350-401 Security Practice Question
A network administrator is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The design requires that only traffic from specific subnets be encrypted and that the routers use a preshared key for authentication. Which combination of configuration elements must the administrator define to match the interesting traffic and establish the tunnel?
⚠ Common exam trap
The trap here is assuming that a route map or an interface other than the WAN can define or carry the IPsec policy, when interesting traffic must be defined by an ACL and the crypto map must be applied to the WAN interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An ACL defining interesting traffic, an ISAKMP policy, a preshared key, and a crypto map applied to the WAN interface.
A Cisco IOS site-to-site IPsec VPN requires an extended ACL to identify interesting traffic, an ISAKMP policy to define Phase 1 parameters, a preshared key for peer authentication, and a crypto map that ties the ACL and transform set together and is applied to the WAN interface. All of these elements work together to negotiate and encrypt traffic between the peers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An ISAKMP policy, a preshared key, and a crypto map applied to the WAN interface without an ACL for interesting traffic.
Why it's wrong here
Without an ACL to define interesting traffic, the crypto map has no match criteria and cannot determine which packets to encrypt. The ACL is a required component of the crypto map configuration. The other elements alone would not allow the router to selectively encrypt traffic from the specified subnets.
- ✗
A route map defining interesting traffic, a crypto map, and a transform set applied to the LAN interface.
Why it's wrong here
Route maps are not used to define interesting traffic for IPsec; an extended ACL is required. Additionally, the crypto map is applied to the WAN-facing interface, not the LAN interface, because that is where the IPsec peer resides. Applying it to the LAN interface would not intercept traffic destined for the remote peer.
- ✓
An ACL defining interesting traffic, an ISAKMP policy, a preshared key, and a crypto map applied to the WAN interface.
Why this is correct
A classic site-to-site IPsec VPN on Cisco IOS requires an extended ACL to identify interesting traffic, an ISAKMP (IKE) policy to define Phase 1 parameters, a preshared key for peer authentication, and a crypto map that references the ACL and transform set and is applied to the WAN interface. Together these elements establish and encrypt the tunnel.
- ✗
An ACL defining interesting traffic, a transform set, and a crypto map applied to the LAN interface without an ISAKMP policy.
Why it's wrong here
An ISAKMP policy is mandatory for IKE Phase 1 negotiation; without it the peers cannot authenticate and establish the management tunnel. Also, the crypto map must be applied to the WAN interface, not the LAN interface. Omitting the ISAKMP policy means no security association can be built.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.