300-410 Infrastructure Security Practice Question
A network administrator is configuring a site-to-site VPN on a Cisco IOS router using IPsec. The administrator wants to ensure that only traffic from the 192.168.1.0/24 subnet is encrypted and sent over the VPN tunnel. Which configuration component is used to define the interesting traffic?
⚠ Common exam trap
Many exam-takers confuse the role of the crypto map with the ACL; the crypto map references the ACL but does not define the traffic itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
access list
An access list is used to define interesting traffic for an IPsec VPN. It specifies the source and destination addresses and protocols that should be encrypted. The crypto map references this ACL to determine which packets to encrypt and send through the tunnel. The transform set and ISAKMP policy define security parameters but do not select traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ISAKMP policy
Why it's wrong here
The ISAKMP policy defines the parameters for Phase 1 IKE negotiation, such as encryption, hash, authentication, and Diffie-Hellman group. It does not define which traffic is interesting for the VPN. Therefore, it is not the correct component for specifying traffic to be encrypted.
- ✗
transform set
Why it's wrong here
A transform set defines the encryption and authentication algorithms used to protect the data. It does not specify which traffic should be encrypted. The transform set is referenced by the crypto map, but it is not responsible for defining interesting traffic.
- ✓
access list
Why this is correct
An access list (ACL) is used to define interesting traffic for IPsec VPNs. The ACL specifies which source and destination IP addresses and protocols should be encrypted and sent through the tunnel. In this scenario, an ACL permitting traffic from 192.168.1.0/24 to the remote subnet would be referenced by the crypto map.
- ✗
crypto map
Why it's wrong here
The crypto map ties together the various IPsec configuration elements, such as the peer, the transform set, and the ACL that defines interesting traffic. However, the crypto map itself does not define the traffic; it references an ACL. Therefore, it is not the component that defines interesting traffic.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.