CCNP Security Practice Question
A network administrator is configuring a Cisco IOS router to terminate a site-to-site IPsec VPN with a remote peer that uses dynamic public IP addressing. The administrator wants the router to accept IKE negotiations from any peer that presents a valid pre-shared key and matches a specific protected subnet. Which configuration element is required to support this?
⚠ Common exam trap
The trap here is thinking that a wildcard pre-shared key alone allows any peer, when the crypto map must also be dynamic to learn the unknown peer address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A dynamic crypto map entry referenced by a static crypto map, with the remote peer address set to 0.0.0.0.
To accept IPsec negotiations from a peer whose IP address is not known in advance, the headend uses a dynamic crypto map entry that has no configured peer address. A static crypto map references it, so incoming IKE negotiations can be matched, the peer address learned, and the appropriate transform set and ACL applied to build the tunnel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A dynamic crypto map entry referenced by a static crypto map, with the remote peer address set to 0.0.0.0.
Why this is correct
When the remote peer has an unknown or changing IP address, the headend uses a dynamic crypto map entry with no set peer address so it can accept IKE proposals from any source. A static crypto map references the dynamic map with the set crypto map dynamic command, allowing the router to learn the peer address from the incoming negotiation and apply the correct transform set and ACL.
- ✗
A static crypto map with set peer 0.0.0.0 and a wildcard pre-shared key on the local router.
Why it's wrong here
A static crypto map entry requires a specific peer address; using 0.0.0.0 in a static entry is not the supported method for accepting unknown peers. Wildcard pre-shared keys can match any peer identity for authentication, but the crypto map itself must be dynamic to accept negotiations from an unknown address. This combination does not correctly build the required dynamic tunnel.
- ✗
An IKEv2 profile with match identity remote address 0.0.0.0 and a certificate map for peer authentication.
Why it's wrong here
An IKEv2 profile can match remote identities broadly, but the scenario specifies pre-shared key authentication rather than certificates, so a certificate map is inappropriate. More importantly, the question describes a classic crypto map based IPsec configuration; the IKEv2 profile alone does not define the protected traffic or the dynamic peer acceptance in the way a dynamic crypto map does for this design.
- ✗
A GRE tunnel with IPsec transport mode protecting the tunnel endpoints and dynamic routing over the tunnel.
Why it's wrong here
GRE over IPsec can support dynamic peers if the tunnel source is reachable, but it adds overlay complexity and does not directly answer the requirement of accepting IKE from any peer matching a protected subnet. The question asks for the configuration element enabling dynamic peer acceptance in an IPsec site-to-site design, which is the dynamic crypto map, not a GRE overlay.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.