Security Implementing Cisco Secure Mobility Solutions (SIMOS) Free Sample Questions

The split-dns command requires a list of domain names. When a client needs to resolve a name matching a domain in this list, the query is sent through the tunnel to the corporate DNS server. The command split-dns DefaultDNS is not a valid configuration; it should be followed by a domain name, for example, split-dns value internal.company.com. Without the specific domain list, the AnyConnect client will continue to use its local DNS server, failing to resolve internal FQDNs.

GETVPN uses the GDOI protocol, which is encapsulated in UDP over port 848. If an access control list on the KS or any intermediate device blocks this traffic from the GM, the registration process will fail.

The group identity number is a critical parameter that must match between the KS and GM. It is used to associate the GM with the correct GDOI group. A mismatch will cause the KS to reject the registration request.

In a FlexVPN IKEv2 server (hub) configuration, the crypto ikev2 profile is the central component. It ties together authentication (certificates), authorization (AAA), and the configuration template for dynamic tunnels (virtual-template). The AAA server or local pool is then configured to provide IP addresses and other attributes to authenticated spokes, which are applied via the virtual-access interface cloned from the virtual-template.

True. Clientless SSL VPN primarily provides access to web-based resources. To access non-web applications that use specific TCP ports (like SSH on port 22 or Telnet on port 23), port forwarding must be configured. This feature uses a Java applet that is downloaded to the client's browser to map a local port on the client's machine to the internal application's IP address and port, tunneling the traffic through the SSL VPN session.

Perfect Forward Secrecy (PFS) ensures that a session key derived from a set of long-term keys will not be compromised if one of the long-term keys is compromised in the future. In IPsec, this is achieved by forcing a new Diffie-Hellman exchange to generate fresh, unrelated keys for each new security association (SA) rekey, typically during IKE Phase 2. This prevents an attacker who compromises a router's private key from decrypting previously captured VPN traffic.

In DMVPN Phase 3, when a spoke (Spoke A) sends a packet to another spoke (Spoke B) via the hub, the hub processes the packet and forwards it to Spoke B. Simultaneously, the hub sends an 'NHRP Redirect' message back to Spoke A. This message tells Spoke A to find a better path. Spoke A then sends an 'NHRP Resolution Request' for Spoke B's NBMA address, triggering the dynamic spoke-to-spoke tunnel formation. The initial packet loss occurs during this discovery and tunnel setup process.

The HostScan module, deployed from the Cisco ASA or integrated with Cisco Identity Services Engine (ISE), is responsible for endpoint posture assessment. Administrators configure posture policies (requirements) within the ASA's HostScan settings or more granularly within ISE. These policies define the specific conditions, such as the presence and state of antivirus software, OS patch levels, or running processes, that must be met for an endpoint to be considered compliant.

IKEv2 Fragmentation is a specific feature designed to address issues where large IKE packets, especially those carrying extensive certificate chains, exceed the path MTU. When enabled with the crypto ikev2 fragmentation command, the router will fragment the IKEv2 messages at the IKE layer before encryption, allowing them to be transmitted in smaller IP packets that can traverse links with lower MTU values without being dropped by intermediate devices.

The authentication remote eap command within an IKEv2 profile specifies that the remote peer (spoke) will be authenticated using EAP. A corresponding authentication local command defines how the hub authenticates itself to the spoke. Crucially, IKEv2 performs the EAP exchange inside the encrypted IKE_AUTH exchange, protecting user credentials from eavesdropping. This is a significant security improvement over IKEv1's Xauth, which sent the credentials in a separate, potentially vulnerable transaction.

Diagram C correctly illustrates the GETVPN architecture. The Key Server (KS) acts as a centralized control plane entity, distributing keys and policies to all Group Members (GMs) using the GDOI protocol. The data plane, however, is a full mesh. Once GMs receive the common security policy and keys, they can encrypt and decrypt traffic directly between each other without involving the KS. This preserves the original IP headers and supports native IP routing and multicast.