hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures IPsec between two VRF-Lite…
An engineer configures IPsec between two VRF-Lite routers using a site-to-site VPN. The tunnel is established, but no traffic is encrypted. The engineer verifies that the crypto map is applied to the correct interface and that the ACL for interesting traffic matches the VRF traffic. Which is the most likely explanation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL for interesting traffic is not matching the VRF traffic because the ACL is evaluated in the global routing table, not the VRF.
In VRF-Lite, traffic is forwarded based on the VRF routing table. However, IPsec crypto maps operate on the global routing table by default. If the traffic is in a VRF, the crypto map must be applied with the VRF keyword or the traffic must be redirected using a policy-based route (PBR) to the global table. Without this, the crypto engine does not see the traffic as interesting, so it is not encrypted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The crypto map is applied to the wrong interface; it should be applied to the VRF interface, not the physical interface.
Why it's wrong here
The crypto map should be applied to the physical interface (or tunnel interface) that carries the traffic, but the issue is that the crypto engine does not see VRF traffic.
- ✓
The ACL for interesting traffic is not matching the VRF traffic because the ACL is evaluated in the global routing table, not the VRF.
Why this is correct
IPsec crypto maps are evaluated in the global routing table. VRF traffic must be redirected to the global table using PBR or the crypto map must be VRF-aware.
- ✗
The IPsec transform set has a mismatch in the encryption algorithm, causing the tunnel to fail to establish.
Why it's wrong here
The tunnel is established, so transform set mismatch is not the issue.
- ✗
The 'crypto isakmp key' command is missing the VRF keyword, causing IKE to fail.
Why it's wrong here
IKE is used for tunnel establishment, and the tunnel is up, so this is not the problem.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
OSPF Route Summarization and Filtering
Key term
Policy Based Routing
Policy Based Routing (PBR) is a technology that allows network traffic to be forwarded based on user-defined policies rather than just the destination IP address in the routing table.
Key term
MPLS Layer 3 VPN
A technology that uses Multiprotocol Label Switching to create secure, scalable virtual private networks that connect multiple sites at the network layer, where the service provider manages routing between customer sites.
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.