CCNP Practice Question: Runs the following command on Router R7: R7# show…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The IKEv2 SA is in a failed state because it is READY.

  Why it's wrong here

  In Cisco IKEv2, the SA state of 'READY' is a normal, operational state that indicates the IKEv2 SA has been successfully established and is actively usable for securing traffic. It is not an error or failure state; rather, it reflects that both endpoints have completed the IKE_SA_INIT and IKE_AUTH exchanges and have installed the IPsec SAs. A failed SA would typically show a state such as 'DELETED', 'LARVAL', or be absent from the output entirely, not 'READY'.

• ✓

  The tunnel is using pre-shared keys for authentication.

  Why this is correct

  The output directly shows 'Auth sign: PSK' and 'Auth verify: PSK', which are the IKEv2 authentication fields that specify the integrity/authentication algorithm used during the IKE_AUTH exchange. When both fields display 'PSK', the tunnel is unambiguously using pre-shared keys for authentication, meaning both peers derive the same symmetric key from a shared secret. This is a common, low-overhead authentication method in IPsec VPNs, and the Cisco CLI explicitly reports it in the 'show crypto ikev2 sa' or 'show crypto ikev2 profile' output.

• ✗

  The tunnel is using RSA signatures for authentication.

  Why it's wrong here

  RSA signature authentication in IKEv2 would be indicated by 'Auth sign: RSA' (or 'RSA-SIG') and 'Auth verify: RSA' in the corresponding command output, as the router would use its RSA private key to sign the key exchange payload. In the given output, both fields show 'PSK', which is mutually exclusive with RSA signatures for the same Security Association because the authentication method is negotiated during IKEv2's initial exchange. Therefore, stating that the tunnel uses RSA signatures directly contradicts the observed authentication parameters and is incorrect.

• ✗

  The IKEv2 SA has expired because the life time is 86400 seconds.

  Why it's wrong here

  The IKEv2 SA lifetime is the maximum duration (86400 seconds) or traffic volume it can exist before rekeying or expiration, but the SA only reaches that point after being active for that full time. The output also includes an active time of 3600 seconds, which is far below the lifetime threshold, meaning the SA is still well within its valid operational window. Furthermore, IKEv2 implementations proactively rekey before the hard lifetime expires, so an SA showing a remaining lifetime is not considered expired.