CCSM Advanced VPN Troubleshooting Practice Question
A Check Point administrator is troubleshooting an IPsec VPN where Phase 2 negotiations fail with the error 'No proposal chosen'. The peer is a Cisco ASA. Both gateways are configured with AES-256 and SHA-256 for Phase 2. What is the most likely cause?
⚠ Common exam trap
The trap here is assuming that Phase 2 errors are caused by a Phase 1 mismatch, when in fact Phase 2 negotiation uses its own independent parameters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Phase 2 PFS group is not identical on both gateways.
The error 'No proposal chosen' during Phase 2 indicates that the two gateways could not agree on a Phase 2 proposal. PFS group, encryption, and hashing must match exactly. Since encryption and hashing are already aligned, the PFS group setting is the likely culprit and must be identical on both peers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPN tunnel interface is not configured with the correct IP address.
Why it's wrong here
Interface IP misconfiguration would prevent the tunnel from establishing at all, often with routing or connectivity errors. Since Phase 2 negotiation has been reached, basic connectivity and Phase 1 are functional; the failure is due to a Phase 2 proposal mismatch, not interface addressing.
- ✗
The shared secret for the VPN community is incorrect.
Why it's wrong here
An incorrect shared secret would cause a Phase 1 authentication failure, typically logged as 'Phase 1 completion failed' or 'Authentication failed'. Phase 2 'No proposal chosen' specifically points to a mismatch in Phase 2 parameters such as encryption, hashing, or PFS, not the pre-shared key.
- ✓
The Phase 2 PFS group is not identical on both gateways.
Why this is correct
PFS group is negotiated in Phase 2. If one gateway proposes a PFS group and the other does not or uses a different group, the responder cannot select a matching proposal, resulting in 'No proposal chosen'. Ensuring the PFS group (e.g., Group 5, 14) matches on both peers resolves the error.
- ✗
The Phase 1 encryption algorithms do not match between the gateways.
Why it's wrong here
Phase 1 encryption mismatch would cause an IKE Phase 1 failure, not a Phase 2 'No proposal chosen' error. Phase 1 and Phase 2 are negotiated independently; a Phase 2 failure indicates the issue lies within Phase 2 settings or the related PFS configuration, not the Phase 1 encryption algorithm.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
One of 219 original CCSM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This CCSM practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSM exam.