hardMultiple SelectObjective-mapped
300-410 Practice Question: Which THREE symptoms indicate a potential IPsec…
Which THREE symptoms indicate a potential IPsec site-to-site VPN failure due to mismatched IKE parameters? (Choose THREE.)
⚠ Common exam trap
Cisco often tests the distinction between IKE Phase 1 and Phase 2 failure symptoms, and the trap here is confusing packet errors in 'show crypto ipsec sa' (Phase 2) with IKE parameter mismatches (Phase 1), leading candidates to incorrectly select option B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'show crypto isakmp sa' output shows 'MM_NO_STATE'.
The 'show crypto isakmp sa' output showing 'MM_NO_STATE' indicates that the IKE Phase 1 negotiation has failed to progress past the Main Mode initial exchange. This typically occurs when IKE parameters such as encryption, hash, Diffie-Hellman group, or authentication method do not match between the two VPN peers, preventing the establishment of an ISAKMP security association.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The 'show crypto isakmp sa' output shows 'MM_NO_STATE'.
Why this is correct
MM_NO_STATE indicates that IKE phase 1 has not completed, often due to mismatched parameters.
- ✗
The 'show crypto ipsec sa' output shows packet errors.
Why it's wrong here
Packet errors in IPsec SA can indicate many issues, not specifically IKE mismatches.
- ✓
The router logs display '%CRYPTO-4-IKMP_NO_POLICY' error messages.
Why this is correct
This error indicates that no matching IKE policy was found, often due to mismatched parameters.
- ✗
The 'show crypto isakmp sa' output shows 'ACTIVE' state.
Why it's wrong here
ACTIVE state means phase 1 is successful, so no mismatch.
- ✓
Pings across the VPN fail, and 'show crypto isakmp sa' shows no SA.
Why this is correct
No ISAKMP SA indicates phase 1 failure, often due to mismatched IKE parameters.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.