2.1 Cisco AnyConnect Client-Based, Remote-Access VPN Technologies on Cisco ASA, Cisco FTD, and Cisco Routers CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company has multiple ASAs in different geographic regions. They want to provide AnyConnect access with the best performance and high availability. They also need to ensure that if one ASA fails, users can connect to another. Which solution is most appropriate?

   • AConfigure all ASAs in a single cluster with a shared virtual IP.
   • BSet up a VPN load balancer in each region and use DNS round-robin.
   • CDeploy a global server load balancer (GSLB) that directs users to the nearest ASA and monitors availability.
   • DUse AnyConnect client profile with multiple server entries and rely on the client to failover.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization is migrating from ASA to FTD and needs to configure AnyConnect remote access. They require that users authenticate against Active Directory and that only users in the 'VPN-Allowed' AD group receive full tunnel access, while others are denied. The FTD is managed by FMC. Which configuration steps are required?

   • AConfigure a RADIUS server and a dynamic access policy that allows all authenticated users full tunnel access.
   • BConfigure LDAP directly on the FTD and create a group policy that maps the AD group to the full tunnel access.
   • CUse local authentication on the FTD and create a user account for each VPN user, then assign the full tunnel group policy to those users.
   • DCreate a RADIUS server object pointing to the AD server, configure an AnyConnect VPN profile, and set the authentication method to RADIUS. Then create a dynamic access policy that checks the AD group membership and assigns the appropriate tunnel policy.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A user is experiencing intermittent disconnects with AnyConnect. The ASA logs show 'DTLS session terminated' errors. The user is on a network that blocks UDP. What is the most likely cause and solution?

   • AThe AnyConnect client is outdated; upgrade the client.
   • BThe user's account is locked; reset the password.
   • CDTLS is being blocked by the network; disable DTLS on the ASA or configure the client to fall back to SSL.
   • DThe ASA's SSL certificate is expired; renew the certificate.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network engineer is configuring AnyConnect on a Cisco IOS-XE router for a small remote workforce. The router will terminate IPsec IKEv2 VPN sessions. The engineer needs to define the IP address pool and DNS servers for the VPN clients. Which configuration component is used to specify these parameters?

   • AA AAA authentication list that references a RADIUS server for address assignment.
   • BThe crypto ikev2 profile configuration that includes the pool and DNS settings.
   • CAn IP local pool and a group policy or AAA server that provides DNS and other attributes.
   • DA virtual-template interface with an IP address and a pool definition.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company wants to deploy AnyConnect to its employees with a pre-configured profile that automatically selects the correct VPN headend and enables split tunneling for specific routes. The profile should be pushed to clients without manual configuration. Which method should be used?

   • APlace the profile XML file on a web server and have users download it manually.
   • BConfigure the ASA/FTD to deploy the profile via the AnyConnect client profile policy.
   • CUse a DHCP option to deliver the profile to clients.
   • DEmbed the profile in the AnyConnect installer package using the AnyConnect Profile Editor.
   Reveal Solution Discussion Select an answer first