300-410 VPN Technologies Practice Question
A network administrator is setting up a site-to-site VPN between two Cisco routers using IPsec. The administrator wants to ensure that the VPN tunnel uses strong encryption and hashing algorithms. Which of the following should be configured to define the encryption and hashing algorithms used for the IPsec SA?
⚠ Common exam trap
Test-takers frequently confuse IKE Phase 1 parameters (defined in ISAKMP policy) with IPsec Phase 2 parameters (defined in transform set).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Transform set
The transform set is used to define the encryption and hashing algorithms for the IPsec SA. It is referenced by the crypto map or IPsec profile. The ISAKMP policy defines Phase 1 parameters, while the crypto map and IKEv2 profile are used for other purposes. Therefore, the transform set is the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Transform set
Why this is correct
A transform set defines the encryption and hashing algorithms (e.g., esp-aes 256 and esp-sha-hmac) that will be used to protect the data. It is referenced by the crypto map or IPsec profile. This is the correct place to specify the algorithms for the IPsec SA. The transform set ensures both peers agree on the security parameters.
- ✗
ISAKMP policy
Why it's wrong here
The ISAKMP policy defines the parameters for IKE Phase 1, including encryption, hash, authentication, and Diffie-Hellman group. It does not define the algorithms for the IPsec SA (Phase 2). While both are important, the question specifically asks about the IPsec SA, which is negotiated in Phase 2 and uses the transform set.
- ✗
IKEv2 profile
Why it's wrong here
An IKEv2 profile is used in IKEv2 configurations to define authentication and other parameters for IKEv2. It does not directly specify the encryption and hashing algorithms for the IPsec SA; those are still defined in the transform set. The IKEv2 profile is used for Phase 1 and can reference the transform set for Phase 2, but it is not the primary place to set algorithms.
- ✗
Crypto map
Why it's wrong here
A crypto map ties together the interesting traffic ACL, the peer, the transform set, and other parameters. It does not define the encryption and hashing algorithms; it references a transform set that does. While essential for the VPN configuration, the crypto map itself is not where you specify algorithms like AES or SHA.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.