CCNP Practice Question: Examine the following IPsec configuration…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The transform set uses ESP with AES-256 encryption and SHA-256 HMAC for authentication.

  Why this is correct

  The transform set is correctly defined. The commands `esp-aes 256` and `esp-sha256-hmac` under `crypto ipsec transform-set` specify the Encapsulating Security Payload (ESP) with AES-256 for confidentiality and the SHA-256 HMAC variant for integrity and authentication. This is a valid and secure combination for a site-to-site IPsec VPN. The statement matches the configuration, making it the correct answer.

• ✗

  The IKEv2 proposal uses AES-256, SHA-256, and DH group 14, but the IPsec profile will not apply because the ikev2-profile command is missing the 'set' keyword.

  Why it's wrong here

  The `set` keyword is indeed present. In Cisco IOS, the IPsec profile references the IKEv2 parameter set using the command `set ikev2-profile IKEV2_POL`; omitting `set` would make the command invalid, but here it is explicitly listed. Additionally, there is no requirement that the IKEv2 policy name differ from the profile name—they can be identical. Therefore the IPsec profile will apply as intended.

• ✗

  The transform set is configured in transport mode, which is incorrect for site-to-site VPN.

  Why it's wrong here

  This claim is false because the transform set is not in transport mode. The configuration explicitly includes the `mode tunnel` command, which overrides the default transport mode and sets the transform set to use IPsec tunnel mode—essential for site-to-site VPNs that encapsulate the entire original IP packet. Transport mode is typically used only for end-to-end host communications or within a GRE-protected tunnel, not for classic site-to-site IPsec deployments. Thus, this option is wrong.

• ✗

  The IPsec profile is incomplete because it does not include a PFS (Perfect Forward Secrecy) setting.

  Why it's wrong here

  PFS (Perfect Forward Secrecy) is not a required element of a valid IPsec profile. In Cisco IOS, PFS is enabled via the `set pfs` command within the crypto map or IPsec profile; while it improves security by ensuring session keys are not derived from persistent keys, its absence does not make the configuration incomplete. The profile can still be applied and the VPN will function correctly. Therefore, claiming the profile is incomplete for lacking PFS is incorrect.