hardMultiple ChoiceObjective-mapped
CCNP Practice Question: An engineer is configuring a site-to-site VPN…
An engineer is configuring a site-to-site VPN between two Cisco routers using IPsec with IKEv2. The engineer wants to use a pre-shared key. The configuration on both routers includes: crypto ikev2 proposal default, encryption aes-cbc-256, integrity sha256, group 14. The engineer also configures crypto ikev2 keyring and crypto ikev2 profile. The tunnel does not establish. The engineer sees that the IKEv2 SA is not created. What is the most likely missing configuration?
⚠ Common exam trap
Cisco often tests the subtle distinction between configuring the IKEv2 components (proposal, keyring, profile) and actually applying the profile to an interface or crypto map, leading candidates to overlook the final attachment step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IKEv2 profile is not attached to the crypto map or interface.
The IKEv2 profile must be attached to a crypto map or directly to an interface (using 'crypto ikev2 profile' under the crypto map or 'tunnel protection ipsec profile') to be used during IKEv2 negotiation. Without this attachment, the router does not know which profile (and thus which keyring and pre-shared key) to apply, so the IKEv2 SA never forms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IKEv2 proposal is not configured correctly.
Why it's wrong here
The proposal is configured with valid parameters.
- ✓
The IKEv2 profile is not attached to the crypto map or interface.
Why this is correct
Correct because the profile must be applied to activate the configuration.
- ✗
The IPsec transform set is missing.
Why it's wrong here
The transform set is for Phase 2, not Phase 1.
- ✗
The pre-shared key is not defined in the keyring.
Why it's wrong here
The keyring is configured, but not applied.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
One of 1,175 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.