5.5 Describe IPsec Remote Access and Site-To-Site VPNs 200-301 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A network engineer is configuring a site-to-site IPsec VPN between two routers. The engineer wants to use IKEv2 and ESP in tunnel mode. The engineer also wants to ensure that the VPN can recover quickly if the tunnel drops. Which feature should be enabled?

   • APerfect Forward Secrecy (PFS)
   • BAggressive mode
   • CNAT traversal (NAT-T)
   • DDead Peer Detection (DPD)
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A network engineer is configuring a site-to-site IPsec VPN between two routers. The engineer wants to use pre-shared keys for authentication and ESP for encryption. During the configuration, the engineer must ensure that the VPN can traverse a NAT device on the path. Which additional configuration is required?

   • AUse a longer pre-shared key
   • BEnable NAT traversal (NAT-T) on both peers
   • CUse AH instead of ESP
   • DConfigure the VPN in transport mode
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is typically configured on the VPN gateways of a site-to-site IPsec VPN to authenticate each other?

   • AA pre-shared key or digital certificates.
   • BMAC address filtering on the WAN interface.
   • CDynamic routing protocol authentication.
   • DA username and password for each user.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is deploying an IPsec remote access VPN. The VPN gateway is configured to use IKEv2 with EAP authentication. A user reports that they can authenticate but cannot access any internal resources. The administrator checks the VPN gateway and sees that the phase 1 SA is established, but no IPsec SAs are present. What is the most likely cause?

   • AThe VPN gateway is not configured with a pool of IP addresses for remote clients
   • BThe phase 2 proposal (encryption/integrity algorithms) does not match between the client and gateway
   • CThe user's password is incorrect
   • DThe user's account is not authorized for the internal network
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A network engineer is configuring a site-to-site VPN between two routers. The VPN must support multiple subnets on each side. Which configuration element is essential for the VPN to route traffic between these subnets?

   • AAn IPsec profile applied to the WAN interface
   • BA crypto map that specifies the peer and the interesting traffic (ACL) for each subnet pair
   • CA NAT rule to translate all internal addresses to the WAN interface
   • DA single static route pointing to the remote router's public IP address
   Reveal Solution Discussion Select an answer first