A security engineer is configuring an ASA cluster for remote-access VPN. They want to ensure that if a cluster member fails, the VPN sessions that were on that member are immediately taken over by another member. What feature of ASA clustering enables this?

Stateful failover with connection replication

In a dual-hub DMVPN configuration, a spoke must be able to reach both hubs for redundancy. How should the spoke's NHRP configuration be set up?

Configure NHRP server mappings for both hubs

Configure only one hub as NHRP server

A dual-hub DMVPN network uses EIGRP for routing. After a hub failure, spokes converge to the other hub, but some spokes are still sending traffic through the failed hub's path. What is the most likely cause?

The routing protocol is not running on the backup hub

EIGRP hold timers have not expired on those spokes

The spokes are not configured with both hub addresses

An ASA cluster is experiencing uneven load distribution for remote-access VPN sessions. The cluster has four members, but one member is handling 70% of the sessions. The administrator suspects the load-balancing algorithm is not optimal. What should they do to improve distribution?

Change the load-balancing algorithm to a hash based on source IP

Add more members to the cluster

Disable clustering and use Active/Standby

Increase the control link bandwidth

CCIE Security

Domain 2Objective 4

2.4 VPN High Availability Methods CCIE-SECURITY Practice Questions (Page 8)

Part of the 2.0 Secure Connectivity and Segmentation domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

7concepts

20%of the exam

Questions 36–40

36application · medium
A security engineer is configuring an ASA cluster for remote-access VPN. They want to ensure that if a cluster member fails, the VPN sessions that were on that member are immediately taken over by another member. What feature of ASA clustering enables this?
Select an answer first
37application · medium
A company is implementing dual-hub DMVPN to provide redundancy for branch offices. They also want to ensure that traffic between branches takes the most direct path. Which feature should be enabled to achieve this?
Select an answer first
38application · medium
In a dual-hub DMVPN configuration, a spoke must be able to reach both hubs for redundancy. How should the spoke's NHRP configuration be set up?
Select an answer first
39expert · hard
A dual-hub DMVPN network uses EIGRP for routing. After a hub failure, spokes converge to the other hub, but some spokes are still sending traffic through the failed hub's path. What is the most likely cause?
Select an answer first
40expert · hard
An ASA cluster is experiencing uneven load distribution for remote-access VPN sessions. The cluster has four members, but one member is handling 70% of the sessions. The administrator suspects the load-balancing algorithm is not optimal. What should they do to improve distribution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.