hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A financial company is expanding its hybrid cloud…
A financial company is expanding its hybrid cloud architecture. They have an AWS VPC connected to an on-premises network via an IPsec VPN using IKEv2. The on-premises firewall is a Cisco ASA. Recently, users report intermittent connectivity to cloud resources. The security team reviews logs and finds the following message on the ASA: 'no matching crypto map entry for traffic from on-prem to cloud'. The team also suspects potential data leakage due to occasional unencrypted traffic. The corporate policy requires all traffic between environments to be encrypted. The engineer has verified that the IKEv2 proposals match on both sides. The cloud side uses a virtual private gateway with a static route to the on-premises network. Which of the following should the engineer do FIRST to resolve the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the crypto map configuration on the Cisco ASA and ensure it matches the peer IP and proxy IDs
The error message 'no matching crypto map entry for traffic from on-prem to cloud' indicates that the Cisco ASA does not have a crypto map that matches the traffic. This is a common issue when proxy IDs (or interesting traffic definitions) do not align between the VPN endpoints. Since the IKEv2 proposals match, the problem is likely in the crypto map configuration. Checking the crypto map on the ASA to ensure it matches the peer IP and proxy IDs is the correct first step. Option A is correct. Option B is incorrect because disabling NAT traversal could cause connectivity issues if NAT is present. Option C is unnecessary as IKEv2 policies already match. Option D is too drastic and not the first troubleshooting step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check the crypto map configuration on the Cisco ASA and ensure it matches the peer IP and proxy IDs
Why this is correct
The 'no matching crypto map entry' error is resolved by correcting the crypto map.
- ✗
Disable NAT traversal on both VPN endpoints
Why it's wrong here
NAT traversal is often required for VPNs behind NAT; disabling it may cause further issues.
- ✗
Reconfigure the IKEv2 policies on both sides to use different encryption algorithms
Why it's wrong here
The problem is not IKEv2 policy mismatch; the error points to crypto map.
- ✗
Replace the VPN connection with AWS Direct Connect for dedicated bandwidth
Why it's wrong here
This is an expensive and unnecessary escalation; the issue is configuration, not connectivity type.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.