100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 640
A shared network administrator credential is confirmed exposed in a ticket attachment. Which immediate account and shared-secret response limits reuse of the compromised access?
- Keep the credential active and only ask users not to share it again
- Change the administrator display name but retain the same leaked secret
- Copy the compromised password into a new private ticket with no rotation
- Disable the account and rotate exposed shared secrets
Explanation
Correct Answer
D:Offboarding removes active credentials and residual shared access.
Incorrect Answers
A:The already-exposed secret remains reusable until it is revoked or rotated.
B:A renamed account with unchanged authentication secret is still compromised.
C:Relocation of the plaintext secret does not revoke attacker knowledge or access.
Question 641
Two IPsec gateways protect traffic between private LAN hosts behind them. The original host-to-host IP header must be protected while a new outer header identifies the two gateways. Which IPsec encapsulation mode fits?
- ESP transport mode, retaining the original host IP header as the exposed outer header
- ESP tunnel mode, encapsulating the entire original IP packet behind a new gateway-to-gateway header
- AH transport mode without encryption of the original IP packet payload
- An ordinary GRE tunnel with no IPsec security association
Explanation
Correct Answer
B:ESP tunnel mode protects the original IP datagram and adds a new outer IP header whose endpoints are the IPsec gateways.
Incorrect Answers
A:Transport mode keeps the original IP header rather than encapsulating the whole host packet as required for gateway-to-gateway private LAN tunneling.
C:AH offers authentication/integrity but not the ESP confidentiality requirement, and transport mode leaves the host header exposed.
D:A plain GRE tunnel encapsulates packets but supplies no IPsec encryption or authenticated security association by itself.
Question 642
A traveling engineer connects from a hotel network and must securely access authorized intranet systems as an individual user, rather than establish a permanent gateway-to-gateway site tunnel. Which remote-access VPN topology fits?
- Deploy a permanent site-to-site IPsec tunnel between two offices for one roaming person
- Use unencrypted Telnet to the internal applications over the hotel network
- Use a supported remote-access VPN client and gateway
- Extend the corporate access VLAN across the public hotel LAN
Explanation
Correct Answer
C:A remote-access VPN terminates an authenticated tunnel for a single roaming endpoint, allowing access to approved internal resources. It differs from a permanent site-to-site gateway tunnel that represents entire office subnets.
Incorrect Answers
A:Gateway-to-gateway VPNs join fixed networks; the question requests individual remote-user access from changing hotel locations.
B:Telnet does not provide confidentiality/authentication for the remote engineer’s intranet access.
D:Layer 2 bridging into an untrusted hotel network is neither a practical nor secure remote-user VPN design.
Question 643
A site-to-site IPsec tunnel traverses the public Internet and must encrypt user payloads inside the negotiated IPsec security association. Which ESP confidentiality protection supplies that encryption?
- Use IKE preshared credentials alone as the per-packet user-payload cipher
- Use IPsec ESP encryption with a suitable cipher suite
- Use only IPsec AH integrity/authentication without an ESP confidentiality transform
- Use the remote-access client login password itself to encrypt every data packet independently of ESP
Explanation
Correct Answer
B:IPsec ESP can encrypt the protected data and optionally provide integrity protection using the configured security association. IKE establishes the necessary parameters and keys but is not itself the packet encryption payload mechanism.
Incorrect Answers
A:IKE peer credentials authenticate or establish keying material; they do not by themselves apply payload encryption to each transit data packet.
C:IPsec AH can authenticate packet contents and integrity but does not provide confidentiality. Encrypting the payload requires an ESP encryption transform.
D:Remote-access account authentication does not replace the negotiated ESP security association and cipher used for transit payload confidentiality.
Question 644
Two IPsec gateways have compatible traffic selectors but their IKE negotiation fails authentication of the remote peer. Which IKE peer-identity/authentication mechanism should be configured consistently?
- Use IKE with appropriate peer authentication
- Replace IPsec ESP with an unencrypted GRE tunnel without IKE authentication
- Change only the NAT pool allocation while retaining invalid IKE credentials
- Permit any peer identity and disable IKE authentication validation
Explanation
Correct Answer
A:IKE establishes cryptographic parameters and authenticated security associations.
Incorrect Answers
B:GRE encapsulation alone does not authenticate remote IPsec peers or protect the required tunnel.
C:NAT address allocation does not repair peer-authentication mismatch in IKE negotiation.
D:Accepting unauthenticated peers defeats the required secure IPsec gateway trust model.
Question 645
An IKE peer-authentication policy disallows shared secrets and requires centrally issued, revocable identities for each branch VPN gateway. Which credential model satisfies that stated authentication policy?
- The same pre-shared password installed on every branch gateway
- A CA-issued certificate and corresponding private key uniquely held by each gateway
- An IPsec ESP encryption algorithm with no identity credential
- The external public IP address of the gateway with no cryptographic identity proof
Explanation
Correct Answer
B:Unique certificates let IKE authenticate gateway identities with cryptographic proof and allow certificate lifecycle or revocation controls.
