hardMultiple ChoiceObjective-mapped
Why Phase 2 Negotiation Fails in IPsec VPNs: Traffic Selector Mismatch
A cloud administrator is managing a hybrid cloud environment where on-premises servers connect to a public cloud VPC via a site-to-site VPN. Users report intermittent connectivity issues to cloud resources. The administrator examines the VPN tunnel logs and sees 'Phase 2 negotiation failed' errors. Which of the following is the MOST likely cause?
Quick Answer
The answer is mismatched encryption domain definitions (traffic selectors) between the on-premises and cloud VPN gateways. This is the most likely cause of a site-to-site VPN phase 2 failure because Phase 2 negotiation establishes the IPsec security associations (SAs) that encrypt actual data traffic, and each gateway must agree on exactly which local and remote subnets, protocols, and ports are allowed. When these traffic selectors do not align—for example, if the on-premises gateway defines 10.0.0.0/16 while the cloud gateway expects 10.0.1.0/24—the gateways cannot complete the SA, resulting in intermittent connectivity or complete failure. On the CompTIA Cloud+ CV0-004 exam, this tests your ability to diagnose hybrid cloud VPN issues, often appearing in scenario-based questions where logs show “Phase 2 negotiation failed.” A common trap is to blame pre-shared key errors or routing, but remember: Phase 1 handles authentication, Phase 2 handles traffic—so when Phase 2 fails, think selectors. Memory tip: “Phase 2 is about the ‘what’—what traffic gets encrypted—so mismatched ‘whats’ break the tunnel.”
⚠ Common exam trap
Test-takers frequently confuse Phase 1 and Phase 2 failures, incorrectly attributing the error to pre-shared key mismatches (Phase 1) instead of traffic selector mismatches (Phase 2).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mismatched encryption domain definitions (traffic selectors) between on-premises and cloud VPN gateways.
Phase 2 negotiation failures in IPsec VPNs indicate that the two gateways cannot agree on the security associations (SAs) for encrypting data traffic. This is most commonly caused by mismatched encryption domain definitions (traffic selectors), such as differing local/remote subnets, protocols, or ports. When the on-premises and cloud VPN gateways define the allowed traffic differently, they cannot establish the Phase 2 SA, leading to intermittent connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dead Peer Detection (DPD) is disabled on one side.
Why it's wrong here
DPD affects tunnel health detection, not negotiation.
- ✗
Incorrect pre-shared key used for the VPN tunnel.
Why it's wrong here
Incorrect pre-shared key causes Phase 1 failure, not Phase 2.
- ✗
Packet loss due to high latency on the internet link.
Why it's wrong here
Packet loss could cause timeouts but not specific Phase 2 failure.
- ✓
Mismatched encryption domain definitions (traffic selectors) between on-premises and cloud VPN gateways.
Why this is correct
Phase 2 negotiates encryption domains; mismatched selectors cause failure.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 977 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CV0-004
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A cloud administrator is troubleshooting a connectivity issue between two virtual networks in different cloud regions. The networks are connected via a VPN gateway. The administrator can ping resources in one network but not the other. Which of the following should the administrator check FIRST?
hard- A.Confirm the local network gateways have the correct NIC IP addresses
- B.Verify the VPN tunnel status on both gateways
- C.Check network security groups for blocking ICMP
- ✓ D.Review the route tables on both sides for the remote network prefix
Why D: The correct first step is to review the route tables on both sides for the remote network prefix. Since the administrator can ping resources in one direction but not the other, the issue is likely asymmetric routing or a missing route for the return traffic. Route tables control how traffic is forwarded between virtual networks, and a missing or incorrect route for the remote network prefix would prevent bidirectional communication, even if the VPN tunnel is up.
Variation 2. A cloud administrator manages a hybrid cloud environment where on-premises servers connect to a VPC in AWS via a VPN connection. The on-premises network uses IP range 10.0.0.0/16. The VPC uses 172.16.0.0/16. The VPN is established and the tunnel status is UP. However, on-premises hosts cannot ping EC2 instances in the VPC. The administrator logs into an EC2 instance and can ping the on-premises VPN gateway IP. The security groups and network ACLs are configured to allow all traffic. The route tables in the VPC have a route to the on-premises network via the virtual private gateway. The on-premises firewall logs show that packets from the VPC are being dropped. What is the most likely cause?
medium- A.The VPN tunnel is misconfigured and not passing traffic.
- ✓ B.The on-premises firewall is blocking traffic from the VPC CIDR range.
- C.The security group attached to the EC2 instance is blocking inbound ICMP.
- D.The VPC route table does not have a route to the on-premises network.
Why B: The on-premises firewall logs explicitly show that packets from the VPC are being dropped, indicating the firewall is filtering traffic from the VPC CIDR range (172.16.0.0/16). Since the VPN tunnel is UP, the EC2 instance can ping the on-premises VPN gateway IP, and security groups/network ACLs allow all traffic, the only remaining point of failure is the on-premises firewall blocking the return traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.