cisco ASA, Cisco FTD, and Cisco Routers CCIE-SECURITY Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A network architect is designing a remote-access VPN solution using AnyConnect on an ASA. The requirement is to support both SSL and IPsec IKEv2 clients, but the ASA has limited resources. The architect wants to minimize the number of public IP addresses used. Which approach is most efficient?

   • AUse only IPsec IKEv2 and disable SSL to reduce complexity.
   • BUse the same interface and port for both SSL and IPsec IKEv2, with the ASA listening on UDP 500/4500 and TCP 443.
   • CUse a load balancer to distribute traffic between two ASAs, one for SSL and one for IPsec.
   • DUse separate interfaces for SSL and IPsec IKEv2, each with its own public IP.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An FTD device managed by FMC is configured for AnyConnect. The administrator needs to enforce that users from the 'Engineering' AD group get full tunnel access, while 'Contractor' users get split tunneling to only a specific subnet. The AD groups are returned as RADIUS attributes. Which configuration is required on FMC?

   • AConfigure AAA authorization to return a Filter-Id that maps to a group policy.
   • BUse a single group policy with split tunneling enabled for all users.
   • CCreate two tunnel groups and assign users to them based on the AD group.
   • DCreate two group policies and use a dynamic access policy to select the group policy based on the AD group attribute.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An IOS-XE router is configured for AnyConnect with IPsec IKEv2. The router uses a RADIUS server for authentication. The administrator wants to assign a specific access list to the VPN client session based on the RADIUS Filter-Id attribute. Which configuration is required?

   • AUse a dynamic access policy on the router to evaluate the Filter-Id.
   • BConfigure a group policy with the access-list and assign it to all users.
   • CConfigure the RADIUS server to send Filter-Id and map it to an access-list in the AAA authorization configuration.
   • DConfigure the virtual-template interface to apply the access-list.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard · select all that apply

   A company is deploying AnyConnect to a diverse user base. They need to ensure that the client automatically connects to the correct VPN headend based on the user's location, and that split tunneling is configured differently for different user groups. Which two methods can be used to achieve this? (Select all that apply.)

   • ADeploy different profiles to different user groups via MDM or GPO.
   • BUse the ASA/FTD to push different profiles based on the user's group policy.
   • CUse multiple AnyConnect profiles with different server lists and assign them via group policy.
   • DUse a single profile with all servers and rely on the client to select the best one.
   • EUse the AnyConnect profile editor to create a profile with multiple server entries and let the user choose.
   Check answers Discussion Select an answer first
6. 10expert · hard

   An ASA is configured with AnyConnect and DAP. The DAP policy is set to require a specific posture attribute (AVG antivirus) for full access. Users with a different antivirus are denied. The administrator wants to allow users with a different antivirus but restrict them to a limited network. How should the DAP be configured?

   • AUse AAA authorization to restrict access based on AV.
   • BModify the existing DAP rule to allow all users and use group policy to restrict.
   • CDisable DAP and use a single group policy for all users.
   • DCreate a second DAP rule that matches users without the required AV and assigns a restricted ACL.
   Reveal Solution Discussion Select an answer first