300-410 IPsec Site-to-Site VPN Practice Test 4 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# show crypto ipsec transform-set

Transform set combined-des-sha: { esp-des esp-sha-hmac  } 
   will negotiate = { Tunnel,  },
Transform set myset: { esp-3des esp-sha-hmac  } 
   will negotiate = { Tunnel,  },
Transform set strong: { esp-aes 256 esp-sha-hmac  } 
   will negotiate = { Tunnel,  },

What does this output indicate?

Accepted Answer

The transform set 'combined-des-sha' uses DES, which is not recommended due to security vulnerabilities.. The output shows three transform sets, including 'combined-des-sha', which uses DES (Data Encryption Standard) with a 56-bit key. DES is considered cryptographically weak and has been deprecated due to known vulnerabilities, such as susceptibility to brute-force attacks. Cisco recommends using AES or 3DES as a minimum for production IPsec VPNs, making option B correct.

Answer

All transform sets are using strong encryption and are acceptable for production.

Answer

The transform sets are not configured correctly because they do not specify the mode.

Answer

The transform set 'strong' is not supported because it uses AES 256.

Question 2

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# show crypto engine connections active

Crypto Engine Connections

ID  Type    Algorithm           Encrypt  Decrypt LastSeqNo
    1  IPsec   ESP-3DES+SHA           0        0         0
    2  IPsec   ESP-3DES+SHA           0        0         0
    3  IPsec   ESP-AES+SHA            0        0         0

What does this output indicate?

Accepted Answer

The IPsec SAs are established but no traffic is flowing, possibly due to routing or ACL issues.. The output shows three IPsec Security Associations (SAs) with zero encrypted and zero decrypted packets, and a LastSeqNo of 0. This indicates the SAs are established (the tunnels are up) but no traffic is being processed through them. The most common causes are routing issues preventing traffic from reaching the tunnel interface, or ACLs that do not match the interesting traffic for encryption.

Answer

The IPsec VPN is actively encrypting and decrypting traffic.

Answer

The crypto engine is overloaded and cannot process packets.

Answer

The IPsec SAs are using the wrong transform set.

Question 3

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# show crypto map

Crypto Map "CMAP" 10 ipsec-isakmp
    Peer = 192.168.2.2
    Extended IP access list 101
        access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    Current peer: 192.168.2.2
    Security association lifetime: 4608000 kilobytes/3600 seconds
    PFS (Y/N): N
    Transform sets={myset, }
    Interfaces using crypto map CMAP:
        Tunnel0

What does this output indicate?

Accepted Answer

The crypto map is correctly configured for a site-to-site VPN with the peer 192.168.2.2.. Option B is correct because the output shows a properly configured IPsec site-to-site VPN crypto map. It includes a peer (192.168.2.2), an extended ACL (101) that correctly matches the local and remote subnets (192.168.1.0/24 and 192.168.2.0/24), a transform set (myset), and is applied to Tunnel0, which is typical for a site-to-site VPN. The security association lifetime and PFS settings are also present, confirming a valid configuration.

Answer

The crypto map is misconfigured because it uses an extended ACL with source and destination subnets.

Answer

The crypto map is missing the transform set.

Answer

The crypto map should be applied to the physical interface instead of the tunnel.

Question 4

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# show ip route 192.168.2.0

Routing entry for 192.168.2.0/24
  Known via "eigrp 100", distance 90, metric 2684416, type internal
  Redistributing via eigrp 100
  Last update from 10.0.0.2 on Tunnel0, 00:00:23 ago
  Routing Descriptor Blocks:
  * 10.0.0.2, from 10.0.0.2, via Tunnel0
      Route metric is 2684416, traffic share count is 1
      Total delay is 20000 microseconds, minimum bandwidth is 100000 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 1

What does this output indicate?

