CEH Footprinting and Reconnaissance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Phase 1, then Phase 2, then traffic selectors, then apply policies, then test.

  Why this is correct

  This is the correct order because IPsec tunnel mode setup begins with IKE Phase 1 to establish a secure channel, followed by Phase 2 to negotiate IPsec SAs, then traffic selectors define interesting traffic, policies are applied, and finally testing verifies connectivity.

• ✗

  Phase 2, then Phase 1, then traffic selectors, then apply policies, then test.

  Why it's wrong here

  IPsec tunnel setup strictly requires IKE Phase 1 to complete before Phase 2 can commence. Phase 1 establishes a secure, authenticated channel (the IKE Security Association or IKE SA) for key exchange and protects subsequent negotiations. Without a secure IKE SA from Phase 1, Phase 2 cannot safely negotiate the IPsec Security Associations (IPsec SAs) that define the actual data encryption and authentication parameters for user traffic. Therefore, reversing this order makes the entire IPsec setup impossible.

• ✗

  Phase 1, then traffic selectors, then Phase 2, then apply policies, then test.

  Why it's wrong here

  While traffic selectors define which network traffic should be protected by the IPsec tunnel, their negotiation and application are intrinsically linked to IKE Phase 2. Phase 2 is where the specific IPsec Security Associations (SAs) are established, and these SAs are directly tied to the agreed-upon traffic selectors between the peers. Attempting to define traffic selectors before Phase 2 negotiation means they lack the context of the negotiated IPsec SAs, potentially leading to misconfigurations or a failure to establish the tunnel correctly.

• ✗

  Phase 1, then Phase 2, then apply policies, then traffic selectors, then test.

  Why it's wrong here

  The logical flow of IPsec configuration dictates that traffic selectors must be defined before security policies can be effectively applied. Traffic selectors specify the "interesting" traffic that the IPsec tunnel should protect, acting as criteria for policy enforcement. Security policies then dictate how that identified traffic should be handled (e.g., permit, deny, or protect with a specific IPsec SA). Applying policies before defining the traffic selectors they are meant to govern would result in policies having no specific traffic to act upon, rendering the configuration ineffective or incorrect.

Go deeper

Related to this question