mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Given this configuration on router R1: crypto…
Given this configuration on router R1:
crypto isakmp policy 10
encryption aes 256 authentication pre-share group 14 lifetime 86400 !
crypto isakmp key cisco123 address 192.168.1.2
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
mode tunnel !
crypto map CMAP 10 ipsec-isakmp
set peer 192.168.1.2 set transform-set TSET match address 101 !
interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
What will happen when traffic from 10.1.1.0/24 to 10.2.2.0/24 is generated?
⚠ Common exam trap
A common mix-up: candidates assume a crypto map is automatically applied to the interface it references (e.g., via the peer IP), but Cisco explicitly tests that the `crypto map` command under the interface is required for IPsec to function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The traffic will be forwarded normally without encryption.
The crypto map is not applied to any interface. Without the `crypto map CMAP` command under GigabitEthernet0/1, the router has no IPsec policy to enforce on that interface. Traffic matching access-list 101 will simply be forwarded normally as clear-text IP packets, since no encryption is triggered.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The traffic will be dropped because the ACL denies it.
Why it's wrong here
The ACL permits the traffic, but without the crypto map, it is not used for IPsec.
- ✓
The traffic will be forwarded normally without encryption.
Why this is correct
Since the crypto map is not applied, the router treats the traffic as normal and forwards it based on routing.
- ✗
The router will attempt to establish an IPsec tunnel but fail because the crypto map is missing.
Why it's wrong here
The crypto map must be applied to an interface for IPsec to be triggered.
- ✗
The router will create a dynamic crypto map entry automatically.
Why it's wrong here
Dynamic crypto maps are configured manually; no automatic creation occurs.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.