Accepted Answer

The IPsec tunnel is up and EIGRP is exchanging routes over the tunnel.. The output shows a route to 192.168.2.0/24 learned via EIGRP (distance 90) with the next hop 10.0.0.2 reachable through Tunnel0. The last update was 23 seconds ago, confirming the tunnel is up and EIGRP is actively exchanging routing information over the IPsec tunnel. This indicates the IPsec Site-to-Site VPN is functioning and dynamic routing is working correctly.

Answer

The route to the remote LAN is not present, indicating a routing issue.

Answer

The route is using a static route, not a dynamic routing protocol.

Answer

The tunnel interface is down, causing the route to be unreachable.

Question 5

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# show crypto isakmp policy

Global IKE policy
Protection suite of priority 10
        encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #5 (1536 bit)
        lifetime:               86400 seconds, no volume limit
Default protection suite
        encryption algorithm:   DES - Data Encryption Standard (56 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #1 (768 bit)
        lifetime:               86400 seconds, no volume limit

What does this output indicate?

Accepted Answer

The IKE policy is correctly configured with strong encryption and DH group.. Option A is correct because the output shows a global IKE policy with priority 10 using AES-256 encryption, SHA hash, Pre-Shared Key authentication, and Diffie-Hellman group 5 (1536-bit). These parameters represent a strong and secure IKE policy configuration suitable for a production IPsec VPN. The default protection suite is irrelevant unless the peer does not match the higher-priority policy, so the active policy is the one configured with priority 10.

Answer

The IKE policy uses DES, which is insecure and should be changed.

Answer

The IKE policy is missing the authentication method.

Answer

The IKE policy lifetime is set to 86400 seconds, which is too short.

Question 6

What is the default IKE (ISAKMP) lifetime value in Cisco IOS for IPsec Site-to-Site VPN?

Accepted Answer

86400 seconds (24 hours). The default IKE (ISAKMP) lifetime in Cisco IOS for IPsec Site-to-Site VPN is 86400 seconds (24 hours). This value is defined in the ISAKMP policy and controls how long the IKE Phase 1 security association (SA) remains active before requiring re-authentication. A longer lifetime reduces the overhead of re-establishing the Phase 1 tunnel, balancing security with performance.

Answer

3600 seconds (1 hour)

Answer

28800 seconds (8 hours)

Answer

180 seconds (3 minutes)

Question 7

Which default IPsec transform set is automatically created in Cisco IOS when configuring a site-to-site VPN?

Accepted Answer

No default transform set is created. Cisco IOS does not automatically create any default IPsec transform set when configuring a site-to-site VPN. Transform sets must be explicitly defined using the `crypto ipsec transform-set` command, which specifies the encryption and authentication algorithms. The absence of a default ensures that administrators intentionally select the appropriate security parameters for their environment.

Answer

esp-aes 256 esp-sha-hmac

Answer

esp-3des esp-sha-hmac

Answer

esp-aes 128 esp-md5-hmac

Question 8

In IPsec site-to-site VPN, what is the default Diffie-Hellman (DH) group used in IKEv1 phase 1 on Cisco IOS?

Accepted Answer

DH group 1 (768-bit). In Cisco IOS, the default Diffie-Hellman group for IKEv1 Phase 1 is DH group 1 (768-bit). This is defined in the default ISAKMP policy (policy 100) that is automatically present when no custom policy is configured. If no DH group is explicitly specified, the router uses group 1 by default, which provides the lowest security level but ensures backward compatibility.

Answer

DH group 2 (1024-bit)

Answer

DH group 5 (1536-bit)

Answer

No default DH group; negotiation fails if not set

Question 9

Which statement correctly describes the default behavior of Dead Peer Detection (DPD) in Cisco IOS for IPsec site-to-site VPN?

Accepted Answer

DPD is disabled by default. Dead Peer Detection (DPD) is disabled by default in Cisco IOS for IPsec site-to-site VPNs. This means that without explicit configuration using the 'crypto isakmp keepalive' command, the router will not send DPD messages to verify the liveness of the remote peer. DPD must be manually enabled to detect peer failures and trigger failover or tunnel teardown.

