300-410 VPN Technologies Practice Question
A network administrator is troubleshooting a site-to-site IPsec VPN between two Cisco IOS routers using IKEv1. Phase 1 completes successfully, but Phase 2 fails with the message 'QM_IDLE' and no IPSec SA is established. The administrator verifies that the transform sets on both peers contain matching encryption and hash algorithms. Which configuration mismatch is the most likely cause of the Phase 2 failure?
⚠ Common exam trap
The trap here is focusing on transform set mismatches or Phase 1 parameters when the symptom of a working Phase 1 with a failing Phase 2 points to proxy identity or ACL mirroring issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The crypto ACLs on the two peers do not mirror each other for the interesting traffic.
In IKEv1, Phase 2 quick mode negotiates the IPSec SA using proxy identities derived from the crypto ACLs. These ACLs must be mirror images between peers so that the source and destination selectors align. If they do not mirror each other, quick mode fails and no IPSec SA is created, even though Phase 1 is established and transform sets match.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ISAKMP policy priority numbers are different on the two peers.
Why it's wrong here
IKE policy priority numbers only determine the order in which policies are evaluated locally; they do not need to match between peers. What matters is that at least one policy on each peer has matching attributes. Different priority numbers alone would not cause Phase 2 to fail after Phase 1 has already succeeded.
- ✓
The crypto ACLs on the two peers do not mirror each other for the interesting traffic.
Why this is correct
In IKEv1 main mode, the Phase 2 quick mode negotiation uses the crypto ACL to identify the traffic to protect, and the proxy IDs must be mirror images. If the source and destination subnets are reversed or mismatched, the peers cannot agree on the IPSec SA selectors, causing quick mode to fail even though Phase 1 is up and transform sets match.
- ✗
The IKEv1 aggressive mode is enabled on one peer but not the other.
Why it's wrong here
Aggressive mode versus main mode affects how Phase 1 is negotiated, not Phase 2. If the modes were mismatched, Phase 1 would not complete successfully. Because Phase 1 is already up, the mode mismatch is not the cause of the quick mode failure described.
- ✗
The pre-shared keys on the two peers do not match.
Why it's wrong here
A pre-shared key mismatch would cause Phase 1 authentication to fail, preventing the ISAKMP SA from reaching the established state. Since the scenario states Phase 1 completes successfully, the pre-shared keys must already match, so this cannot be the cause of the Phase 2 failure.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.