Refer to the exhibit. An engineer must configure Cisco ASA so that the Secure Client deployment is removed when the user laptop disconnects from the VPN. The indicated configuration was applied to…

Question

Exhibit

Options

• Aclient-bypass-protocol enable
• Banyconnect keep-installer none
• Canyconnect firewall-rule client-interface
• Dclient-bypass-protocol disable

• A
  8% (2)
• B
  4% (1)
• C
  15% (4)
• D
  73% (19)

Explanation

Important note for the student: The marked answer of D appears to conflict with Cisco's documented behavior. This is worth flagging before you memorize the wrong concept.

anyconnect keep-installer none (option B) is the command that directly controls what happens to the Secure Client installer on the endpoint after disconnect - none removes it, while installed retains it. This is the textbook answer for the stated requirement.

client-bypass-protocol disable (option D) controls what happens to traffic using IP protocols unsupported by the Secure Client - disable drops that traffic rather than allowing it to bypass the VPN tunnel. This is a security posture setting with no direct relationship to installer removal.

The other distractors: A (client-bypass-protocol enable) does the opposite - it allows unsupported traffic to bypass the tunnel, which is a security risk. C (anyconnect firewall-rule client-interface) configures firewall rules pushed to the client interface, unrelated to installer lifecycle.

Memory tip: Think of "keep-installer" as the literal on/off switch for leaving the package behind - installed = leave it, none = take it back. For the exam, if your exhibit shows anyconnect keep-installer installed and the goal is cleanup on disconnect, the answer is anyconnect keep-installer none.

If this question came from a practice exam or certification prep vendor, I'd recommend cross-checking against Cisco's official ASA CLI configuration guide - there may be an error in the answer key.

No community discussion yet for this question.