Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
mediumDrag & DropObjective-mapped
CCNP Practice Question: Drag and drop the steps of FlexVPN spoke-to-spoke…
Drag and drop the steps of FlexVPN spoke-to-spoke dynamic tunnel creation into the correct order, from first to last.
⚠ Common exam trap
A common trap is confusing IKE versions: FlexVPN exclusively uses IKEv2, so any reference to IKEv1 in the steps is incorrect. Also, authentication in FlexVPN is direct between spokes, not proxied through the hub.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Spoke1 sends IKEv2 request to hub for Spoke2
In FlexVPN, the spoke-to-spoke dynamic tunnel creation process uses IKEv2, not IKEv1. The correct sequence: Spoke1 sends an IKEv2 request to the hub for information about Spoke2. The hub responds with a redirect notification containing Spoke2's address. Spoke1 then initiates a direct IKEv2 SA with Spoke2. Authentication is performed directly between spokes (typically using certificates or pre-shared keys), not via the hub. After authentication, they establish an IPsec SA for secure data transfer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Spoke1 sends IKEv2 request to hub for Spoke2
Why this is correct
This step is correct in order but contains a common mistake: it says 'IKEv1' but FlexVPN uses IKEv2. The step should read 'Spoke1 sends IKEv2 request to hub for Spoke2'.
- ✓
Hub sends redirect notification with Spoke2 address
Why this is correct
Correct: The hub sends a redirect notification with the destination spoke's address. This step is accurate.
- ✓
Spoke1 initiates IKEv2 SA with Spoke2
Why this is correct
Correct: Spoke1 initiates an IKEv2 SA directly with Spoke2 after receiving the redirect. This step is accurate.
- ✓
Spoke1 and Spoke2 authenticate each other directly
Why this is correct
This step is correct in order but the description is misleading: authentication is direct between spokes, not via the hub. The step should read 'Spoke2 authenticates Spoke1 directly'.
- ✓
Spoke1 and Spoke2 establish IPsec SA
Why this is correct
Correct: After authentication, Spoke1 and Spoke2 establish an IPsec SA for data transfer.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,175 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.