easyMultiple ChoiceObjective-mapped
200-201 An analyst is verifying a VPN configuration Practice Question
Exhibit
Refer to the exhibit. crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac ! crypto map CMAP 10 ipsec-isakmp set peer 203.0.113.5 set transform-set ESP-AES256-SHA match address VPN-TRAFFIC
An analyst is verifying a VPN configuration. Which of the following is true about this configuration?
⚠ Common exam trap
Cisco often tests the ability to read a configuration snippet accurately, where candidates confuse AES key lengths (128 vs. 256) or authentication algorithms (SHA-1 vs. SHA-2) because the numbers look similar, leading them to pick a plausible but incorrect option like B or A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPN uses AES-256 encryption and SHA-1 authentication.
The configuration shown in the exhibit (not provided here) specifies AES-256 as the encryption algorithm and SHA-1 as the authentication (integrity) algorithm. AES-256 provides a 256-bit key for strong encryption, while SHA-1 produces a 160-bit hash for data integrity. Although SHA-1 is considered cryptographically weaker than SHA-2, it is still commonly used in legacy or compatibility-focused VPN configurations, making option C the correct match for the given settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPN uses AES-128 encryption and SHA-1 authentication.
Why it's wrong here
AES-256 not 128.
- ✗
The VPN uses AES-256 encryption and SHA-2 authentication.
Why it's wrong here
SHA-1 is used, not SHA-2.
- ✓
The VPN uses AES-256 encryption and SHA-1 authentication.
Why this is correct
Correct interpretation of transform set.
- ✗
The VPN uses 3DES encryption and SHA-256 authentication.
Why it's wrong here
Incorrect algorithm.
- ✗
The VPN uses DES encryption and MD5 authentication.
Why it's wrong here
Incorrect algorithm.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.