CCSM Advanced VPN Troubleshooting Practice Question
A Check Point Security Gateway is configured with a site-to-site VPN to a third-party gateway. The administrator notices that the VPN tunnel goes down and comes back up every hour. The logs show 'IKE Phase 2 rekey failed' just before the tunnel drops. Which of the following is the most likely cause of this rekey failure?
⚠ Common exam trap
The trap here is focusing on Phase 1 issues like shared secret, but the error specifically points to Phase 2 rekey, which is governed by SA lifetime and other Phase 2 parameters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Phase 2 SA lifetime is mismatched between the two gateways.
The most likely cause is a mismatch in Phase 2 SA lifetime. When lifetimes differ, the gateway with the shorter lifetime initiates rekey, but the other gateway may not accept it if it still has a valid SA, leading to rekey failure and tunnel re-establishment. This creates a periodic drop pattern. Ensuring both peers use the same SA lifetime prevents this.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Phase 1 shared secret has been changed on one gateway.
Why it's wrong here
A shared secret mismatch would cause Phase 1 to fail, preventing any tunnel establishment. Since the tunnel is up and only rekey fails, the shared secret is correct. Phase 1 rekey might occur, but the error explicitly mentions Phase 2 rekey, so the issue is in the IPsec SA parameters, not the IKE SA.
- ✓
The Phase 2 SA lifetime is mismatched between the two gateways.
Why this is correct
If the Phase 2 SA lifetime differs, the gateway with the shorter lifetime will initiate a rekey before the other expects it. The other gateway may reject the rekey because it still considers the old SA valid, or the rekey may fail due to timing. This causes the tunnel to drop and re-establish, often at regular intervals matching the shorter lifetime. Matching SA lifetimes resolves the issue.
- ✗
The VPN community is configured with overlapping encryption domains.
Why it's wrong here
Overlapping encryption domains can cause routing or policy issues, but they do not typically cause periodic rekey failures. Rekey failures are tied to the IKE/IPsec SA parameters, such as lifetime, not to the encryption domain definitions. Overlapping domains might cause traffic to be dropped or misrouted, but not a regular tunnel drop every hour.
- ✗
The Diffie-Hellman group for Phase 2 is mismatched.
Why it's wrong here
A Diffie-Hellman group mismatch in Phase 2 would cause the initial Quick Mode negotiation to fail, preventing the tunnel from coming up at all. Since the tunnel is established and only the rekey fails, the initial Phase 2 must have succeeded, implying the DH group matches. The problem is likely with the SA lifetime or other rekey parameters.
About these practice questions
This CCSM question is part of Courseiva's 219-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This CCSM practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSM exam.