mediumMultiple SelectObjective-mapped
350-401 Practice Question: Which three statements about FlexVPN are true?…
Which three statements about FlexVPN are true? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FlexVPN uses IKEv2 as its underlying key exchange protocol.
FlexVPN is a Cisco implementation based on IKEv2, supporting hub-and-spoke, spoke-to-spoke, and remote access VPNs with centralized key management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
FlexVPN uses IKEv2 as its underlying key exchange protocol.
Why this is correct
Correct because FlexVPN is built on IKEv2, leveraging its features like EAP, mobility, and NAT traversal.
- ✓
FlexVPN supports both site-to-site and remote access VPN topologies.
Why this is correct
Correct because FlexVPN can be deployed as a hub-and-spoke site-to-site VPN or as a remote access server for clients.
- ✗
FlexVPN requires a dedicated AAA server for all authentication functions.
Why it's wrong here
Incorrect because FlexVPN can use local authentication on the hub router; AAA is optional but recommended for scalability.
- ✓
FlexVPN can use digital certificates or pre-shared keys for authentication.
Why this is correct
Correct because IKEv2 supports both authentication methods, and FlexVPN inherits this flexibility.
- ✗
FlexVPN uses NHRP to dynamically discover spoke routers and establish direct tunnels.
Why it's wrong here
Incorrect because NHRP is used in DMVPN, not FlexVPN. FlexVPN relies on IKEv2 for peer discovery and tunnel establishment.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,175 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.