CCNP Virtualization Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure ISAKMP policy, then IPsec transform set, then crypto ACL, then create and apply crypto map

  Why this is correct

  This is the correct order because IKE phase 1 (ISAKMP policy) must be configured first to establish a secure channel, followed by phase 2 (transform set) to define encryption and hashing, then the ACL to specify interesting traffic, and finally the crypto map to bind everything together and apply it to the interface.

• ✗

  Configure IPsec transform set, then ISAKMP policy, then crypto ACL, then create and apply crypto map

  Why it's wrong here

  This sequence violates the IKE dependency model because the ISAKMP policy (IKE phase 1) must be configured before any IPsec transform set (IKE phase 2). The transform set's encryption and integrity algorithms are negotiated only after phase 1 has established the secure channel, so configuring the transform set first leaves the router unable to complete IKE SA negotiation with the peer. Additionally, the crypto ACL and crypto map cannot function correctly without a valid ISAKMP policy in place, because the router lacks the hash, encryption, and authentication parameters needed to protect the phase 1 exchange itself.

• ✗

  Configure ISAKMP policy, then IPsec transform set, then create and apply crypto map, then crypto ACL

  Why it's wrong here

  This order is incorrect because the crypto ACL must be defined before creating the crypto map, as the crypto map references the ACL to identify traffic to be encrypted. Applying the crypto map without the ACL would result in no traffic being encrypted.

• ✗

  Configure crypto ACL, then ISAKMP policy, then IPsec transform set, then create and apply crypto map

  Why it's wrong here

  This order is incorrect because the ISAKMP policy and transform set must be configured before the crypto ACL and crypto map are applied. The ACL can be defined earlier, but the overall sequence should start with IKE phase 1.