Answer

DPD is enabled by default with a 10-second interval

Answer

DPD is enabled by default with a 30-second interval

Answer

DPD is enabled only for IKEv2 by default

Question 10

In IPsec site-to-site VPN, what is the default IPsec SA lifetime in Cisco IOS?

Accepted Answer

3600 seconds and 4608000 kilobytes. Option B is correct because the default IPsec Security Association (SA) lifetime in Cisco IOS for site-to-site VPNs is 3600 seconds (1 hour) and 4,608,000 kilobytes (4.5 GB). These values are defined in the IPsec transform set configuration and control when the SA expires, triggering a rekey via IKEv1 or IKEv2 to maintain secure communication.

Answer

86400 seconds and 256000 kilobytes

Answer

28800 seconds and 1000000 kilobytes

Answer

1800 seconds and 256000 kilobytes

Question 11

Which authentication method is used by default in IKEv1 main mode for IPsec site-to-site VPN on Cisco IOS?

Accepted Answer

Pre-shared keys. In Cisco IOS, IKEv1 main mode for IPsec site-to-site VPN defaults to pre-shared keys (PSK) as the authentication method. This is because PSK is the simplest to configure and does not require a public key infrastructure (PKI), making it the default choice when no other authentication method is explicitly specified. The configuration commands like 'crypto isakmp key' directly implement PSK authentication.

Answer

RSA signatures

Answer

Elliptic Curve Digital Signature Algorithm (ECDSA)

Answer

No default; authentication must be explicitly configured

Question 12

In Cisco IOS, what is the default encryption algorithm for IKEv1 phase 1 if not specified in the ISAKMP policy?

Accepted Answer

DES. In Cisco IOS, when an IKEv1 ISAKMP policy is configured without specifying an encryption algorithm, the default encryption algorithm is DES (Data Encryption Standard). This is because Cisco IOS defaults to DES for IKEv1 phase 1 if no encryption is explicitly defined in the ISAKMP policy, as per the default policy parameters. DES uses a 56-bit key and is considered weak by modern standards, but it remains the default for backward compatibility.

Answer

AES 256

Answer

3DES

Answer

AES 128

Question 13

What is the default hash algorithm for IKEv1 phase 1 in Cisco IOS when not explicitly configured?

Accepted Answer

MD5. In Cisco IOS, when IKEv1 phase 1 parameters are not explicitly configured, the default hash algorithm is MD5. This is because the default IKE proposal in Cisco IOS includes MD5 as the hash algorithm, along with DES encryption and Diffie-Hellman group 1. MD5 was chosen historically for its lower computational overhead, though it is now considered cryptographically weak.

Answer

SHA-1

Answer

SHA-256

Answer

No default; hash must be configured

Question 14

In Cisco IOS, what is the default IKEv1 phase 1 authentication method when using a pre-shared key and no explicit authentication is configured?

Accepted Answer

Pre-shared key. When no explicit authentication method is configured for IKEv1 phase 1 and a pre-shared key is used, Cisco IOS defaults to 'pre-shared key' authentication. This is because the pre-shared key itself defines the authentication mechanism; the router automatically selects the appropriate authentication method based on the configured key material.

Answer

RSA encrypted nonces

Answer

Digital signatures (RSA-SIG)

Answer

No default; authentication must be explicitly set

Question 15

Drag and drop the steps to negotiate an IKEv2 IPsec site-to-site tunnel into the correct order, from first to last.

Accepted Answer

Initiate IKE_SA_INIT exchange. IKEv2 negotiation begins with Phase 1 (IKE_SA_INIT) to establish a secure channel, followed by IKE_AUTH to authenticate and exchange identities. Phase 2 (CREATE_CHILD_SA) then negotiates the IPsec SA, and the final step installs the IPsec security associations into the data plane.