hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Runs the following command to troubleshoot IPsec…
A network engineer runs the following command to troubleshoot IPsec IKE phase 1:
R1# debug crypto isakmp
ISAKMP: (0:0:N/A:0) Starting aggressive mode exchange ISAKMP: (0:0:N/A:0) processing SA payload ISAKMP: (0:0:N/A:0) Checking ISAKMP transform 1 against priority 1 policy ISAKMP: (0:0:N/A:0) encryption 3DES ISAKMP: (0:0:N/A:0) hash SHA ISAKMP: (0:0:N/A:0) group 2 ISAKMP: (0:0:N/A:0) auth pre-share ISAKMP: (0:0:N/A:0) life type in seconds ISAKMP: (0:0:N/A:0) life duration (basic) of 86400 ISAKMP: (0:0:N/A:0) atts are not acceptable
What does this output indicate?
⚠ Common exam trap
Cisco often tests the distinction between transform set mismatch and authentication failure, where candidates mistakenly assume that any failure in IKE phase 1 is due to authentication, but the debug message 'atts are not acceptable' specifically points to a proposal mismatch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IKE phase 1 fails due to transform set mismatch.
The debug output shows that the ISAKMP transform (3DES, SHA, group 2, pre-share) is being checked against the local policy, and the message 'atts are not acceptable' indicates a mismatch. This means the proposed transform set does not match any configured IKE policy on the responder, causing IKE phase 1 to fail. The failure is specifically due to a transform set mismatch, not authentication or lifetime issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IKE phase 1 is successful; the transform set is accepted.
Why it's wrong here
The output says 'atts are not acceptable'.
- ✓
IKE phase 1 fails due to transform set mismatch.
Why this is correct
The attributes are not acceptable, indicating a mismatch.
- ✗
IKE phase 1 fails due to authentication failure.
Why it's wrong here
No authentication failure is shown; the issue is with the transform set.
- ✗
IKE phase 1 fails due to lifetime mismatch.
Why it's wrong here
The lifetime is shown but not indicated as the cause; the general 'atts are not acceptable' covers all attributes.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.