300-410 IPsec Site-to-Site VPN Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show crypto map
Crypto Map "VPN-MAP" 10 ipsec-isakmp
    Peer = 10.1.1.2
    Extended IP access list 100
        access-list 100 permit ip 10.1.1.0 0.0.0.255 192.168.1.0 0.0.0.255
    Current peer: 10.1.1.2
    Security association lifetime: 4608000 kilobytes/3600 seconds
    PFS (Y/N): N
    Transform sets={ESP-AES256-SHA,}
    Interfaces using crypto map VPN-MAP:
        Tunnel0

Based on this output, which statement is correct?

Accepted Answer

The crypto map is applied to interface Tunnel0 and uses ACL 100 to define interesting traffic.. The crypto map is applied to Tunnel0 and uses ACL 100 to match traffic from 10.1.1.0/24 to 192.168.1.0/24. This is a typical site-to-site VPN configuration.

Answer

Perfect Forward Secrecy (PFS) is enabled.

Answer

The crypto map uses dynamic IPsec peer discovery.

Answer

The crypto map is not applied to any interface.

Question 2

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa | include pkts
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

Based on this output, what is the problem?

Accepted Answer

No interesting traffic is being sent through the tunnel; check the crypto ACL and routing.. All packet counters are zero, indicating no traffic has been encrypted or decrypted. This could be due to a misconfigured crypto ACL that does not match the actual traffic, or routing issues preventing traffic from reaching the tunnel.

Answer

The IPsec SA is not established; the tunnel is down.

Answer

The tunnel is working correctly; all packets are being encrypted.

Answer

The remote peer is not responding; the SA is in MM_NO_STATE.

Question 3

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa detail
Codes: C - IKEv1, I - IKEv2

C-id  Local       Remote      I-VRF    Status Encr Hash Auth DH     Lifetime Cap
1     10.1.1.1    10.1.1.2              ACTIVE aes  sha  psk  14    23:59:59

Based on this output, which statement is correct?

Accepted Answer

The IKEv1 SA is established with the peer 10.1.1.2.. The ISAKMP SA is active, using AES encryption, SHA hash, pre-shared key authentication, and Diffie-Hellman group 14. The lifetime is about 24 hours.

Answer

The IKEv2 SA is established with the peer 10.1.1.2.

Answer

The ISAKMP SA is not established; status is MM_NO_STATE.

Answer

The Diffie-Hellman group is group 2.

Question 4

Given the following partial configuration on router R1:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
 lifetime 86400
!
crypto isakmp key cisco123 address 192.168.1.2
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.2
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

What is the effect of this configuration?

Accepted Answer

IPsec tunnel is established when traffic from 10.1.1.0/24 to 10.2.2.0/24 triggers it.. Option A is correct because the configuration uses a crypto map with 'match address 101' referencing an ACL that permits traffic from 10.1.1.0/24 to 10.2.2.0/24. This triggers IPsec SA negotiation via ISAKMP (IKEv1) only when interesting traffic is detected. The tunnel is established dynamically upon matching traffic, which is the standard behavior for a site-to-site VPN using a crypto map.

Answer

The tunnel will only be established if the peer initiates first.

Answer

The transform set uses AES 256 with MD5 authentication, which is incorrect.

Answer

ISAKMP lifetime is set to 86400 seconds, which is too short for a site-to-site VPN.

Question 5

Consider the following configuration on router R2:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
 lifetime 3600
!
crypto isakmp key secretkey address 192.168.1.1
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.1
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.2 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255

Which statement is true?

Accepted Answer

The IKE phase 1 will fail due to ISAKMP lifetime mismatch.. The correct answer is B because the ISAKMP lifetime configured on R2 is 3600 seconds (1 hour), but the question implies the remote peer (192.168.1.1) has a different lifetime (likely the default of 86400 seconds). During IKE phase 1 negotiation, the peers propose their lifetimes, and if they do not match, the session fails because Cisco IOS requires identical lifetime values for successful phase 1 establishment. This mismatch causes the IKE phase 1 to fail, preventing the IPsec tunnel from forming.

