300-730 · Question #41
Refer to the exhibit. Based on the exhibit, why are users unable to access CCNP Webserver bookmark?
The correct answer is B. The ASA cannot resolve the URL.. When a clientless SSL VPN bookmark uses a hostname, the ASA must resolve it via DNS on behalf of the user, and a resolution failure blocks access.
Question
Options
- AThe URL is being blocked by a WebACL.
- BThe ASA cannot resolve the URL.
- CThe bookmark has been disabled.
- DThe user cannot access the URL.
How the community answered
(43 responses)- A30% (13)
- B51% (22)
- C12% (5)
- D7% (3)
Why each option
When a clientless SSL VPN bookmark uses a hostname, the ASA must resolve it via DNS on behalf of the user, and a resolution failure blocks access.
A WebACL denial produces an access-denied or policy-block message rather than the DNS resolution failure shown in the exhibit.
The ASA acts as a proxy for clientless SSL VPN sessions and performs all DNS lookups on behalf of the connected user. If the ASA's DNS server is unreachable, not configured, or cannot resolve the hostname in the CCNP Webserver bookmark URL, the connection fails and the portal displays a resolution error as shown in the exhibit. Correcting DNS server configuration on the ASA resolves the issue.
A disabled bookmark would not appear as an active link in the clientless portal or would be visually greyed out, not produce an error on access.
This choice is too generic and does not identify the specific technical cause shown in the exhibit - the failure is a DNS resolution issue on the ASA, not a blanket user access restriction.
Concept tested: ASA DNS resolution for clientless SSL VPN bookmarks
Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/vpn/asa-96-vpn-config/vpn-clientless-ssl-vpn.html
Topics
Community Discussion
No community discussion yet for this question.