mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Examine this configuration on router R1: crypto…
Examine this configuration on router R1:
crypto isakmp policy 10
encryption aes 256 authentication pre-share group 14 lifetime 86400 !
crypto isakmp key cisco123 address 192.168.1.2
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
mode tunnel !
crypto map CMAP 10 ipsec-isakmp
set peer 192.168.1.2 set transform-set TSET match address 101 !
interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 crypto map CMAP
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
What is missing from this configuration to ensure the tunnel works correctly?
⚠ Common exam trap
Cisco often tests the misconception that a route to the remote LAN is required for IPsec to work, but in reality, the crypto ACL handles traffic selection, and only a route to the peer's public IP is needed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Nothing is missing; the configuration is correct.
The configuration is complete for a site-to-site IPsec VPN. ISAKMP policy 10 specifies AES-256 encryption, pre-shared key authentication, Diffie-Hellman group 14, and a lifetime of 86400 seconds (the default is 86400, so explicitly setting it is fine). The crypto map CMAP binds the transform set TSET (AES-256, SHA-HMAC) to peer 192.168.1.2 and matches interesting traffic via access-list 101 (10.1.1.0/24 to 10.2.2.0/24). The interface GigabitEthernet0/1 applies the crypto map. A route to the remote LAN is not required because IPsec encrypts traffic based on the crypto ACL; routing only needs to reach the peer's public IP (192.168.1.2), which is directly connected on the same subnet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Nothing is missing; the configuration is correct.
Why this is correct
All necessary components: ISAKMP policy, key, transform set, crypto map with peer and ACL, and interface application.
- ✗
A route to the remote LAN 10.2.2.0/24 is missing.
Why it's wrong here
Routing is separate from IPsec; the tunnel can be established without a route, but traffic may not be forwarded correctly. However, the question asks what is missing for the tunnel to work, and IPsec itself does not require a route.
- ✗
The ISAKMP policy needs a 'lifetime' value.
Why it's wrong here
A lifetime is already configured (86400).
- ✗
The transform set should include 'mode transport' for site-to-site.
Why it's wrong here
Tunnel mode is correct for site-to-site VPNs.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.