A VPN administrator is troubleshooting a remote access VPN. The client and gateway successfully complete IKE phase 1, but phase 2 fails. The administrator suspects a mismatch in the IPsec proposal. Which action should the administrator take to resolve the issue?

Verify that the pre-shared key is identical on both ends.

Verify that the Diffie-Hellman group matches on both ends.

Verify that the VPN gateway has a public IP address.

Verify that the encryption and integrity algorithms in the transform set match on both ends.

A network engineer is configuring a site-to-site IPsec VPN between two routers. The engineer wants to ensure that the data traffic is encrypted and authenticated, but also wants to minimize overhead. Which IPsec protocol should be used?

ESP (Encapsulating Security Payload)

ISAKMP (Internet Security Association and Key Management Protocol)

A small business has a main office and a branch office. They want to connect the two offices securely and also allow a few employees to work from home. Which VPN approach is most appropriate?

Use a GRE tunnel for the branch office and IPsec for home workers.

Deploy a site-to-site VPN for the branch office and a remote access VPN for home workers.

Deploy a single remote access VPN for both the branch office and home workers.

Deploy a single site-to-site VPN for both the branch office and home workers.

Which component is typically required on a remote access VPN client to establish an IPsec tunnel?

VPN client software configured with the VPN server's address and authentication credentials.

A site-to-site VPN gateway at the client's location.

A dedicated leased line to the corporate network.

A static public IP address on the client's internet connection.

CiscoCertified Network Associate (CCNA)

Domain 5Objective 5

5.5 Describe IPsec Remote Access and Site-To-Site VPNs 200-301 Practice Questions (Page 4)

Part of the Security Fundamentals domain, which accounts for 15% of the 200-301 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

15%of the exam

Questions 16–20

16expert · hard
A VPN administrator is troubleshooting a remote access VPN. The client and gateway successfully complete IKE phase 1, but phase 2 fails. The administrator suspects a mismatch in the IPsec proposal. Which action should the administrator take to resolve the issue?
Select an answer first
17application · medium
A network engineer is configuring a site-to-site IPsec VPN between two routers. The engineer wants to ensure that the data traffic is encrypted and authenticated, but also wants to minimize overhead. Which IPsec protocol should be used?
Select an answer first
18application · medium
A small business has a main office and a branch office. They want to connect the two offices securely and also allow a few employees to work from home. Which VPN approach is most appropriate?
Select an answer first
19foundation · easy
Which component is typically required on a remote access VPN client to establish an IPsec tunnel?
Select an answer first
20application · medium
A network engineer is configuring a site-to-site IPsec VPN between two branch routers. The traffic between the branches consists of standard TCP and UDP applications, and the engineer wants to minimize overhead while still providing confidentiality and integrity. Which IPsec protocol and mode combination should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-301

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-301” is a trademark of its owner, used for identification only.