Answer

The IPsec tunnel will establish successfully because the transform sets match.

Answer

The tunnel will work but will rekey every hour due to the shorter lifetime.

Answer

The pre-shared key mismatch will cause the tunnel to fail.

Question 6

Given the partial configuration:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
!
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.2
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

What is the effect of the 'crypto isakmp key' command with address 0.0.0.0 0.0.0.0?

Accepted Answer

The key will be accepted from any peer, creating a security vulnerability.. The `crypto isakmp key` command with address `0.0.0.0 0.0.0.0` acts as a wildcard, meaning the pre-shared key will be accepted from any peer IP address during IKE Phase 1 authentication. This effectively disables peer-specific validation, allowing any device that knows the key to establish an ISAKMP SA, which is a significant security vulnerability.

Answer

The key will be used only for peer 192.168.1.2 because the crypto map specifies that peer.

Answer

The configuration will fail because the key must specify a specific peer address.

Answer

The key will be ignored because there is no ISAKMP policy with a lifetime.

Question 7

Examine this configuration on router R1:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
 lifetime 86400
!
crypto isakmp key cisco123 address 192.168.1.2
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.2
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

What is missing from this configuration to ensure the tunnel works correctly?

Accepted Answer

Nothing is missing; the configuration is correct.. The configuration is complete for a site-to-site IPsec VPN. ISAKMP policy 10 specifies AES-256 encryption, pre-shared key authentication, Diffie-Hellman group 14, and a lifetime of 86400 seconds (the default is 86400, so explicitly setting it is fine). The crypto map CMAP binds the transform set TSET (AES-256, SHA-HMAC) to peer 192.168.1.2 and matches interesting traffic via access-list 101 (10.1.1.0/24 to 10.2.2.0/24). The interface GigabitEthernet0/1 applies the crypto map. A route to the remote LAN is not required because IPsec encrypts traffic based on the crypto ACL; routing only needs to reach the peer's public IP (192.168.1.2), which is directly connected on the same subnet.

Answer

A route to the remote LAN 10.2.2.0/24 is missing.

Answer

The ISAKMP policy needs a 'lifetime' value.

Answer

The transform set should include 'mode transport' for site-to-site.

Question 8

Given this configuration on router R1:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
 lifetime 86400
!
crypto isakmp key cisco123 address 192.168.1.2
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.2
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

What will happen when traffic from 10.1.1.0/24 to 10.2.2.0/24 is generated?

Accepted Answer

The traffic will be forwarded normally without encryption.. Option B is correct because the crypto map is not applied to any interface. Without the `crypto map CMAP` command under GigabitEthernet0/1, the router has no IPsec policy to enforce on that interface. Traffic matching access-list 101 will simply be forwarded normally as clear-text IP packets, since no encryption is triggered.

Answer

The traffic will be dropped because the ACL denies it.

Answer

The router will attempt to establish an IPsec tunnel but fail because the crypto map is missing.

Answer

The router will create a dynamic crypto map entry automatically.

Question 9

Consider the following configuration on router R1:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
 lifetime 86400
!
crypto isakmp key cisco123 address 192.168.1.2
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.2
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

If the remote peer has an ISAKMP policy with encryption 3des, what will happen?

Accepted Answer

IKE phase 1 will fail due to encryption algorithm mismatch.. IKE phase 1 requires both peers to have a matching ISAKMP policy, including the encryption algorithm. Since R1 is configured with AES 256 and the remote peer uses 3DES, there is no common proposal, causing phase 1 to fail. Cisco IOS does not automatically negotiate or fall back to a different encryption algorithm; the mismatch results in a failed IKE SA.

Answer

The tunnel will use 3DES because the remote peer's policy is accepted.

Answer

The router will automatically adjust to use 3DES.

Answer

The tunnel will establish but use AES 256 anyway.

Question 10

In IPsec site-to-site VPN, what is the default lifetime for ISAKMP (IKE phase 1) security associations on Cisco IOS routers?

