hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures an IPsec VPN between two…
An engineer configures an IPsec VPN between two routers using a transform-set with ESP encryption (AES 256) and ESP authentication (SHA-256). The engineer also applies an IPv4 ACL to define interesting traffic that matches all IP traffic. After configuration, the VPN tunnel comes up, but only ICMP traffic is encrypted; other traffic like HTTP is sent in clear text. What is the most likely explanation?
⚠ Common exam trap
Cisco often tests the misconception that the transform-set or the IPsec SA itself filters traffic by port or protocol, when in reality the ACL is the sole mechanism for defining interesting traffic in a crypto map.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL for interesting traffic only permits ICMP, so only ICMP is encrypted.
The most likely explanation is that the ACL for interesting traffic only permits ICMP, so only ICMP is encrypted. In Cisco IOS, the crypto map uses the ACL to identify which traffic should be protected by IPsec. If the ACL only matches ICMP (e.g., 'permit icmp any any'), then only ICMP packets trigger IPsec encryption; all other traffic, such as HTTP, is forwarded in clear text because it does not match the ACL and is therefore not subject to IPsec processing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ACL for interesting traffic only permits ICMP, so only ICMP is encrypted.
Why this is correct
IPsec uses the ACL to determine which traffic to protect; if only ICMP is permitted, other traffic is not encrypted.
- ✗
The transform-set does not support HTTP traffic due to port filtering.
Why it's wrong here
Transform-set defines encryption and authentication algorithms, not traffic selection.
- ✗
The IPsec SA is only established for ICMP; other traffic requires a separate SA.
Why it's wrong here
The SA is triggered by the ACL; if the ACL is narrow, only matched traffic creates SAs.
- ✗
The router has a NAT rule that bypasses IPsec for HTTP traffic.
Why it's wrong here
NAT can interfere, but the question does not mention NAT.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.