300-730 · Question #135
Refer to the exhibit. What action will the given configuration achieve?
The correct answer is B. Split exclude policy with a permit for 0.0.0.0/32.. The exhibit configuration implements a split-exclude VPN policy where a permit ACL entry for 0.0.0.0/32 causes that traffic to bypass the VPN tunnel.
Question
Options
- ASplit exclude policy with a deny for 192.168.0.3/32.
- BSplit exclude policy with a permit for 0.0.0.0/32.
- CTunnel all policy.
- DSplit include policy with a permit for 192.168.0.0/24.
How the community answered
(28 responses)- A4% (1)
- B71% (20)
- C7% (2)
- D18% (5)
Why each option
The exhibit configuration implements a split-exclude VPN policy where a permit ACL entry for 0.0.0.0/32 causes that traffic to bypass the VPN tunnel.
The exhibit ACL references 0.0.0.0 as the network, not 192.168.0.3/32; a deny action for a specific host address like 192.168.0.3 would require that host to appear explicitly in the policy.
A split-exclude policy (excludespecified) directs traffic matching the referenced ACL to exit the interface directly rather than traversing the VPN tunnel. A permit entry for 0.0.0.0/32 in that ACL identifies the specific network to exclude, and the presence of 0.0.0.0 as the network address alongside the excludespecified keyword is the defining indicator of this split-exclude behavior.
A tunnel-all policy sends all user traffic through the VPN with no exclusions and would not reference any split-tunnel ACL or network list in the configuration.
A split-include policy uses the tunnelspecified keyword so that only ACL-matched traffic enters the tunnel, which is structurally opposite to the excludespecified keyword shown in the exhibit.
Concept tested: AnyConnect split-exclude tunnel policy ACL configuration
Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/S/asa-command-ref-S/sa-sd-cmds.html
Topics
Community Discussion
No community discussion yet for this question.