SSCP Practice Question: Drag and drop the steps for establishing a VPN…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  IKE Phase 1: Establish management SA, then IKE Phase 2: Establish IPsec SA, then Apply IPsec SA to traffic

  Why this is correct

  This is the correct order because IKE Phase 1 authenticates peers and creates a secure channel, IKE Phase 2 negotiates the IPsec SA for data protection, and then traffic is encrypted/decrypted using the established IPsec SA.

• ✗

  IKE Phase 2: Establish IPsec SA, then IKE Phase 1: Establish management SA, then Apply IPsec SA to traffic

  Why it's wrong here

  This is incorrect because IKE Phase 2 depends on the secure channel established in Phase 1; Phase 1 must occur first.

• ✗

  Apply IPsec SA to traffic, then IKE Phase 1: Establish management SA, then IKE Phase 2: Establish IPsec SA

  Why it's wrong here

  This is incorrect because applying IPsec SA to traffic requires the SAs to already be established; attempting to do so first would fail as no security associations exist.

• ✗

  IKE Phase 1: Establish management SA, then Apply IPsec SA to traffic, then IKE Phase 2: Establish IPsec SA

  Why it's wrong here

  This is incorrect because applying IPsec SA to traffic before Phase 2 would try to use an IPsec SA that hasn't been negotiated yet; Phase 2 must precede application.

Go deeper

Related to this question