Cisco 300-730 Practice Test

300-730 practice test: what's covered

• Secure Communications & IKEv1/IKEv2
• Site-to-Site VPN (DMVPN, GET VPN, FlexVPN)
• Remote Access VPN (AnyConnect, Clientless SSL)
• Troubleshooting

Free 300-730 sample questions

1. An engineer is comparing IKEv2 with IKEv1 for a new deployment and must justify the change to management. Which IKEv2 characteristic represents a genuine improvement?

   • A. IKEv2 removes the need for any pre-shared key or certificate authentication
   • B. IKEv2 encrypts traffic without requiring an IPsec security association
   • C. IKEv2 eliminates the need to define interesting traffic or protected networks
   • D. IKEv2 establishes the tunnel in fewer message exchanges and supports built-in NAT traversal
   Show answer

   Correct: D. IKEv2 negotiates in four messages rather than the six or nine of IKEv1 main and aggressive modes, and NAT traversal plus dead peer detection are integral rather than extensions. It still requires authentication credentials, still creates child security associations for data protection, and still needs traffic selectors defining what is protected.

2. An engineer must protect site-to-site traffic that traverses a NAT device in the path. Which IPsec protocol choice is required and why?

   • A. Either protocol, because both encapsulate the original header identically
   • B. Neither, because IPsec cannot operate through any form of address translation
   • C. ESP, because AH authenticates the IP header and breaks when addresses are translated
   • D. AH, because it provides stronger authentication than ESP across NAT boundaries
   Show answer

   Correct: C. AH includes immutable IP header fields in its integrity check, so translating the address invalidates it, whereas ESP protects only the payload and works with NAT traversal encapsulation. The protocols are not interchangeable in this respect, and IPsec does work through NAT when ESP with UDP encapsulation is used.

3. An engineer is configuring an IKEv2 proposal and policy. Select the TWO parameters that must be negotiated successfully for the security association to establish. (Choose TWO)

   • A. The hostname configured on each peer for administrative identification
   • B. The MTU value applied to the physical outside interface of each router
   • C. The encryption algorithm and integrity algorithm supported by both peers
   • D. The Diffie-Hellman group used to derive the shared keying material
   • E. The routing protocol running across the tunnel interface once it is up
   Show answer

   Correct: C and D. IKE negotiation must reach agreement on the cryptographic transforms and the key exchange group before any security association can form. Routing protocol choice, device hostnames and interface MTU affect operation after the tunnel exists rather than whether the negotiation itself succeeds.

4. A security policy requires that compromise of a long-term key must not expose previously captured traffic. Which IPsec feature satisfies this?

   • A. Perfect forward secrecy, which performs a fresh key exchange for each new security association
   • B. A longer IPsec security association lifetime measured in kilobytes
   • C. A stronger hashing algorithm applied to the integrity check value
   • D. Aggressive mode negotiation to reduce the number of exchanged messages
   Show answer

   Correct: A. Perfect forward secrecy derives each session key from an independent exchange, so recovering one key does not unlock previously recorded sessions. Longer lifetimes increase the exposure of a single key, stronger hashing protects integrity rather than confidentiality, and aggressive mode weakens rather than strengthens the negotiation.

5. An engineer must decide between tunnel mode and transport mode for a GRE over IPsec design. Which choice is appropriate and why?

   • A. Tunnel mode, because GRE cannot be combined with IPsec in any configuration
   • B. Transport mode, because it encrypts the original IP header for extra confidentiality
   • C. Tunnel mode, because transport mode is unsupported on all Cisco IOS platforms
   • D. Transport mode, because GRE already provides the outer header that carries the packet
   Show answer

   Correct: D. When GRE supplies the encapsulating header, transport mode avoids adding a second redundant IP header and saves overhead. GRE and IPsec combine routinely, transport mode protects the payload rather than encrypting the original header, and transport mode is fully supported.

Last updated: 2026-09-23

300-730 practice test FAQ

Related practice tests

• CCIE Security Written 350-701 practice test
• CCNA 200-301 practice test
• Cisco 300-410 practice test
• CCNP ENCOR 350-401 practice test
• Cisco 100-160 practice test
• Cisco 200-201 practice test