SkillTestPro | CCNP Security 350-701 SCOR Practice Test 12

CCNP Security 350-701 SCOR Practice Test 12 (Hard) - Remote Access VPN - AnyConnect and DMVPN

CISCO CCNP Security Exam Logo

1 / 10

Which Cisco client software provides remote users with secure VPN connectivity, typically supporting both SSL and IPsec IKEv2 transport, along with endpoint posture assessment capabilities?

Cisco Webex Meetings client

Cisco Jabber client

Cisco Unified Communications Manager client

Cisco Finesse client

Cisco Secure Client (formerly AnyConnect)

Cisco Umbrella roaming client only, with no VPN tunnel capability

2 / 10

Which AnyConnect/Secure Client feature evaluates a connecting endpoint's security state (such as antivirus status or OS patch level) before granting or restricting network access?

Posture assessment (e.g., via Cisco Secure Firewall Posture / HostScan integration)

The client's icon in the system tray

The client's default language setting

The client's connection profile display name

Split tunneling configuration alone, with no posture evaluation, though the exact behavior varies depending on the specific platform and software version in use

The client's installer file size

3 / 10

Which AnyConnect VPN tunneling configuration determines whether all of a remote user's traffic is routed through the corporate VPN, versus only traffic destined for specific internal corporate networks?

Split tunneling policy (full-tunnel vs. split-tunnel configuration)

The client's automatic update check frequency

The client's authentication method (certificate vs. password) alone

The client's installed language pack

The client's system tray icon color

The client's posture assessment result alone

4 / 10

What is the primary purpose of Dynamic Multipoint VPN (DMVPN) in a hub-and-spoke or partial-mesh WAN deployment?

To allow spoke sites to dynamically establish direct, on-demand IPsec tunnels to each other (spoke-to-spoke) without requiring a permanently configured tunnel for every possible pair, while still supporting a simpler hub configuration

To require every spoke to maintain a permanently configured static tunnel to every other spoke at all times

To function exclusively as a DNS caching service between sites

To eliminate the need for any IPsec encryption between sites

To provide DHCP address assignment to WAN interfaces only

To replace the need for any routing protocol between sites

5 / 10

Which DMVPN component is responsible for mapping a spoke's logical (tunnel) IP address to its actual, dynamic physical (NBMA) IP address, enabling dynamic spoke-to-spoke tunnel establishment?

Hot Standby Router Protocol (HSRP)

Internet Group Management Protocol (IGMP)

Spanning Tree Protocol (STP)

Simple Network Management Protocol (SNMP)

Dynamic Host Configuration Protocol (DHCP)

Next Hop Resolution Protocol (NHRP)

6 / 10

Which DMVPN phase introduces dynamic spoke-to-spoke tunnels established on demand, rather than requiring all inter-spoke traffic to traverse the hub?

DMVPN Phase 1, which only supports hub-to-spoke tunnels with all spoke-to-spoke traffic traversing the hub, which several deployment guides list as an important operational nuance

A phase that requires manual static tunnel configuration between every spoke pair

A phase that eliminates the hub entirely from the topology

A phase that requires disabling all routing protocols

DMVPN Phase 2 or Phase 3 (both support dynamic spoke-to-spoke tunnels, with Phase 3 offering improved scalability)

A phase that only functions with a single spoke and no hub at all

7 / 10

Which AnyConnect deployment consideration is most important for an organization wanting to enforce that only devices in a healthy security posture can access sensitive internal resources over the VPN?

Configuring a posture assessment policy that restricts or remediates access for non-compliant endpoints before granting full network access

Enabling full-tunnel mode with no posture assessment configured at all

Disabling all logging to reduce administrative overhead

Disabling all authentication so any device can connect without restriction

Relying solely on the client's display name to determine trust

Assuming every connecting device is automatically compliant with no verification, under typical enterprise deployment conditions before any further customization

8 / 10

Which routing approach is commonly used over a DMVPN network to allow spokes to learn routes to each other's local networks dynamically, rather than relying solely on static routes?

A dynamic routing protocol (such as EIGRP, OSPF, or BGP) running over the DMVPN tunnel interfaces

Disabling all routing protocols and relying exclusively on default routes pointing to the hub with no spoke-to-spoke awareness

Using only DNS TXT records to advertise routing information

Using only SNMP traps to propagate routing updates

Using only DHCP to advertise routes between spokes

Using only manual static routes configured identically on every spoke with no automation

9 / 10

Which security consideration is most relevant when configuring split tunneling for remote AnyConnect users who also access the public internet directly while connected to the corporate VPN?

Split tunneling automatically encrypts all internet-bound traffic with the same VPN encryption regardless of configuration, assuming no additional per-interface configuration overrides the default behavior

Split tunneling is only relevant for wired connections and never for Wi-Fi

Traffic not routed through the VPN (internet-bound split-tunnel traffic) bypasses corporate security inspection, so appropriate endpoint protection and policy must be in place to cover that traffic

Split tunneling has no security implications whatsoever and requires no additional consideration

Split tunneling eliminates the need for any endpoint protection software

Split tunneling always routes 100% of traffic through the corporate network with no exceptions

10 / 10

Which combination of DMVPN and IPsec design choices would best support a large, geographically distributed enterprise wanting secure, scalable spoke-to-spoke connectivity with minimal per-spoke configuration overhead?

A full mesh of manually configured static IPsec tunnels between every possible pair of spokes

A design that disables NHRP entirely and relies only on default gateway routing

DMVPN Phase 1 with all traffic forced through the hub and no spoke-to-spoke capability

DMVPN Phase 3 with NHRP for dynamic spoke-to-spoke tunnel resolution, IPsec (ESP) for encryption, and a dynamic routing protocol for reachability, configured centrally at the hub with minimal per-spoke customization

Static routing configured individually and manually on every single spoke with no dynamic protocol

No encryption at all, relying solely on the WAN provider's physical security

Your score is

The average score is 0%