mediumMultiple Choice
300-410 Practice Question: Which statement correctly describes the default…
Which statement correctly describes the default behavior of Dead Peer Detection (DPD) in Cisco IOS for IPsec site-to-site VPN?
⚠ Common exam trap
Cisco often tests the misconception that DPD is enabled by default or that it has a fixed interval, when in fact it must be manually configured and the default state is disabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DPD is disabled by default
Dead Peer Detection (DPD) is disabled by default in Cisco IOS for IPsec site-to-site VPNs. This means that without explicit configuration using the 'crypto isakmp keepalive' command, the router will not send DPD messages to verify the liveness of the remote peer. DPD must be manually enabled to detect peer failures and trigger failover or tunnel teardown.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DPD is enabled by default with a 10-second interval
Why it's wrong here
Cisco IOS does not enable DPD by default; it must be configured under the crypto map or ISAKMP profile, so no default 10-second interval exists. DPD with a 10-second interval would be the correct choice when an administrator explicitly configures aggressive failure detection for fast peer-loss detection.
- ✗
DPD is enabled by default with a 30-second interval
Why it's wrong here
DPD is disabled by default in Cisco IOS and requires explicit configuration, so no default 30-second interval applies. A 30-second interval would be correct only when an administrator deliberately sets that timer to balance detection speed against keepalive overhead on a specific tunnel.
- ✓
DPD is disabled by default
Why this is correct
Cisco IOS leaves DPD inactive unless configured, so it is disabled by default on IPsec site-to-site peers. This satisfies the stem's constraint that the statement correctly describe default DPD behaviour, not its configured or enabled state.
- ✗
DPD is enabled only for IKEv2 by default
Why it's wrong here
DPD is not enabled by default for either IKEv1 or IKEv2 in Cisco IOS; it must be configured explicitly, so claiming IKEv2-only default is false. It tempts because IKEv2 does include native liveness mechanisms, but IOS still requires explicit DPD configuration per peer.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.