CCNP Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  crypto ipsec transform-set <name> esp-aes 256 esp-sha256-hmac

  Why it's wrong here

  The transform-set command defines the encryption and authentication algorithms (AES-256 and SHA-256) used to protect the data. It does not control how often the tunnel is rekeyed. The lifetime is a separate parameter. While this command is required to meet the encryption and authentication requirements, it does not address the 3600-second rekey interval.

• ✗

  crypto map <name> 10 ipsec-isakmp

  Why it's wrong here

  The 'crypto map' command creates a crypto map entry that ties together the peer, transform set, and ACL for IPsec. It does not set the rekey interval. The lifetime is configured globally or per-crypto-map with the 'set security-association lifetime' command, but the crypto map itself only references the policy. This option is a necessary but insufficient component for the scenario.

• ✓

  crypto ipsec security-association lifetime seconds 3600

  Why this is correct

  The 'crypto ipsec security-association lifetime seconds 3600' command sets the IPsec SA lifetime to 3600 seconds, after which the SA is rekeyed. This is the correct command to control the rekey interval for the IPsec (data) tunnel. The IKE SA lifetime is controlled separately with 'crypto isakmp policy' or 'crypto ikev2 policy' settings, but the IPsec SA lifetime is what governs data tunnel rekeying.

• ✗

  crypto isakmp key <key> address <peer>

  Why it's wrong here

  The 'crypto isakmp key' command configures the pre-shared key used for IKE authentication between peers. It does not control any lifetime or rekey interval. While essential for establishing the IKE SA, it is unrelated to the 3600-second rekey requirement for the IPsec tunnel. Confusing this with lifetime settings is a common pitfall.