NSE4 Authentication and VPN Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  It reduces the number of IPsec SAs needed

  Why it's wrong here

  This is incorrect. In a hub-and-spoke VPN, each spoke establishes its own IPsec tunnel with the hub, and every tunnel requires its own set of Phase 2 SAs (one per direction) regardless of whether the Phase 2 selector is a specific subnet or 0.0.0.0/0. The broad selector only means one Phase 2 SA on a given tunnel can cover traffic for multiple subnets at that spoke; it does not collapse the per-spoke SA pairs into a single SA. The total number of SAs is driven by the number of active spoke peers, not by the width of the proxy ID.

• ✓

  It simplifies configuration by not needing specific subnet definitions per spoke

  Why this is correct

  This is correct. Configuring the Phase 2 selector as 0.0.0.0/0 on the hub means the hub will accept any source and destination subnet from the spoke during Phase 2 negotiation, so there is no need to define each spoke's LAN subnets explicitly. When a spoke adds, removes, or changes a protected subnet behind it, the hub's Phase 2 configuration remains valid and no reconfiguration is required. This greatly simplifies hub management in a dynamic environment where spoke subnets are not stable or are unknown in advance.

• ✗

  It allows direct spoke-to-spoke communication without passing through the hub

  Why it's wrong here

  This is incorrect. Even with a 0.0.0.0/0 Phase 2 selector, spoke-to-spoke traffic must still pass through the hub because each spoke only has a single IPsec peer — the hub — and no direct tunnel exists between spokes. The hub receives the encrypted packet from one spoke, decrypts it, examines the destination, re-encrypts it with the SA for the destination spoke, and forwards it; this is normal hub-and-spoke forwarding. A 0.0.0.0/0 selector only controls which traffic can be encrypted on a given tunnel, not the topology or routing path.

• ✗

  It enables dynamic routing protocols over the VPN

  Why it's wrong here

  This is incorrect. Phase 2 selectors (proxy IDs) determine which IP traffic is protected by an IPsec SA; they have no effect on whether dynamic routing protocols such as OSPF or BGP can run over the tunnel. To use dynamic routing, you must configure the routing protocol on the tunnel interface (or over the VPN virtual interface), define appropriate neighbors and policy routes, and in many cases enable additional settings such as mode-config or interface mode. The 0.0.0.0/0 selector simply tells the gateway that all subnets are interesting traffic; it does not enable or disable routing processes.

Go deeper

Related to this question