Question 78 of 1,958
mediumMultiple ChoiceObjective-mapped
350-401 Practice Question: Examine this configuration for a site-to-site VPN…
Examine this configuration for a site-to-site VPN on a Cisco router:
crypto isakmp policy 10
encryption aes 256 hash sha256 authentication pre-share group 14 lifetime 86400 !
crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac
mode tunnel !
crypto map CMAP 10 ipsec-isakmp
set peer 192.168.1.1 set transform-set TSET match address 101 !
interface GigabitEthernet0/0/0 ip address 10.0.0.1 255.255.255.0 crypto map CMAP
!
access-list 101 permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
Which statement about this configuration is true?
⚠ Common exam trap
Cisco often tests the misconception that the crypto map should be applied to a tunnel interface, but in reality it must be applied to the physical egress interface for site-to-site VPNs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The access-list 101 defines the traffic that will be encrypted; traffic from 192.168.10.0/24 to 192.168.20.0/24 will be protected.
Access-list 101 is used by the crypto map to match traffic that should be encrypted via IPsec. The ACL permits traffic from source network 192.168.10.0/24 to destination network 192.168.20.0/24, so that traffic will be protected by the IPsec tunnel. This is the standard method for defining interesting traffic in a site-to-site VPN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The crypto map uses IKEv2 for key exchange because the transform set uses SHA-256.
Why it's wrong here
The 'crypto isakmp' commands indicate IKEv1, not IKEv2. IKEv2 uses 'crypto ikev2' commands.
- ✓
The access-list 101 defines the traffic that will be encrypted; traffic from 192.168.10.0/24 to 192.168.20.0/24 will be protected.
Why this is correct
The 'match address 101' in the crypto map references ACL 101, which permits the specified source and destination networks. Only matching traffic triggers IPsec encryption.
- ✗
The ISAKMP policy lifetime of 86400 seconds is too long and will cause the tunnel to fail.
Why it's wrong here
The default ISAKMP lifetime is 86400 seconds (1 day), which is acceptable. It does not cause failure.
- ✗
The crypto map should be applied to the tunnel interface, not the physical interface.
Why it's wrong here
Crypto maps are applied to physical interfaces (or subinterfaces) for site-to-site VPNs. Tunnel interfaces are used for VTI or DMVPN.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.