A company has a main office and 50 branch offices. Each branch office has a router with a dynamic public IP address. The company wants to connect all branch offices to the main office using IPsec VPNs. The main office has a static public IP address. Which VPN architecture is most appropriate?

A full mesh of site-to-site tunnels between all branch offices

Remote access VPNs with client software on each branch router

A single site-to-site VPN tunnel shared by all branch offices

Site-to-site VPNs with dynamic IP addressing using IKEv2 or DMVPN

In a site-to-site IPsec VPN, what is typically required on each VPN gateway to allow traffic to be routed through the tunnel?

A NAT translation for all traffic entering the tunnel.

A route (static or dynamic) that points the remote network's prefix to the VPN tunnel interface.

A DHCP server to assign IP addresses to remote users.

A RADIUS server for user authentication.

What is a common method used to authenticate users in an IPsec remote access VPN?

MAC address filtering on the VPN gateway.

Static routing between the client and the VPN gateway.

Pre-shared keys configured on both VPN gateways.

Username and password authentication, often integrated with a RADIUS server.

Which IPsec protocol provides authentication and integrity for the entire IP packet, including the IP header, but does NOT provide encryption?

ESP (Encapsulating Security Payload)

CiscoCertified Network Associate (CCNA)

Domain 5Objective 5

5.5 Describe IPsec Remote Access and Site-To-Site VPNs 200-301 Practice Questions (Page 3)

Part of the Security Fundamentals domain, which accounts for 15% of the 200-301 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

15%of the exam

Questions 11–15

11expert · hard
A company has a main office and 50 branch offices. Each branch office has a router with a dynamic public IP address. The company wants to connect all branch offices to the main office using IPsec VPNs. The main office has a static public IP address. Which VPN architecture is most appropriate?
Select an answer first
12foundation · easy
In a site-to-site IPsec VPN, what is typically required on each VPN gateway to allow traffic to be routed through the tunnel?
Select an answer first
13foundation · easy
What is a common method used to authenticate users in an IPsec remote access VPN?
Select an answer first
14application · medium
A network engineer is configuring a site-to-site IPsec VPN between two routers. The engineer wants to ensure that the original source and destination IP addresses of the internal hosts are not visible on the public internet. Which mode and protocol combination should be used?
Select an answer first
15foundation · easy
Which IPsec protocol provides authentication and integrity for the entire IP packet, including the IP header, but does NOT provide encryption?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-301

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-301” is a trademark of its owner, used for identification only.