mediumMultiple Choice
300-410 Practice Question: Which default IPsec transform set is…
Which default IPsec transform set is automatically created in Cisco IOS when configuring a site-to-site VPN?
⚠ Common exam trap
Cisco often tests the misconception that a default transform set exists, tempting candidates to select a common algorithm combination like `esp-aes 256 esp-sha-hmac` or `esp-3des esp-sha-hmac` as the default, when in fact no such default is automatically created.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No default transform set is created
Cisco IOS does not automatically create any default IPsec transform set when configuring a site-to-site VPN. Transform sets must be explicitly defined using the `crypto ipsec transform-set` command, which specifies the encryption and authentication algorithms. The absence of a default ensures that administrators intentionally select the appropriate security parameters for their environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
esp-aes 256 esp-sha-hmac
Why it's wrong here
Cisco IOS creates the default transform set 'esp-aes 256 esp-sha-hmac' only in newer releases; older IOS and IOS-XE default to 'esp-aes esp-sha-hmac'. It is tempting because 256-bit AES is the modern default, but the platform's actual default depends on the software version.
- ✗
esp-3des esp-sha-hmac
Why it's wrong here
This is a common transform set but not automatically created.
- ✓
No default transform set is created
Why this is correct
Cisco IOS never auto-creates a transform set; one must be defined manually with `crypto ipsec transform-set` before the crypto map references it. The stem asks which default exists, and none does, so this satisfies the "default" constraint precisely.
- ✗
esp-aes 128 esp-md5-hmac
Why it's wrong here
This is not a default; administrators must define it.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.