CCNP Practice Question: Drag and drop the steps of IKEv2 IPsec tunnel…

Drag and drop the steps of IKEv2 IPsec tunnel establishment into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

IKE_SA_INIT exchange

IKEv2 uses a two-phase process: Phase 1 (IKE_SA_INIT) establishes a secure channel, then Phase 2 (IKE_AUTH and CREATE_CHILD_SA) authenticates peers and creates IPsec SAs. The order is: 1. IKE_SA_INIT exchange, 2. IKE_AUTH exchange, 3. CREATE_CHILD_SA exchange, 4. IPsec SA installation, 5. Data encryption/decryption.

Quick reference

VPN Protocol Comparison

Protocol	Port	Encryption	Authentication	Use Case
IKEv2 / IPsec	UDP 500 / 4500	AES-256	Certificates / PSK	Site-to-site & remote access
SSL / TLS VPN	TCP 443	TLS 1.3	Certificates / MFA	Clientless remote access
L2TP / IPsec	UDP 1701	AES (IPsec)	PSK / Certificates	Legacy remote access
WireGuard	UDP 51820	ChaCha20	Public keys	Modern high-performance VPN
PPTP	TCP 1723	MPPE (weak)	MS-CHAPv2	Legacy — avoid in production

PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.

About these practice questions

This 350-401 question is part of Courseiva's 1,175-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Ready to practise?

Turn this into a habit — start a practice session.

Start practice session

Timed practice sets

Short scored sets — answer, get feedback, read the explanation, move on.

CCNP Practice Test 3 — 25 Questions→CCNP Exam Simulation 1 — 100 Questions→

Practice by domain

Drill one exam section at a time instead of jumping between unrelated topics.

Network Assurance Architecture Automation

Filter by question format

Filter questions by type — troubleshooting, exhibit, drag-and-drop, PBQ, ACLs, OSPF, and more.

Browse scenarios

Topic-level practice

One concept per page — questions, worked explanations, and a short concept guide.

Security practice questions ENCOR EIGRP practice questions Automation practice questions ENCOR BGP practice questions

Where to go next

Study guide All 350-401 questions All Cisco practice questions

This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.