350-701 Exam Questions and Answers | Exam-Dumps.net (Page: 5)

QUESTION: 21 Exam Topic: 1, Exam Pool A

Elliptic curve cryptography is a stronger more efficient cryptography method meant to replace which current encryption technology?

3DES
RSA
DES
AES

Answer(s): B

Explanation:

Compared to RSA, the prevalent public-key cryptography of the Internet today, Elliptic Curve Cryptography (ECC) offers smaller key sizes, faster computation,as well as memory, energy and bandwidth savings and is thus better suited forsmall devices.

Reveal Solution Next Question

QUESTION: 22 Exam Topic: 1, Exam Pool A

What is the result of running the crypto isakmp key ciscXXXXXXXX address 172.16.0.0 command?

authenticates the IKEv2 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX
authenticates the IP address of the 172.16.0.0/32 peer by using the key ciscXXXXXXXX
authenticates the IKEv1 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX
secures all the certificates in the IKE exchange by using the key ciscXXXXXXXX

Answer(s): C

Explanation:

Configure a Crypto ISAKMP Key
In order to configure a preshared authentication key, enter the crypto isakmp key command in global configuration mode:
crypto isakmp key cisco123 address 172.16.1.1

https://community.cisco.com/t5/vpn/isakmp-with-0-0-0-0-dmvpn/td-p/4312380 It is a bad practice but it is valid. 172.16.0.0/16 the full range will be accepted as possible PEER https://www.examtopics.com/discussions/cisco/view/46191-exam-350-701-topic-1-question-71- discussion/#:~:text=Command%20reference%20is%20not%20decisive,172.16.1.128%20cisco123%0A CSR%2D1(config)%23
Testing without a netmask shows that command interpretation has a preference for /16 and /24. CSR-1(config)#crypto isakmp key cisco123 address 172.16.0.0 CSR-1(config)#do show crypto isakmp key | i cisco default 172.16.0.0 [255.255.0.0] cisco123
CSR-1(config)#no crypto isakmp key cisco123 address 172.16.0.0 CSR-1(config)#crypto isakmp key cisco123 address 172.16.1.0 CSR-1(config)#do show crypto isakmp key | i cisco default 172.16.1.0 [255.255.255.0] cisco123
CSR-1(config)#no crypto isakmp key cisco123 address 172.16.1.0 CSR-1(config)#crypto isakmp key cisco123 address 172.16.1.128 CSR-1(config)#do show crypto isakmp key | i cisco default 172.16.1.128 cisco123 CSR-1(config)#

Reveal Solution Next Question

QUESTION: 23 Exam Topic: 1, Exam Pool A

Which technology must be used to implement secure VPN connectivity among company branches over a private IP cloud with any-to-any scalable connectivity?

DMVPN
FlexVPN
IPsec DVTI
GET VPN

Answer(s): D

Explanation:

Cisco`s Group Encrypted Transport VPN (GETVPN) introduces the concept of a trusted group to eliminate point-to-point tunnels and their associated overlay routing. All group members (GMs) share a common security association (SA), also known as a group SA. This enables GMs to decrypt traffic that was encrypted by any other GM.
GETVPN provides instantaneous large-scale any-to-any IP connectivity using a group IPsec security paradigm.

Reference:

https://www.cisco.com/c/dam/en/us/products/collateral/security/group-encrypted- transport-vpn/
GETVPN_DIG_version_2_0_External.pdf

Reveal Solution Next Question

QUESTION: 24 Exam Topic: 1, Exam Pool A

Which two conditions are prerequisites for stateful failover for IPsec? (Choose two)

Only the IKE configuration that is set up on the active device must be duplicated on the standby device; the
IPsec configuration is copied automatically
The active and standby devices can run different versions of the Cisco IOS software but must be the same type of device.
The IPsec configuration that is set up on the active device must be duplicated on the standby device
Only the IPsec configuration that is set up on the active device must be duplicated on the standby device;
the IKE configuration is copied automatically.
The active and standby devices must run the same version of the Cisco IOS software and must be the same type of device

Answer(s): C,E

Explanation:

Stateful failover for IP Security (IPsec) enables a router to continue processing and forwarding IPsec packets after a planned or unplanned outage occurs. Customers employ a backup (secondary) router that automatically takes over the tasks of the active (primary) router if the active router loses connectivity for any reason. This failover process is transparent to users and does not require adjustment or reconfiguration of any remote peer.
Stateful failover for IPsec requires that your network contains two identical routers that are available to be either the primary or secondary device. Both routers should be the same type of device, have the same CPU and memory, and have either no encryption accelerator or identical encryption accelerators.
Prerequisites for Stateful Failover for IPsec
Complete, Duplicate IPsec and IKE Configuration on the Active and Standby Devices This document assumes that you have a complete IKE and IPsec configuration. The IKE and IPsec configuration that is set up on the active device must be duplicated on the standby device.
That is, the crypto configuration must be identical with respect to Internet Security Association and Key
Management Protocol (ISAKMP) policy, ISAKMP keys (preshared), IPsec profiles, IPsec transform sets, all crypto map sets that are used for stateful failover, all access control lists (ACLs) that are used in match address statements on crypto map sets, all AAA configurations used for crypto, client configuration groups, IP local pools used for crypto, and ISAKMP profiles.

Reference:

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnav/configuration/15- mt/sec-vpnavailability-15-mt-book/sec-state-fail-ipsec.html Although the prerequisites only stated that "Both routers should be the same type of device" but in the
"Restrictions for Stateful Failover for IPsec" section of the link above, it requires "Both the active and standby devices must run the identical version of the Cisco IOS software" so answer E is better than answer B.

Reveal Solution Next Question

QUESTION: 25 Exam Topic: 1, Exam Pool A

Which VPN technology can support a multivendor environment and secure traffic between sites?

SSL VPN
GET VPN
FlexVPN
DMVPN

Answer(s): C

Explanation:

FlexVPN is an IKEv2-based VPN technology that provides several benefits beyond traditional site-to- site VPN implementations. FlexVPN is a standards-based solution that can interoperate with non- Cisco IKEv2
implementations. Therefore FlexVPN can support a multivendor environment. All of the three VPN technologies support traffic between sites (site-to-site or spoke-to-spoke).

Reveal Solution Next Question

Cisco® 350-701 Exam (page: 5) Cisco® Implementing and Operating Security Core Technologies Updated on: 01-Sep-2025

QUESTION: 21 Exam Topic: 1, Exam Pool A

Explanation:

QUESTION: 22 Exam Topic: 1, Exam Pool A

Explanation:

QUESTION: 23 Exam Topic: 1, Exam Pool A

Explanation:

Reference:

QUESTION: 24 Exam Topic: 1, Exam Pool A

Explanation:

Reference:

QUESTION: 25 Exam Topic: 1, Exam Pool A

Explanation:

Cisco® 350-701 Exam (page: 5)
Cisco® Implementing and Operating Security Core Technologies
Updated on: 01-Sep-2025