Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
mediumDrag & DropObjective-mapped
ISC2 CC Practice Question: Drag and drop the steps to configure a basic VPN…
Drag and drop the steps to configure a basic VPN (site-to-site) between two routers into the correct order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure IKE policy and pre-shared key, then configure IPsec transform set, then define interesting traffic with crypto ACL, then create and apply crypto map to the interface, then verify the VPN tunnel.
Configuring a site-to-site VPN between two routers requires a specific sequence: first establish IKE policy and pre-shared keys for authentication, then define the IPsec transform set for encryption and integrity, then specify interesting traffic via a crypto ACL, then create and apply the crypto map to the outgoing interface, and finally verify the tunnel. This order ensures all security parameters are correctly bound and operational.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure IKE policy and pre-shared key, then configure IPsec transform set, then define interesting traffic with crypto ACL, then create and apply crypto map to the interface, then verify the VPN tunnel.
Why this is correct
This is the correct order because IKE policy must be established first to negotiate security associations, followed by the transform set for encryption and authentication, then the crypto ACL to specify traffic, then the crypto map to bind all parameters, and finally verification to ensure the tunnel is operational.
- ✗
Define interesting traffic with crypto ACL, then configure IPsec transform set, then configure IKE policy and pre-shared key, then create and apply crypto map, then verify.
Why it's wrong here
This is incorrect because the crypto ACL should be defined after the IKE policy and transform set, as the crypto map uses both to protect the matched traffic. Defining ACL first without the security parameters is not possible.
- ✗
Configure IKE policy and pre-shared key, then define interesting traffic with crypto ACL, then configure IPsec transform set, then create and apply crypto map, then verify.
Why it's wrong here
This is incorrect because the IPsec transform set should be configured before the crypto ACL, as the crypto map references the transform set. Defining ACL before the transform set may lead to incompatible settings.
- ✗
Verify the VPN tunnel, then configure IKE policy, then configure IPsec transform set, then define ACL, then create crypto map.
Why it's wrong here
This is incorrect because verification must occur after the configuration is complete. Configuring parameters after verifying is illogical; the tunnel cannot be verified before it is configured.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
IKE
IKE (Internet Key Exchange) is a protocol used to set up a secure, authenticated communication channel between two parties by establishing and managing the Security Associations for IPsec.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.