hardMultiple ChoiceObjective-mapped

350-701 Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.
```
ipsec proposal MY_PROPOSAL
 esp encryption aes-256
 esp integrity sha256
!
crypto map MY_MAP 10 ipsec-isakmp
 set peer 203.0.113.1
 set transform-set MY_SET
 match address 100
!
access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
```

Refer to the exhibit. The crypto map is applied to an interface. Which additional configuration is necessary for IPsec to function correctly?

⚠ Common exam trap

Cisco often tests the misconception that a crypto map alone is sufficient for IPsec, hiding the fact that IKE Phase 1 (ISAKMP policy) is a prerequisite that must be configured separately, leading candidates to overlook it when other options like transform-sets or access lists are already present.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure an ISAKMP policy (IKE phase 1) with pre-shared key or certificate

IPsec requires both IKE Phase 1 (ISAKMP) and Phase 2 to be configured. The crypto map references a transform-set and an access list, but without an ISAKMP policy defining authentication (pre-shared key or certificate) and encryption/hash parameters, IKE cannot establish a secure control channel. Option D is correct because the ISAKMP policy is mandatory for IKE Phase 1 negotiation before IPsec SAs can be created.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Define an extended access list for interesting traffic
Why it's wrong here
Access-list 100 already defines interesting traffic.
✗
Create a tunnel interface and apply the crypto map to it
Why it's wrong here
Crypto maps can be applied to physical interfaces; a tunnel interface is not required.
✗
Create a transform-set with the same parameters as the proposal
Why it's wrong here
A transform-set is referenced (MY_SET) but not defined; however, the more fundamental missing piece is IKE policy.
✓
Configure an ISAKMP policy (IKE phase 1) with pre-shared key or certificate
Why this is correct
IKE phase 1 must be configured to establish a secure channel before IPsec can work.

Visual reference

Quick reference

VPN Protocol Comparison

Protocol	Port	Encryption	Authentication	Use Case
IKEv2 / IPsec	UDP 500 / 4500	AES-256	Certificates / PSK	Site-to-site & remote access
SSL / TLS VPN	TCP 443	TLS 1.3	Certificates / MFA	Clientless remote access
L2TP / IPsec	UDP 1701	AES (IPsec)	PSK / Certificates	Legacy remote access
WireGuard	UDP 51820	ChaCha20	Public keys	Modern high-performance VPN
PPTP	TCP 1723	MPPE (weak)	MS-CHAPv2	Legacy — avoid in production

PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.

Go deeper

350-701 Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

VPN Protocol Comparison

Related to this question