A remote access VPN client is configured to use IPsec with IKEv2. The client successfully authenticates and establishes the phase 1 SA, but then the connection fails. The administrator checks the logs and sees that phase 2 negotiation failed. What is the most likely reason?

The client and server have different phase 2 proposals (e.g., encryption algorithms)

The server's pre-shared key is incorrect

The client's username or password is incorrect

The client is using the wrong IPsec mode (transport vs. tunnel)

In an IPsec VPN, what is the role of a Security Association (SA)?

It authenticates the IP header of each packet.

It defines the encryption, authentication, and keying parameters for the VPN tunnel.

It encrypts the IP payload of each packet.

It establishes the VPN tunnel between peers.

During IKE Phase 1, what is the primary goal?

To establish a secure and authenticated channel between the VPN peers.

To negotiate the IPsec security associations for protecting data traffic.

To exchange encryption keys for the data plane.

To authenticate the data packets flowing through the tunnel.

A company is deploying an IPsec remote access VPN for its employees. The VPN gateway is configured to use IKEv2. Which statement about IKEv2 is true?

IKEv2 is more resistant to denial-of-service attacks than IKEv1

IKEv2 requires the use of certificates for authentication

IKEv2 uses a single phase to establish both the IKE SA and the IPsec SAs

IKEv2 does not support EAP authentication

CiscoCertified Network Associate (CCNA)

Domain 5Objective 5

5.5 Describe IPsec Remote Access and Site-To-Site VPNs 200-301 Practice Questions (Page 5)

Part of the Security Fundamentals domain, which accounts for 15% of the 200-301 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

15%of the exam

Questions 21–25

21application · medium
A remote access VPN client is configured to use IPsec with IKEv2. The client successfully authenticates and establishes the phase 1 SA, but then the connection fails. The administrator checks the logs and sees that phase 2 negotiation failed. What is the most likely reason?
Select an answer first
22foundation · easy
In which IPsec mode is the original IP header preserved and only the payload is encrypted?
Select an answer first
23foundation · easy
In an IPsec VPN, what is the role of a Security Association (SA)?
Select an answer first
24foundation · easy
During IKE Phase 1, what is the primary goal?
Select an answer first
25application · medium
A company is deploying an IPsec remote access VPN for its employees. The VPN gateway is configured to use IKEv2. Which statement about IKEv2 is true?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-301

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-301” is a trademark of its owner, used for identification only.