Cisco SVPN 300-730 Quick Reference: Every Number You Need to Memorise

The Cisco Secure VPN (300-730 SVPN) exam is a 90-minute test with 55-65 questions, requiring a passing score of 750 out of 1000. It validates your skills in designing, implementing, and troubleshooting secure VPN solutions. To help you focus your revision, here is a quick-reference guide covering every number you need to know, along with must-know concepts per domain.

Exam Structure and Key Numbers

• Exam code: 300-730 SVPN
• Duration: 90 minutes
• Questions: 55-65 (multiple choice, drag-and-drop, simlets, testlets)
• Passing score: 750/1000
• Cost: $300 USD (varies by region)
• Prerequisites: None, but CCNA or equivalent knowledge recommended

Domain Weightings (What to Focus On)

The exam is divided into four domains with specific percentages that indicate the number of questions per area. Memorize these to allocate your study time effectively. See also The Hardest Domain on Cisco SVPN 300-730, Broken Down for a complementary perspective. For more on this topic, see our guide on AZ-400 Quick Reference: Every Number You Need to Memorise.

• Secure Communications (25%): IPsec, IKEv1/IKEv2, SSL VPN, and PKI.
• Secure Remote Access and VPNs (40%): Cisco AnyConnect, remote access VPNs, site-to-site VPNs, and troubleshooting.
• Secure Network Access (20%): Network security concepts, security controls, and monitoring.
• Secure Endpoints (15%): Endpoint security, posture assessment, and identity-based policies.

Must-Know Concepts per Domain

1. Secure Communications (25%)

• IPsec protocols: ESP (Encapsulating Security Payload) for encryption and authentication; AH (Authentication Header) for authentication only. ESP uses port 50, AH uses port 51.
• IKEv1 vs IKEv2: IKEv2 has fewer exchanges (2 vs 6), built-in NAT traversal, and supports EAP. IKEv2 uses UDP ports 500 and 4500 (for NAT-T).
• IKE phases: Phase 1 (ISAKMP) establishes a secure channel using either Main Mode (6 messages) or Aggressive Mode (3 messages). Phase 2 (IPsec) negotiates the IPsec SA using Quick Mode (3 messages).
• PKI components: Certificate Authority (CA), Registration Authority (RA), and certificate revocation list (CRL). Certificates use X.509 format.
• Common trap: Confusing AH vs ESP. Remember: ESP encrypts, AH does not. Also, ESP can provide both confidentiality and integrity.

2. Secure Remote Access and VPNs (40%) – The Heavyweight

• Cisco AnyConnect: Supports SSL (TLS) and IPsec IKEv2. Default ports: 443 for SSL, 500/4500 for IPsec. AnyConnect can be deployed via web launch or pre-deployment.
• Remote access VPN configuration: On ASA, you need: IP pool, group policy, tunnel group, and NAT exemption. On IOS, use virtual-template interfaces.
• Site-to-site VPN: Two main types: IPsec and DMVPN. DMVPN uses mGRE (multicast GRE) and NHRP for dynamic spoke-to-spoke tunnels.
• FlexVPN: Cisco's unified VPN solution using IKEv2 and supports both site-to-site and remote access. Uses virtual-access interfaces and AAA.
• Common trap: Forgetting that AnyConnect requires a valid license (AnyConnect Essentials or AnyConnect Plus/Apex) on the headend. Also, SSL VPN uses TLS handshake, not IPsec.

3. Secure Network Access (20%)

• Security zones: Inside (trusted), outside (untrusted), DMZ (semi-trusted). Traffic between zones is controlled by ACLs.
• Access control lists (ACLs): Standard (1-99, 1300-1999) and extended (100-199, 2000-2699). Extended ACLs filter by source, destination, port, and protocol.
• Network Address Translation (NAT): Static, dynamic, and PAT. PAT uses port numbers to map multiple internal IPs to one public IP.
• Monitoring: SNMP (v1, v2c, v3), syslog, and NetFlow. SNMP v3 provides authentication and encryption.
• Common trap: Misunderstanding ACL placement: standard ACLs should be placed close to destination, extended ACLs close to source.

4. Secure Endpoints (15%)

• Posture assessment: AnyConnect can check endpoint compliance (OS version, antivirus, firewall) before granting access. Uses posture servers and remediation.
• Identity-based policies: Use AAA (Authentication, Authorization, Accounting) with RADIUS or LDAP. RADIUS uses UDP 1812/1813, LDAP uses TCP 389.
• Endpoint security: Cisco AMP (Advanced Malware Protection) provides file reputation and sandboxing. Cisco Umbrella provides DNS-layer security.
• Common trap: Confusing RADIUS (uses UDP, encrypts only password) with TACACS+ (uses TCP, encrypts entire packet).

Common Traps and How to Avoid Them

• Port numbers: Memorize: HTTPS=443, IPsec=500/4500, RADIUS=1812/1813, TACACS+=49, LDAP=389, SNMP=161/162.
• IKEv1 vs IKEv2: IKEv2 is more efficient and secure; it does not support Aggressive Mode. It also has built-in DDoS protection.
• DMVPN phases: Phase 1 (hub-and-spoke), Phase 2 (spoke-to-spoke with spoke-to-spoke tunnels), Phase 3 (spoke-to-spoke with routing optimizations).
• AnyConnect licensing: There are three tiers: Essentials (basic), Plus (adds advanced features), Apex (adds advanced endpoint analytics).
• SSL VPN vs IPsec: SSL VPN works on any device with a browser, easier through firewalls, but IPsec is more performant and supports all IP traffic.

Final Revision Tips

• Create flashcards for port numbers and protocol characteristics.
• Practice configuring VPNs on simulators (Packet Tracer, GNS3, or EVE-NG).
• Review the Cisco official exam topics list and ensure you can explain each objective in your own words.
• Take multiple mock tests to get comfortable with the format and timing.

Expose the topics you have been skimming by sitting Cisco Implementing Secure Solutions with Virtual Private Networks (SVPN) mock test questions without notes.

If you want to spot weak areas before taking those mock questions, the free study plans and readiness checks can guide which topics to review first.