2.1 Cisco AnyConnect Client-Based, Remote-Access VPN Technologies on Cisco ASA, Cisco FTD, and Cisco Routers CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31expert · medium

   An organization wants to enforce that only corporate-managed devices can access the VPN. They use AnyConnect with posture assessment. Which feature should be used to block non-compliant devices?

   • AConfigure a DAP that checks for the presence of a corporate certificate.
   • BUse IPsec IKEv2 with certificate authentication.
   • CConfigure the AnyConnect profile to require a specific version.
   • DUse AAA authentication with RADIUS to verify device compliance.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A network engineer is configuring AnyConnect on an IOS-XE router for a small branch office. They need to provide remote access for 20 users. The router will use a virtual-template interface for the VPN pool. Which configuration is required to allow AnyConnect clients to connect via SSL?

   • AConfigure a virtual-template interface, enable webvpn gateway with SSL, and configure a group policy with the AnyConnect client image and address pool.
   • BConfigure a virtual-template interface, enable IPsec IKEv2, and configure the AnyConnect profile on the client.
   • CConfigure a virtual-template interface with an IP address, enable AAA authentication for VPN users, and configure the AnyConnect profile on the router.
   • DConfigure a virtual-template interface, enable AAA authentication, and set the address pool on the virtual-template.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An organization wants to deploy AnyConnect to all employees with a pre-configured profile that automatically connects to the VPN and uses split tunneling to exclude local LAN traffic. They have an ASA headend. Which method should be used to deploy the profile?

   • AEmail the profile XML file to each user and instruct them to place it in the AnyConnect configuration folder.
   • BConfigure the ASA to host the profile and set the group policy to push the profile to clients upon connection.
   • CUse a third-party MDM to push the profile to mobile devices only.
   • DPlace the profile XML file on a web server and have users manually import it into AnyConnect.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company is setting up AnyConnect on an ASA. They want to use RADIUS authentication against their existing Cisco ISE, and also want to assign different group policies based on the RADIUS class attribute. Which configuration is necessary on the ASA?

   • AConfigure a RADIUS server group, enable authentication, and create a separate tunnel group for each group policy, then use a DAP to assign the correct one.
   • BConfigure a RADIUS server group, enable authentication, and create a dynamic access policy that checks the class attribute.
   • CConfigure a RADIUS server group, enable authentication, and set the 'group-lookup' feature to use the class attribute for tunnel-group selection.
   • DConfigure a RADIUS server group, enable authentication, and use the 'ldap-attribute-map' to map the class attribute to a group policy.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An organization wants to enforce different VPN access policies based on the user's device posture. For example, if the device has antivirus running, the user should get full access; otherwise, they should be restricted to a quarantine network. Which feature should be used on the ASA?

   • AGroup policy with split tunneling
   • BAnyConnect profile with VPN filtering
   • CAAA authentication with RADIUS
   • DDynamic Access Policy (DAP)
   Reveal Solution Discussion Select an answer first