mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Runs the following command to troubleshoot an…
A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:
R1# debug crypto isakmp *Mar 1 00:01:23.456: ISAKMP (0:0): received packet from 192.168.1.2 dport 500 sport 500 Global (N) NEW SA *Mar 1 00:01:23.457: ISAKMP: Created a peer struct for 192.168.1.2, peer port 500 *Mar 1 00:01:23.457: ISAKMP: New peer created peer = 0x12345678 peer_handle = 0x80000001 *Mar 1 00:01:23.457: ISAKMP: Locking peer struct 0x12345678, refcount 1 for crypto_isakmp_process_block *Mar 1 00:01:23.457: ISAKMP (0:0): SA request profile is (default) *Mar 1 00:01:23.457: ISAKMP: local port 500, remote port 500 *Mar 1 00:01:23.458: ISAKMP (0:0): found peer pre-shared-key matching 192.168.1.2 *Mar 1 00:01:23.458: ISAKMP (0:0): constructed NAT-T vendor ID *Mar 1 00:01:23.458: ISAKMP (0:0): sending packet to 192.168.1.2 my_port 500 peer_port 500 (I) MM_NO_STATE *Mar 1 00:01:23.458: ISAKMP (0:0): received packet from 192.168.1.2 dport 500 sport 500 Global (I) MM_NO_STATE *Mar 1 00:01:23.459: ISAKMP (0:0): processing SA payload. message ID = 0 *Mar 1 00:01:23.459: ISAKMP (0:0): Checking ISAKMP transform 1 against priority 1 policy *Mar 1 00:01:23.459: ISAKMP: encryption DES-CBC *Mar 1 00:01:23.459: ISAKMP: hash SHA *Mar 1 00:01:23.459: ISAKMP: default group 2 *Mar 1 00:01:23.459: ISAKMP: auth pre-share *Mar 1 00:01:23.459: ISAKMP (0:0): atts are not acceptable. Next transforms are not acceptable *Mar 1 00:01:23.460: ISAKMP (0:0): no offers accepted!
What does this output indicate?
⚠ Common exam trap
Cisco often tests the distinction between a pre-shared key mismatch (which would show 'no pre-shared key found') and a transform set mismatch (which shows 'atts are not acceptable'), leading candidates to incorrectly blame the PSK when the actual issue is the encryption/hash/DH group.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ISAKMP transform set proposal is rejected due to a mismatch in encryption, hash, or DH group between peers.
The debug output shows that the router received an ISAKMP proposal from the peer (192.168.1.2) and checked it against its own configured policy. The line 'atts are not acceptable' followed by 'no offers accepted' indicates that the transform set attributes (encryption DES-CBC, hash SHA, DH group 2) did not match any of the router's ISAKMP policies. This is a classic proposal mismatch, preventing the ISAKMP SA from being established.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ISAKMP SA is established successfully using pre-shared key authentication.
Why it's wrong here
The debug shows 'no offers accepted', indicating failure, not success.
- ✓
The ISAKMP transform set proposal is rejected due to a mismatch in encryption, hash, or DH group between peers.
Why this is correct
The output clearly states 'atts are not acceptable' and 'no offers accepted', which means the proposed transform does not match the local policy.
- ✗
The router is receiving the packet from an incorrect source IP address.
Why it's wrong here
The source IP is 192.168.1.2, which matches the expected peer; the issue is with transform mismatch, not source IP.
- ✗
The router is unable to find a pre-shared key for the peer.
Why it's wrong here
The debug shows 'found peer pre-shared-key matching 192.168.1.2', so the key is present.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.