NSE7 Advanced VPN and Zero Trust Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Detect loss of connectivity to the remote VPN peer

  Why this is correct

  Dead Peer Detection sends periodic probes to the remote gateway and, when replies stop arriving, declares the peer dead and tears down the security association. This detects loss of connectivity to the remote VPN peer so traffic can fail over or renegotiate.

• ✗

  Detect if the VPN tunnel is using the correct encryption algorithm

  Why it's wrong here

  DPD detects peer unreachability by sending R-U-THERE probes and awaiting acknowledgement; encryption algorithm mismatches are surfaced during IKE or IPsec SA negotiation, not by DPD. It is tempting because DPD runs inside the tunnel, but its purpose is liveness detection so failed peers can be torn down and routes reconverged.

• ✗

  Detect duplicate IP addresses on the network

  Why it's wrong here

  DPD sends encrypted probes through the tunnel to confirm the peer is still reachable, so it cannot inspect host addressing at all. Duplicate IP addresses are found by ARP probing or network scanning tools, which is where this option would apply.

• ✗

  Detect packet loss over the VPN tunnel

  Why it's wrong here

  DPD detects whether the remote peer is alive and responding, not the volume of lost packets traversing the tunnel; packet loss is measured by transport or QoS statistics. It is tempting because DPD relies on probe acknowledgements, but missing replies indicate peer death, not general loss over the VPN.

Go deeper

Related to this question