The Secret of cisco ccnp security 300-209 simos

It is impossible to pass Cisco 300-209 exam without any help in the short term. Come to {brand} soon and find the most advanced, correct and guaranteed Cisco 300-209 practice questions. You will get a surprising result by our Rebirth Implementing Cisco Secure Mobility Solutions (SIMOS) practice guides.

2016 Oct 300-209 Study Guide Questions:

Q101. A company needs to provide secure access to its remote workforce. The end users use public kiosk computers and a wide range of devices. They will be accessing only an internal web application. Which VPN solution satisfies these requirements? 

A. Clientless SSLVPN 

B. AnyConnect Client using SSLVPN 

C. AnyConnect Client using IKEv2 

D. FlexVPN Client 

E. Windows built-in PPTP client 

Answer: A 

Q102. What are two benefits of DMVPN Phase 3? (Choose two.) 

A. Administrators can use summarization of routing protocol updates from hub to spokes. 

B. It introduces hierarchical DMVPN deployments. 

C. It introduces non-hierarchical DMVPN deployments. 

D. It supports L2TP over IPSec as one of the VPN protocols. 

Answer: A,B 

Q103. A company has decided to migrate an existing IKEv1 VPN tunnel to IKEv2. Which two are valid configuration constructs on a Cisco IOS router? (Choose two.) 

A. crypto ikev2 keyring keyring-name 

peer peer1 


pre-shared-key local key1 

pre-shared-key remote key2 

B. crypto ikev2 transform-set transform-set-name 

esp-3des esp-md5-hmac 

esp-aes esp-sha-hmac 

C. crypto ikev2 map crypto-map-name 

set crypto ikev2 tunnel-group tunnel-group-name 

set crypto ikev2 transform-set transform-set-name 

D. crypto ikev2 tunnel-group tunnel-group-name 

match identity remote address 

authentication local pre-share 

authentication remote pre-share 

E. crypto ikev2 profile profile-name 

match identity remote address 

authentication local pre-share 

authentication remote pre-share 

Answer: A,E 

300-209  practice test

Renovate 300-209 simos books:

Q104. Which Cisco firewall platform supports Cisco NGE? 


B. Cisco ASA 5505 

C. Cisco ASA 5580 

D. Cisco ASA 5525-X 

Answer: D 

Q105. Refer to the exhibit. 

Which type of VPN implementation is displayed? 

A. IKEv2 reconnect 

B. IKEv1 cluster 

C. IKEv2 load balancer 

D. IKEv1 client 

E. IPsec high availability 

F. IKEv2 backup gateway 

Answer: C 

Q106. In DMVPN phase 2, which two EIGRP features need to be disabled on the hub to allow spoke-to-spoke communication? (Choose two.) 

A. autosummary 

B. split horizon 

C. metric calculation using bandwidth 

D. EIGRP address family 

E. next-hop-self 

F. default administrative distance 

Answer: B,E

Accurate 300-209 burner:



You are the network security administrator for your organization. Your company is growing and a remote branch office is being created. You are tasked with configuring your headquarters Cisco ASA to create a site-to-site IPsec VPN connection to the branch office Cisco ISR. The branch office ISR has already been deployed and configured and you need to complete the IPsec connectivity configurations on the HQ ASA to bring the new office online. 

Use the following parameters to complete your configuration using ASDM. For this exercise, not all ASDM screens are active. 

. Enable IKEv1 on outside I/F for Site-to-site VPN 

. Add a Connection Profile with the following parameters: 

. Peer IP: 

. Connection name: 

. Local protected network: 

. Remote protected network: 

. Group Policy Name: use the default policy name supplied 

. Preshared key: cisco 

. Disable IKEv2 

. Encryption Algorithms: use the ASA defaults 

. Disable pre-configured NAT for testing of the IPsec tunnel 

. Disable the outside NAT pool rule 

. Establish the IPsec tunnel by sending ICMP pings from the Employee PC to the Branch Server at IP address 

. Verify tunnel establishment in ASDM VPN Statistics> Sessions window pane 

You have completed this exercise when you have successfully configured, established, and verified site-to-site IPsec connectivity between the ASA and the Branch ISR. 


Answer: Review the explanation for detailed answer steps. 


First, click on Configuration ->Site-to-Site VPN to bring up this screen: 

Click on “allow IKE v1 Access” for the outside per the instructions as shown below: 

Then click apply at the bottom of the page. This will bring up the following pop up message: 

Click on Send. 

Next, we need to set up the connection profile. From the connection profile tab, click on “Add” 

Then, fill in the information per the instructions as shown below: 

Hit OK and you should see this: 

To test this, we need to disable NAT. Go to Configuration -> Firewall -> NAT rules and you should see this: 

Click on Rule 1 to get the details and you will see this: 

We need to uncheck the “Enable rule” button on the bottom. It might also be a good idea to uncheck the “Translate DNS replies that match the rule” but it should not be needed. Then, go back to the topology: 

Click on Employee PC, and you will see a desktop with a command prompt shortcut. Use this to ping the IP address of and you should see replies: 

We can also verify by viewing the VPN Statistics -> Sessions and see the bytes in/out incrementing as shown below: 

Q108. Which option describes the purpose of the command show derived-config interface virtual-access 1? 

A. It verifies that the virtual access interface is cloned correctly with per-user attributes. 

B. It verifies that the virtual template created the tunnel interface. 

C. It verifies that the virtual access interface is of type Ethernet. 

D. It verifies that the virtual access interface is used to create the tunnel interface. 

Answer: A 

Q109. Which three configuration parameters are mandatory for an IKEv2 profile? (Choose three.) 

A. IKEv2 proposal 

B. local authentication method 

C. match identity or certificate 

D. IKEv2 policy 

E. PKI certificate authority 

F. remote authentication method 

G. IKEv2 profile description 

H. virtual template 

Answer: B,C,F 

Q110. Refer to the exhibit. 

Which type of mismatch is causing the problem with the IPsec VPN tunnel? 


B. Phase 1 policy 

C. transform set 

D. crypto access list 

Answer: A 

About 300-209 Information: 300-209 Dumps