hardMultiple ChoiceObjective-mapped
SSCP Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. crypto isakmp policy 10 authentication pre-share encryption aes 256 hash sha group 14 lifetime 3600 crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
Refer to the exhibit. A network administrator is reviewing the VPN configuration on a site-to-site VPN hub. Which of the following is the most significant security vulnerability in this configuration?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The pre-shared key is applied to all potential peers due to the wildcard address
The most significant security vulnerability in this configuration is the use of a wildcard peer address (0.0.0.0 0.0.0.0) for the ISAKMP key. This allows any device to attempt authentication using the same pre-shared key, effectively turning it into a shared secret across all potential peers. An attacker who obtains the key can establish unauthorized VPN connections. While AES-256 is a strong encryption algorithm, SHA is generally secure (though specific versions like SHA-1 are deprecated), and the key length is not the issue here. The wildcard setting is the critical flaw, making Option B correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The encryption algorithm AES-256 is too weak
Why it's wrong here
AES-256 is a strong encryption algorithm and is considered secure for VPNs. This is not a vulnerability.
- ✓
The pre-shared key is applied to all potential peers due to the wildcard address
Why this is correct
The wildcard peer address (0.0.0.0 0.0.0.0) means the key is shared with any device, making it a shared secret across all peers. This greatly increases the risk of unauthorized access.
- ✗
The hash algorithm SHA is insecure
Why it's wrong here
SHA (Secure Hash Algorithm) is a family of secure cryptographic hash functions. The specific version (SHA-1 or SHA-2) is not specified, but SHA in general is considered secure for IKE. The vulnerability is not in the hash algorithm.
- ✗
The pre-shared key is too short and easily guessable
Why it's wrong here
While 'cisco123' is weak, the more critical issue is the wildcard peer address, which exposes the key to any entity. A strong key alone would not mitigate this exposure.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.