A company is deploying AnyConnect on an ASA for a group of contractors. The contractors should only access a specific internal web server (10.10.10.50) and must not have access to other internal subnets. The ASA has a pool of addresses (192.168.10.100-150) for VPN clients. Which configuration approach best meets the requirement?

Create a group policy with split-tunnel policy set to 'Exclude networks listed below' and list all other internal subnets.

Create a group policy with split-tunnel policy set to 'Tunnel networks listed below' and specify the network 10.10.10.0/24.

Create a group policy with split-tunnel policy set to 'Tunnel networks listed below' and specify the host address 10.10.10.50/32.

Create a group policy with split-tunnel policy set to 'Tunnel all traffic' and restrict access via an ACL on the inside interface.

A company wants to integrate AnyConnect with Cisco Umbrella to enforce DNS security for remote users. They have an ASA headend. What is the recommended way to achieve this?

Configure the ASA to redirect DNS traffic to Umbrella via a policy.

Use a DAP to block DNS traffic to non-Umbrella servers.

Configure split tunneling to send all DNS traffic through the VPN to the internal DNS server.

Deploy the Cisco Umbrella AnyConnect module and configure it to use the Umbrella roaming client.

A large enterprise is deploying AnyConnect on a pair of ASAs in active/standby failover. They want to support both SSL and IPsec IKEv2 connections. They also need to ensure that if the active ASA fails, VPN sessions are preserved. Which configuration is required?

Enable SSL only, and configure stateful failover.

Enable IKEv2 only, and configure stateful failover.

Enable SSL on one interface and IKEv2 on another, and configure stateful failover.

Enable both SSL and IKEv2 on the same interface, and configure stateful failover for VPN sessions.

An administrator is troubleshooting slow performance on an AnyConnect VPN that uses SSL. They notice that DTLS is not being used. What is the most likely reason for DTLS not being negotiated?

The ASA is using a self-signed certificate.

The client's firewall is blocking UDP 443.

The ASA is configured with 'ssl encryption' but not 'dtls' enabled.

The group policy has 'ipsec-udp' enabled instead of 'dtls'.

CCIE Security

Domain 2Objective 1

2.1 Cisco AnyConnect Client-Based, Remote-Access VPN Technologies on Cisco ASA, Cisco FTD, and Cisco Routers CCIE-SECURITY Practice Questions (Page 5)

Part of the 2.0 Secure Connectivity and Segmentation domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

15concepts

20%of the exam

15 Concepts in This Objective

AnyConnect Architecture
SSL VPN and IPsec IKEv2 Support
Configuration on Cisco ASA
Configuration on Cisco FTD
Configuration on Cisco Routers
Client Deployment and Profiles
Authentication and Authorization
Dynamic Access Policies (DAP)
Group Policies and Attributes
Split Tunneling and DNS
High Availability and Load Balancing
Troubleshooting AnyConnect VPN
Integration with Security Features
Performance and Optimization
Licensing and Compliance

Questions 21–25

21application · medium
A company is deploying AnyConnect on an ASA for a group of contractors. The contractors should only access a specific internal web server (10.10.10.50) and must not have access to other internal subnets. The ASA has a pool of addresses (192.168.10.100-150) for VPN clients. Which configuration approach best meets the requirement?
Select an answer first
22application · medium
A company wants to integrate AnyConnect with Cisco Umbrella to enforce DNS security for remote users. They have an ASA headend. What is the recommended way to achieve this?
Select an answer first
23application · easy
A company is planning to deploy AnyConnect to 500 remote users. They need to ensure they have the appropriate licensing. Which license is required for AnyConnect Plus?
Select an answer first
24expert · hard
A large enterprise is deploying AnyConnect on a pair of ASAs in active/standby failover. They want to support both SSL and IPsec IKEv2 connections. They also need to ensure that if the active ASA fails, VPN sessions are preserved. Which configuration is required?
Select an answer first
25expert · medium
An administrator is troubleshooting slow performance on an AnyConnect VPN that uses SSL. They notice that DTLS is not being used. What is the most likely reason for DTLS not being negotiated?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

2.1 Cisco AnyConnect Client-Based, Remote-Access VPN Technologies on Cisco ASA, Cisco FTD, and Cisco Routers CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

A company wants to integrate AnyConnect with Cisco Umbrella to enforce DNS security for remote users. They have an ASA headend. What is the recommended way to achieve this?

A company is planning to deploy AnyConnect to 500 remote users. They need to ensure they have the appropriate licensing. Which license is required for AnyConnect Plus?

A large enterprise is deploying AnyConnect on a pair of ASAs in active/standby failover. They want to support both SSL and IPsec IKEv2 connections. They also need to ensure that if the active ASA fails, VPN sessions are preserved. Which configuration is required?

An administrator is troubleshooting slow performance on an AnyConnect VPN that uses SSL. They notice that DTLS is not being used. What is the most likely reason for DTLS not being negotiated?

Keep studying — 2.0 Secure Connectivity and Segmentation