SCAZT Network And Cloud Security Practice Question

Which THREE actions are required when configuring a new IPsec tunnel for the Cisco SIG (Secure Internet Gateway)?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure the local firewall with the correct Cisco SIG headend IP address.

Configuring an IPsec tunnel requires defining the tunnel details, the IKEv2 settings, and the specific traffic selectors or identity management.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Install a client-side agent on every endpoint behind the router.
Why it's wrong here
Network-level tunnels negate the need for endpoint agents.
✗
Enable the 'AnyConnect Tunnel' feature on the device.
Why it's wrong here
AnyConnect is a client-based solution, not a network IPsec tunnel requirement.
✓
Configure the local firewall with the correct Cisco SIG headend IP address.
Why this is correct
The router must know where to send the tunneled traffic.
✓
Configure IKEv2 proposal settings on the local edge device.
Why this is correct
IKEv2 is the required protocol for setting up the secure tunnel.
✓
Define the tunnel endpoint IP address in the Umbrella dashboard.
Why this is correct
The tunnel endpoint must be registered in the dashboard.

Quick reference

VPN Protocol Comparison

Protocol	Port	Encryption	Authentication	Use Case
IKEv2 / IPsec	UDP 500 / 4500	AES-256	Certificates / PSK	Site-to-site & remote access
SSL / TLS VPN	TCP 443	TLS 1.3	Certificates / MFA	Clientless remote access
L2TP / IPsec	UDP 1701	AES (IPsec)	PSK / Certificates	Legacy remote access
WireGuard	UDP 51820	ChaCha20	Public keys	Modern high-performance VPN
PPTP	TCP 1723	MPPE (weak)	MS-CHAPv2	Legacy — avoid in production

PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.

About these practice questions

One of 316 original SCAZT practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official Cisco exam blueprint

Ready to practise?

Put this into practice with a full scored session.

Start practice session

Practice tests

Quick scored rounds with instant marking and a written explanation per question.

SCAZT Practice Exam 4 — 20 Questions→SCAZT Practice Test 4 — 25 Questions→

Study by exam domain

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Network And Cloud Security Application And Data Security User And Device Security

Filter by question format

Pick a question style — troubleshooting, exhibit-based, PBQ, or configuration.

Browse scenarios

Go deeper on a topic

Each topic page collects the questions that test one concept, plus the theory behind it.

Network And Cloud Security practice questions SCAZT fundamentals practice questions Cloud Security Architecture practice questions Visibility And Assurance practice questions

Where to go next

All Cisco practice questions Study guide All SCAZT questions

This SCAZT practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCAZT exam.