2.1 Cisco AnyConnect Client-Based, Remote-Access VPN Technologies on Cisco ASA, Cisco FTD, and Cisco Routers CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard · select all that apply

   An FTD device is managed by FMC. The security team wants to implement a DAP that grants full access only if the user is in the 'FullAccess' AD group and the device posture is compliant. Otherwise, the user should be placed in a quarantine network. Which of the following are required to implement this? (Select all that apply.)

   • AConfigure a DAP that checks both AD group and posture attributes.
   • BConfigure an LDAP server for authentication and retrieve AD group membership.
   • CEnable posture assessment on the AnyConnect client.
   • DConfigure a RADIUS server for authentication.
   • ECreate a group policy for quarantine with restricted access.
   Check answers Discussion Select an answer first
2. 27expert · medium

   An IOS-XE router is configured for AnyConnect SSL VPN. Users report that they can connect but cannot access internal resources. The router has a virtual-template interface with an IP pool of 192.168.1.0/24. The internal network is 10.0.0.0/8. The router has a static route to 10.0.0.0/8 via the inside interface. What is the most likely issue?

   • AThe router is not performing NAT for VPN traffic.
   • BThe virtual-template interface is not in the same subnet as the internal network.
   • CThe group policy does not have split tunneling configured to include the internal network.
   • DThe router's firewall is blocking traffic from the VPN pool.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company has multiple ASAs in different locations. They want to load balance AnyConnect connections across these ASAs. They also want to ensure that if one ASA fails, users are automatically redirected to another. Which solution should they implement?

   • AUse DNS round-robin with a single public IP.
   • BConfigure VPN load balancing on each ASA using a cluster.
   • CUse a third-party load balancer with health checks.
   • DConfigure AnyConnect to use multiple profiles with different server addresses.
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   An administrator is troubleshooting an AnyConnect connection issue. The user can connect but immediately disconnects. The ASA logs show 'SSL certificate verification failed' errors. What is the most likely cause?

   • AThe ASA's certificate is expired or not trusted by the client.
   • BThe ASA is configured with the wrong tunnel group.
   • CThe client's AnyConnect version is outdated.
   • DThe user's credentials are incorrect.
   Reveal Solution Discussion Select an answer first
6. 30application · hard

   An organization is migrating from ASA to FTD with FMC. They need to configure AnyConnect remote-access VPN for employees. The security policy requires that only users who are members of the 'VPN-Allowed' AD group can connect, and they must use two-factor authentication. Which configuration steps are required on FMC?

   • AConfigure a remote-access VPN with AAA server for RADIUS, enable AnyConnect client, and set the group policy to require two-factor authentication.
   • BConfigure a remote-access VPN with AAA server for LDAP, set the authentication method to 'AAA Only', and create a dynamic access policy that checks AD group membership.
   • CConfigure a remote-access VPN with AAA server for LDAP, set the authentication method to 'AAA Only', and configure the LDAP attribute map to map the 'memberOf' attribute to the 'IETF-Radius-Class' attribute for authorization.
   • DConfigure a remote-access VPN with AAA server for RADIUS, enable AnyConnect client, and create a DAP that checks the device posture.
   Reveal Solution Discussion Select an answer first