5.5 Describe IPsec Remote Access and Site-To-Site VPNs 200-301 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the main purpose of IKE Phase 2 in an IPsec VPN?

   • ATo authenticate the VPN peers using pre-shared keys or certificates.
   • BTo negotiate the IPsec security associations used to protect data traffic.
   • CTo establish the ISAKMP SA for the control channel.
   • DTo encrypt the IP header of each packet.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During IPsec remote access VPN setup, a user's client successfully completes IKE phase 1 but fails during IKE phase 2. What is the most likely cause?

   • AIncorrect Diffie-Hellman group in phase 1
   • BMismatched pre-shared keys
   • CMismatched IPsec transform sets or proxy IDs
   • DThe VPN gateway is behind NAT
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a main office and three branch offices. Each branch has a router with a static public IP. The company also has 200 remote users who connect from home with dynamic IPs. The IT budget is limited, and the team wants to minimize the number of VPN gateways to manage. Which approach best balances scalability and management overhead?

   • AConfigure a full-mesh site-to-site VPN between all offices and a remote access VPN on each branch router.
   • BUse a single site-to-site VPN between the main office and one branch, and rely on that branch to route to the others.
   • CConfigure a hub-and-spoke site-to-site VPN from each branch to the main office, and a separate remote access VPN on the main office gateway for users.
   • DUse only remote access VPNs for both branches and users, with each branch router acting as a client.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A network administrator needs to connect a remote employee's laptop to the corporate network over the internet. Which type of IPsec VPN is designed for this scenario?

   • ASite-to-site VPN
   • BRemote access VPN
   • CTransport mode VPN
   • DTunnel mode VPN
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company has two offices connected via an IPsec site-to-site VPN. The VPN is currently configured with a single tunnel. The company is adding a third office and wants to ensure that all offices can communicate with each other. What is the most scalable approach?

   • AUse a single site-to-site tunnel with multiple subnets
   • BUse a hub-and-spoke topology with a central hub router
   • CUse remote access VPNs for each office
   • DConfigure a full mesh of site-to-site tunnels between all offices
   Reveal Solution Discussion Select an answer first