easyMultiple Choice
300-410 Practice Question: Runs the following command on Router R1: R1# show…
A network engineer runs the following command on Router R1:
R1# show crypto isakmp sa
dst src state conn-id slot status
10.1.1.2 10.1.1.1 QM_IDLE 1 0 ACTIVE
Based on this output, which statement is correct?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IKE phase 1 is complete; the ISAKMP SA is established.
QM_IDLE indicates that IKE phase 1 (ISAKMP) is complete and the SA is idle, waiting for phase 2 negotiation. This is the normal state for an established ISAKMP SA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
IKE phase 1 is complete; the ISAKMP SA is established.
Why this is correct
QM_IDLE with status ACTIVE confirms IKE phase 1 completed successfully and the ISAKMP SA is established between the peers. Quick Mode is idle because no phase 2 negotiation is currently in progress, not because phase 1 failed.
- ✗
IKE phase 2 is complete; the IPsec SA is active.
Why it's wrong here
QM_IDLE confirms only that IKE phase 1 (ISAKMP) completed and the quick-mode exchange is idle, not that phase 2 finished. IPsec SA status requires show crypto ipsec sa. Phase 2 completion is what QM_IDLE would precede, making this the tempting but premature reading of the output.
- ✗
The ISAKMP SA is in MM_NO_STATE; negotiation has failed.
Why it's wrong here
The output explicitly shows QM_IDLE, not MM_NO_STATE. MM_NO_STATE appears during main-mode negotiation before completion, indicating a problem. QM_IDLE means phase 1 succeeded and quick mode is idle, so negotiation has not failed; this option misreads the displayed state field.
- ✗
The tunnel is down; the SA is in a dead state.
Why it's wrong here
QM_IDLE with status ACTIVE indicates a healthy, established ISAKMP SA, not a dead tunnel. A down tunnel would show MM_NO_STATE or a deleted SA. Engineers often assume any non-QUICK_MODE state means failure, but QM_IDLE is the normal steady state for an idle phase 1 SA.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.