Incorrect Answers
A:A shared PSK violates the explicit no-shared-secrets policy and makes per-gateway revocation difficult.
C:ESP protects data-plane packets but an encryption algorithm alone does not authenticate the IKE peer identity.
D:An IP address identifies a packet source or endpoint but does not establish ownership of a cryptographic VPN identity.
Question 646
A site-to-site ESP/IPsec tunnel carries otherwise valid near-1500-byte IPv4 packets, but only large transfers fail after the tunnel is deployed. The underlay path has an MTU of 1500 bytes and smaller packets pass. What is the most direct protocol reason to investigate?
- IPsec ESP tunnel encapsulation adds headers and trailers, so formerly fitting packets may exceed the effective path MTU
- IKEv2 always replaces IPv4 with a fixed 128-byte IPv6-only outer header
- IPsec automatically turns all TCP streams into multicast UDP traffic
- A correctly configured ESP tunnel removes all packet overhead compared with the clear-text route
Explanation
Correct Answer
A:ESP tunnel mode adds a new outer IP header plus protection overhead; effective usable inner packet size falls and large packets may fragment or be dropped depending on DF and PMTUD handling.
Incorrect Answers
B:IKEv2 controls negotiation and does not mandate an IPv6-only outer header or the fixed overhead claimed here.
C:ESP protects the existing IP traffic rather than silently converting TCP sessions to UDP multicast transport.
D:Tunnel mode does not make headers disappear; it introduces additional bytes around protected payloads, which is the MTU issue in the stem.
Question 647
A remote-access VPN company policy requires corporate-internal prefixes to use the encrypted VPN, while ordinary public-Internet browsing must leave directly via the employee’s local Internet connection. What remote-access traffic-selection design implements this policy?
- Full tunneling, sending the client’s corporate and Internet traffic to the VPN headend
- Split tunneling, with only defined corporate destinations included in protected VPN routes
- Site-to-site gateway tunneling that does not permit a remote-access endpoint
- Disabling VPN data encryption for both internal and external traffic
Explanation
Correct Answer
B:Split tunneling selects specified internal routes for encryption while other Internet destinations remain outside the tunnel, subject to the enterprise’s explicitly configured policy.
Incorrect Answers
A:Full tunneling directs normal Internet traffic back through the headend too, contrary to the stated local-breakout requirement.
C:Site-to-site mode connects gateway-managed sites but does not implement the requested endpoint traffic-selection rules.
D:Disabling encryption would remove protection for the corporate networks that policy explicitly requires inside the tunnel.
Question 648
An encrypted VPN must also detect forged or altered IPsec packets rather than only hiding payload content. Which integrity and origin-authentication protections are relevant to ESP/IPsec?
- Use ESP encryption alone and disable integrity/anti-replay checking
- Use only IP routing checksum/TTL to authenticate VPN endpoints
- Use IPsec integrity and authentication protections
- Use an unprotected GRE header and assume tunnel encapsulation proves identity
Explanation
Correct Answer
C:Integrity checks detect alteration and protect against unauthenticated injection.
Incorrect Answers
A:Confidentiality by itself does not detect forged or replayed packets as required.
B:Normal IP forwarding checks are not cryptographic integrity or origin authentication.
D:GRE encapsulation is not an IPsec authenticity/integrity mechanism.
Question 649
After establishing a Cisco IOS site-to-site IKEv2 VPN, an engineer needs to verify whether the IKEv2 negotiation security association is established. Packet ESP counters are a separate data-plane check. Which command directly shows the IKEv2 SA state?
- show crypto ikev2 sa
- show crypto ipsec sa
- show ip route ospf
- show interfaces trunk
Explanation
Correct Answer
A:The IKEv2 SA display reports the key-management control-plane association state and whether negotiation is active.
Incorrect Answers
B:The IPsec SA display describes child/data-plane protection associations and counters, not the specific IKEv2 management SA requested.
C:The OSPF routing table lists routing reachability learned via OSPF and does not inspect cryptographic key-exchange state.
D:The trunk interface display reports switched VLAN membership and cannot establish VPN IKE state.
Question 650
An IPsec site tunnel should protect traffic between 10.10.0.0/16 and 172.16.0.0/16, but not all Internet traffic. Which mirrored selector/route policy defines this permitted protected flow scope?
- Set a universal 0.0.0.0/0 to 0.0.0.0/0 selector for every Internet flow
- Use a source selector of 10.10.0.0/8 rather than the approved /16
- Define the protected traffic selectors and routing policy
- Create selectors for only one direction and omit reciprocal peer configuration
Explanation
Correct Answer
C:IPsec protects the traffic that matches its configured tunnel selectors and routing.
Incorrect Answers
A:This would include unrelated public traffic instead of only the two authorized protected subnets.
B:That is a much broader private network and would include unapproved site traffic.
D:Site-to-site policy must agree on the intended bidirectional protected traffic between the two endpoints.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
