2.1 Cisco AnyConnect Client-Based, Remote-Access VPN Technologies on Cisco ASA, Cisco FTD, and Cisco Routers CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An ASA is configured for AnyConnect with AAA authentication against a RADIUS server. The administrator wants to assign different VPN group policies based on the RADIUS attribute 'Class' returned by the server. Which configuration is required on the ASA?

   • AUse the AAA server group to define a default group policy for all users.
   • BConfigure a local user database with group policy assignments for each user.
   • CConfigure the RADIUS server to send the Class attribute and map it to a group policy in the tunnel group configuration.
   • DCreate a dynamic access policy that evaluates the Class attribute and assigns the group policy.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team wants to enforce that AnyConnect users connecting from a managed device (with a specific AnyConnect posture attribute) are granted full access, while unmanaged devices are restricted to a limited network segment. Which feature should be used to implement this dynamic access control?

   • AAAA authorization with RADIUS Filter-Id attribute.
   • BDynamic Access Policies (DAP) that evaluate endpoint attributes and assign access rights.
   • CTunnel groups with different authentication methods.
   • DGroup policies with different split-tunnel settings.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An administrator is configuring AnyConnect on an ASA and needs to ensure that VPN clients receive a specific DNS suffix and use a specific DNS server for internal name resolution. Which configuration element should be modified?

   • AThe AnyConnect client profile on the client machine.
   • BThe interface configuration for the inside interface.
   • CThe tunnel group's default group policy settings.
   • DThe group policy's DNS attributes, including primary DNS and default domain.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A remote user reports that they can access internal resources but cannot reach the internet while connected to the VPN. The VPN is configured with split tunneling to only tunnel internal subnets. What is the most likely cause?

   • AThe group policy has 'split-tunnel-policy' set to 'excludespecified' with the internal subnets listed.
   • BThe DNS server assigned by the VPN is not resolving external domains.
   • CThe split-tunnel network list includes 0.0.0.0/0, causing all traffic to go through the tunnel.
   • DThe client's local route to the internet is removed when the VPN connects.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company has two ASA firewalls in an active/standby failover pair. They want to ensure that AnyConnect VPN sessions are not interrupted if the active unit fails. Which configuration is required?

   • AConfigure the AnyConnect client to reconnect automatically after a failure.
   • BPlace both ASAs in the same tunnel group and use the same IP address.
   • CConfigure the same VPN configuration on both units and enable stateful failover for VPN sessions.
   • DUse a load balancer to distribute VPN connections between the two ASAs.
   Reveal Solution Discussion Select an answer first