Which two statements are true when designing a SSL VPN solution using Cisco AnyConnect?
(Choose two.)

• A.DTLS can be enabled for better performance.
• B.The VPN IP address pool can overlap with the rest of the LAN networks.
• C.A SSL group pre-shared key must be configured on the server.
• D.Server side certificate is optional if using AAA for client authentication.
• E.The VPN server must have a self-signed certificate.

Comment: *

Name: *

Email: *

Verification: *

A router is being configured for IKEv2 AnyConnect using AnyConnect-EAP. How would the administrator separate profiles for administrators and employees so that authorization differs when they connect?

• A.Define group aliases on the headend and have the user pick the appropriate alias when they connect
• B.Define group-urls on the headend and create two XML profiles to match the administrator and user group urls
• C.Create a certificate map and match on the appropriate certificate fields
• D.Define key-ids on the headend and create two XML profiles to match the administrator and user key-ids.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

A network engineer is reconfiguring clientless SSLVPN during a maintenance window, and after testing the new configuration, is unable to establish the connection. What must be done to remediate this problem?

• A.Enable client services on the outside interface.
• B.Enable auto sign-on for the user's IP address.
• C.Enable clientless protocol under the group policy.
• D.Enable DTLS under the group policy.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

The DMVPN spoke is not establishing a session with the hub. Which two actions resolve this issue? (Choose two.)

• A.Change the nhrp authentication key on the spoke to cisco123.
• B.Change the ISAKMP key address on the spoke to 0.0.0.0.
• C.Change the ISAKMP policy authentication on the spoke to pre-shared.
• D.Change the transform set to mode tunnel.
• E.Change the spoke nhs to 172.16.18.1 and the nbma to 10.0.0.1.

Comment: *

Name: *

Email: *

Verification: *

Where is split tunneling defined for IKEv2 remote access clients on a Cisco router?

• A.IKEv2 authorization policy
• B.Group Policy
• C.virtual template
• D.webvpn context

Comment: *

Name: *

Email: *

Verification: *