exam questions

Exam 350-701 All Questions

View all questions & answers for the 350-701 exam

Exam 350-701 topic 1 question 94 discussion

Actual exam question from Cisco's 350-701
Question #: 94
Topic #: 1
[All 350-701 Questions]


Refer to the exhibit. Traffic is not passing through IPsec site-to-site VPN on the Firepower Threat Defense appliance. What is causing this issue?

  • A. Site-to-site VPN preshared keys are mismatched.
  • B. Site-to-site VPN peers are using different encryption algorithms.
  • C. No split-tunnel policy is defined on the Firepower Threat Defense appliance.
  • D. The access control policy is not allowing VPN traffic in.
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
kerniger
Highly Voted 3 years, 8 months ago
A - vpn is established B - vpn is established C - Split Tunneling has nothing to do with a site-to-site VPN. D - we see traffic is comming in but no traffic is going into the tunnel so its likely a access policy wrong or missing
upvoted 27 times
...
zap_pap
Highly Voted 3 years, 9 months ago
A & B are ruled out by #pkts encaps #pkts decaps: traffic is flowing based on these lines, so the VPN is established. #pkts decaps: 17 - we are getting traffic in, so it is not blocked by the ACL. Only C is left.
upvoted 11 times
jmosilva
3 years, 9 months ago
Perfect explanation! I agree with C
upvoted 3 times
...
gondohwe
1 year, 11 months ago
no no my friend...split-tunneling doesnt prevent vpns from operating but define what traffic should use the vpn tunnel and what traffic shoudnt so forget C...on FTD devices access policies shld also properly permit traffic provide vpn has been configured proper way...D sounds better
upvoted 2 times
gondohwe
1 year, 11 months ago
slpit-tunneling is never heard of in site 2 site vpns
upvoted 2 times
...
...
...
Rockbo47
Most Recent 8 months, 3 weeks ago
Selected Answer: D
As others have pointed out also, the correct answer can only be D for the reasons provided by others however there MUST be a typo in D because traffic is being successfully received as indicated by the decaps and decrypt packets. So the actual correct answer would be "The access control policy is not allowing VPN traffic OUT."
upvoted 1 times
...
Marshpillowz
1 year ago
Selected Answer: D
D is correct
upvoted 1 times
...
Alizade
1 year, 6 months ago
Selected Answer: D
D. The access control policy is not allowing VPN traffic in.
upvoted 2 times
...
intirt
2 years, 4 months ago
D is correct
upvoted 2 times
...
ureis
2 years, 6 months ago
crypto map is not matching with ALC, so D is correct
upvoted 2 times
...
getafix
2 years, 11 months ago
Selected Answer: D
A - cannot be true since the tunnel is established as we can see pkts decerypted and pkts encrypted --> zero B: Same as above, tunnel is up so Phase1 and Phase2 are both up and interesting traffic is passing C: Split tunneling works for remote access VPNs. It defines what traffic, when a user connects to a remote access VPN server, should go inside the VPN and what traffic should go out via his local home router. D: Since there are no encapsulations happening encaps:0bytes.....it evidently shows a problem with the access list
upvoted 8 times
...
somaaoo
3 years ago
Selected Answer: D
pkts encap are 0 , so D
upvoted 4 times
...
killbots
3 years ago
I say its D. Split-Tunneling is only relevant to Remote Access VPNs not S2S. only one that makes sense is D.
upvoted 3 times
...
zheka
3 years, 5 months ago
Maybe it is another example of the stupid question/exhibit or a tricky one. If VPN is established and especially Phase 2 with all security associations created then two firewall peers negotiated everything which is matching. Of course nothing to do with split-tunneling on the site-to-site tunnel. The only explanation for this assymetry of counters for packets entering the tunnel and exiting is either missing NAT exemption rules or indeed access control policy rule which should be configured only if we stopped trusting the traffic that exits the tunnel (former sysopt connection permit-vpn)
upvoted 1 times
...
zeroC00L
3 years, 7 months ago
i would go with D and hoping this is just a typo (and it meant actually "out") because it seems to be the "less" wrong answer. C makes no sense from both wording and technically. If you do something wrong according to what to send into the tunnel it would either not come up at all or would throw erros about "proxy identity mismatch" (we dont have debugs so this cant be validated)
upvoted 6 times
...
Sarbi
3 years, 8 months ago
I agreed with C and VPN tunnel is established only traffic is not passing.
upvoted 1 times
...
Narcolepto
3 years, 10 months ago
I think the answer is D because if you look carefully at the access-list it is incorrectly formatted. There is an extra period between the mask of the source and the ip of the destination instead of a space - 255.255.255.0.10.0.10.0 instead of 255.255.255.0 10.0.10.0
upvoted 2 times
Dead_Adriano
3 years, 10 months ago
This might me just a typo. In the next lines of the output, traffic selectors (local and remote idents) are parsed correctly.
upvoted 1 times
...
...
Raajaa
3 years, 10 months ago
D is the answer
upvoted 1 times
...
Barish
3 years, 11 months ago
Answer D is correct
upvoted 2 times
...
Minipaf
3 years, 12 months ago
Hello, can anyone explain this answer ? I find that answer D makes more sense. thanks!
upvoted 1 times
cciewannab
3 years, 7 months ago
A and B are incorrect because we can see the tunnel is up. We know it is up because we have 17 decap packets. This means traffic is coming from the peer to the ASA and it decrypts and sends it according to the routing table. C is incorrect because that is related to remote-access VPNs, not S2S VPNs. Since we have no encaps - which is traffic entering the ASA, being encrypted, and sent out the tunnel - this likely means the ASA has an inbound access-list on the 'inside' or whatever interface not allowing the interesting traffic in. So the traffic blocked entering into the ASA never giving it an option to be encrypted. D is therefore the answer.
upvoted 7 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago