CCNP Infrastructure Practice Question

A network engineer is configuring a Cisco IOS router to establish a site-to-site VPN with a remote peer using IKEv2. The engineer wants to ensure that the router uses a pre-shared key for authentication and that the IKEv2 proposal uses AES-256 for encryption and SHA-256 for integrity. Which configuration sequence correctly sets up the IKEv2 proposal and keyring?

⚠ Common exam trap

The trap here is using incorrect keywords like aes-256 instead of aes-cbc-256, or omitting the remote pre-shared key, which are common syntax errors in IKEv2 configuration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

crypto ikev2 proposal PROPOSAL1; encryption aes-cbc-256; integrity sha256; group 14; crypto ikev2 keyring KEYRING1; peer PEER1; address 203.0.113.1; pre-shared-key local Cisco123; pre-shared-key remote Cisco123

The correct configuration includes the proper IKEv2 proposal with encryption aes-cbc-256 and integrity sha256, and a keyring with both local and remote pre-shared keys. This ensures the router can authenticate with the remote peer using the correct cryptographic parameters.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
crypto ikev2 proposal PROPOSAL1; encryption aes-cbc-256; integrity sha256; group 14; crypto ikev2 keyring KEYRING1; peer PEER1; address 203.0.113.1; pre-shared-key local Cisco123; pre-shared-key remote Cisco123
Why this is correct
This sequence correctly defines an IKEv2 proposal with AES-256 encryption, SHA-256 integrity, and DH group 14. It then creates a keyring with a peer address and matching local and remote pre-shared keys. This is the proper syntax for IKEv2 configuration on Cisco IOS, ensuring the proposal and keyring are correctly associated for the VPN.
✗
crypto ikev2 proposal PROPOSAL1; encryption aes-cbc-256; integrity sha256; group 14; crypto ikev2 keyring KEYRING1; peer PEER1; address 203.0.113.1; pre-shared-key local Cisco123
Why it's wrong here
This configuration is missing the pre-shared-key remote command. For IKEv2, the keyring peer must have both local and remote pre-shared keys defined. Without the remote key, the authentication will fail. The local key alone is insufficient for a successful VPN establishment.
✗
crypto ikev2 policy POLICY1; encryption aes-cbc-256; integrity sha256; group 14; crypto ikev2 keyring KEYRING1; peer PEER1; address 203.0.113.1; pre-shared-key local Cisco123; pre-shared-key remote Cisco123
Why it's wrong here
The command crypto ikev2 policy is used to define an IKEv2 policy, not a proposal. A proposal is defined with crypto ikev2 proposal. The policy then references the proposal. This sequence omits the proposal definition and directly configures a policy, which would not work because the encryption and integrity parameters belong in the proposal.
✗
crypto ikev2 proposal PROPOSAL1; encryption aes-256; integrity sha-256; group 14; crypto ikev2 keyring KEYRING1; peer PEER1; address 203.0.113.1; pre-shared-key Cisco123
Why it's wrong here
The encryption and integrity keywords are incorrect for IKEv2 on Cisco IOS. The correct syntax uses encryption aes-cbc-256 and integrity sha256. Also, the pre-shared-key command requires both local and remote keywords to specify the keys for each side. This configuration would be rejected by the router.

Quick reference

VPN Protocol Comparison

Protocol	Port	Encryption	Authentication	Use Case
IKEv2 / IPsec	UDP 500 / 4500	AES-256	Certificates / PSK	Site-to-site & remote access
SSL / TLS VPN	TCP 443	TLS 1.3	Certificates / MFA	Clientless remote access
L2TP / IPsec	UDP 1701	AES (IPsec)	PSK / Certificates	Legacy remote access
WireGuard	UDP 51820	ChaCha20	Public keys	Modern high-performance VPN
PPTP	TCP 1723	MPPE (weak)	MS-CHAPv2	Legacy — avoid in production

PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.

About these practice questions

This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed September 2026 · checked against the official Cisco exam blueprint

Ready to practise?

Put this into practice with a full scored session.

Start practice session

Scored practice sessions

Quick scored rounds with instant marking and a written explanation per question.

CCNP Practice Test 5 — 25 Questions→Free CCNP Practice Test 3 — 30 Questions→

Study by exam domain

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Infrastructure Network Assurance Architecture

Practice by scenario

Filter questions by type — troubleshooting, exhibit, drag-and-drop, PBQ, ACLs, OSPF, and more.

Browse scenarios

Practice by topic

Each topic page collects the questions that test one concept, plus the theory behind it.

Infrastructure practice questions Automation practice questions ENCOR SD-Access practice questions ENCOR ACLs and CoPP practice questions ENCOR BGP practice questions

Where to go next

Study guide All Cisco practice questions All 350-401 questions

This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.