mediumMultiple ChoiceObjective-mapped
350-701 Practice Question: A remote user is unable to connect to the…
A remote user is unable to connect to the corporate VPN using Cisco AnyConnect. The user has internet access and can reach the ASA's public IP. The ASA administrator checks and sees that the remote access VPN configuration is correct. What is the most likely client-side issue?
⚠ Common exam trap
Cisco often tests the distinction between network-layer reachability (IP connectivity) and application-layer authentication (certificate trust), leading candidates to incorrectly choose firewall or DNS issues when the user can already reach the ASA's IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The client's certificate is expired or not trusted.
The user can reach the ASA's public IP and has internet access, which rules out basic connectivity issues. Since the ASA's VPN configuration is correct, the problem is likely on the client side. A common cause is an expired or untrusted certificate, as AnyConnect uses certificate-based authentication for the SSL/TLS handshake; if the client does not trust the server's certificate or the client's own certificate is expired, the VPN tunnel will fail to establish.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The client is using an outdated version of AnyConnect.
Why it's wrong here
Outdated versions may have issues, but connection failure with correct ASA config suggests a certificate issue.
- ✗
The client's DNS is not resolving the VPN hostname.
Why it's wrong here
The user can reach the ASA's public IP, so DNS is working.
- ✗
The client's firewall is blocking TCP port 443.
Why it's wrong here
The user can reach the ASA's public IP, so port 443 is likely open.
- ✓
The client's certificate is expired or not trusted.
Why this is correct
Certificate authentication failure is a common cause when ASA configuration is correct.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.