Advanced VPN and Zero Trust →hardMultiple ChoiceObjective-mapped

NSE7 Advanced VPN and Zero Trust Practice Question

An administrator runs the following CLI command on a FortiGate and sees the output below: diagnose vpn ike gateway list vd: root/0 name: REMOTE_GW vrf: 0 version: 2 state: UP IKE SA: created 1s ago 1.2.3.4:500->5.6.7.8:500 What is the most likely explanation for the IKE SA being created only 1 second ago?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The VPN tunnel was just configured or a configuration change was applied

The IKE SA was recently created, suggesting a previous SA was deleted and a new one established. This often happens after configuration changes or a restart of IKE negotiation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The remote peer changed its IP address
Why it's wrong here
A new IP would cause a new SA, but the output shows same IPs.
✗
DPD detected a dead peer and renegotiated
Why it's wrong here
DPD would delete and re-establish, but the timestamp is too recent for a typical DPD interval.
✗
The phase 2 SA expired and triggered phase 1 rekey
Why it's wrong here
Phase 2 expiry may trigger rekey but phase 1 SA would remain; this shows a new phase 1 SA.
✓
The VPN tunnel was just configured or a configuration change was applied
Why this is correct
Recent creation time indicates the SA was just negotiated, typical after applying config changes or restarting IKE.

Go deeper

NSE7 Advanced VPN and Zero Trust Practice Question

Why each option matters

Option-by-option breakdown

Related to this question