mediumMultiple SelectObjective-mapped
300-410 Practice Question: Which TWO statements about IPsec site-to-site VPN…
Which TWO statements about IPsec site-to-site VPN configuration using IKEv1 are true? (Choose TWO.)
⚠ Common exam trap
Cisco often tests the distinction between IKEv1 phase 1 (ISAKMP SA, bidirectional) and phase 2 (IPsec SAs, unidirectional), and candidates frequently confuse which commands apply to each phase, especially the 'crypto isakmp policy' versus 'crypto ipsec transform-set' commands.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IKEv1 phase 1 establishes the ISAKMP SA, which is bidirectional.
IKEv1 phase 1 establishes the ISAKMP Security Association (SA), which is used to securely negotiate the IPsec SAs in phase 2. This ISAKMP SA is bidirectional, meaning a single SA protects both inbound and outbound IKE traffic between the peers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
IKEv1 phase 1 establishes the ISAKMP SA, which is bidirectional.
Why this is correct
Phase 1 creates a bidirectional ISAKMP SA used to protect IKE negotiations.
- ✗
IKEv1 phase 2 uses the crypto isakmp policy to negotiate IPsec SAs.
Why it's wrong here
Phase 2 uses transform sets and crypto maps, not the isakmp policy.
- ✓
The 'crypto isakmp policy' command configures authentication, encryption, and DH group for phase 1.
Why this is correct
This command configures phase 1 parameters like authentication method, encryption algorithm, and Diffie-Hellman group.
- ✗
IPsec SAs are unidirectional and require two SAs per tunnel.
Why it's wrong here
IPsec SAs are unidirectional, but a typical site-to-site VPN uses two SAs (one inbound, one outbound) per security protocol.
- ✗
The 'crypto ipsec transform-set' command defines the IKEv1 phase 1 policy.
Why it's wrong here
The transform-set command defines phase 2 parameters, not phase 1.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.