Accepted Answer

86400 seconds (24 hours). The default lifetime for ISAKMP (IKE phase 1) security associations on Cisco IOS routers is 86400 seconds (24 hours). This is defined in the Cisco IOS default configuration for the `crypto isakmp policy` and is the recommended value to balance security and performance by reducing the frequency of re-authentication and Diffie-Hellman key exchanges.

Answer

3600 seconds (1 hour)

Answer

28800 seconds (8 hours)

Answer

1800 seconds (30 minutes)

Question 11

Which Diffie-Hellman group is considered the minimum recommended for secure IPsec site-to-site VPNs according to current best practices?

Accepted Answer

Group 14. Diffie-Hellman Group 14 (2048-bit MODP) is the minimum recommended for secure IPsec site-to-site VPNs because it provides sufficient key strength against modern computational attacks, including those from quantum-capable adversaries in the near future. Groups 1 and 2 (768-bit and 1024-bit) are considered weak and deprecated due to the Logjam attack (CVE-2015-4000) and advances in factoring, while Group 5 (1536-bit) is also no longer recommended as it does not meet current NIST SP 800-131A guidelines for minimum 2048-bit Diffie-Hellman strength.

Answer

Group 1

Answer

Group 2

Answer

Group 5

Question 12

In IPsec site-to-site VPN, what is the purpose of the 'match address' command under a crypto map?

Accepted Answer

It identifies the traffic that will be encrypted and sent through the tunnel.. The 'match address' command under a crypto map references an access list (ACL) that defines which traffic should be protected by IPsec. When a packet matches a permit entry in that ACL, it triggers the IPsec process to encrypt and tunnel the traffic to the remote peer. This is the fundamental mechanism for selecting interesting traffic in a site-to-site VPN.

Answer

It specifies the peer IP address for the tunnel.

Answer

It defines the encryption and authentication algorithms.

Answer

It sets the lifetime for the IPsec SA.

Question 13

Which TWO commands would a network engineer use to verify the status of IPsec security associations on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show crypto ipsec sa. The 'show crypto ipsec sa' command displays the IPsec security associations (SAs) that have been negotiated, including their SPI numbers, encryption and authentication algorithms, and packet counters. This is the primary command to verify that IPsec SAs are active and that traffic is being encrypted and decrypted correctly. The 'show crypto isakmp sa' command shows the IKE (ISAKMP) phase 1 SAs, which are necessary for establishing the IPsec SAs, making it a complementary verification step.

Answer

show crypto map

Answer

show ip route

Answer

show crypto engine connections active

Question 14

Which TWO statements about IPsec site-to-site VPN configuration using IKEv1 are true? (Choose TWO.)

Accepted Answer

IKEv1 phase 1 establishes the ISAKMP SA, which is bidirectional.. IKEv1 phase 1 establishes the ISAKMP Security Association (SA), which is used to securely negotiate the IPsec SAs in phase 2. This ISAKMP SA is bidirectional, meaning a single SA protects both inbound and outbound IKE traffic between the peers.

Answer

IKEv1 phase 2 uses the crypto isakmp policy to negotiate IPsec SAs.

Answer

IPsec SAs are unidirectional and require two SAs per tunnel.

Answer

The 'crypto ipsec transform-set' command defines the IKEv1 phase 1 policy.

Question 15

Which TWO configuration steps are required to enable IPsec site-to-site VPN with IKEv2 on a Cisco router? (Choose TWO.)

Accepted Answer

Configure an IKEv2 keyring with the pre-shared key.. Option A is correct because an IKEv2 keyring stores the pre-shared key (PSK) used for authenticating the remote peer during IKEv2 SA establishment. Without a keyring, the router has no local credential to present or verify against the peer. Option B is correct because an IKEv2 proposal defines the mandatory encryption (e.g., AES-256) and integrity (e.g., SHA-256) algorithms that both peers must agree on for the IKEv2 Phase 1 (IKE SA) negotiation.

Answer

Configure a crypto isakmp policy for phase 1.

Answer

Configure an IKEv2 profile and bind it to the crypto map.

Answer

Configure the 'crypto ipsec transform-set' command.