A network administrator is troubleshooting an IPsec site-to-site VPN that is not passing traffic. The administrator runs 'show crypto isakmp sa' and sees that the IKE SA is in QM_IDLE state. The administrator then runs 'show crypto ipsec sa' and sees no IPsec SAs. What is the most likely cause?

The pre-shared key is incorrect

The remote peer is not reachable

The tunnel is configured in transport mode instead of tunnel mode

The IPsec proposal (encryption/integrity algorithms) does not match between the peers

A remote access VPN user reports that the VPN tunnel establishes successfully, but after a few minutes the tunnel drops and re-establishes. The administrator suspects an issue with the IPsec security association (SA) lifetime. Which IKE phase is responsible for renegotiating the IPsec SA before it expires?

Neither phase; the SA is renegotiated by the VPN client

Both IKE phase 1 and phase 2 equally

A company wants to allow employees to securely access internal resources from home. The IT team plans to deploy IPsec remote access VPNs. Which statement correctly describes a key characteristic of this deployment?

The remote access VPN uses only IKE phase 1 and skips phase 2.

The VPN gateway encrypts traffic for all users without per-user authentication.

Each remote user's device is a VPN endpoint, and the corporate VPN gateway is the other endpoint.

The VPN tunnel is established between two routers, each protecting a whole network.

CiscoCertified Network Associate (CCNA)

Domain 5Objective 5

5.5 Describe IPsec Remote Access and Site-To-Site VPNs 200-301 Practice Questions (Page 6)

Part of the Security Fundamentals domain, which accounts for 15% of the 200-301 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

15%of the exam

Questions 26–30

26expert · hard
A network administrator is troubleshooting an IPsec site-to-site VPN that is not passing traffic. The administrator runs 'show crypto isakmp sa' and sees that the IKE SA is in QM_IDLE state. The administrator then runs 'show crypto ipsec sa' and sees no IPsec SAs. What is the most likely cause?
Select an answer first
27application · medium
A remote access VPN user reports that the VPN tunnel establishes successfully, but after a few minutes the tunnel drops and re-establishes. The administrator suspects an issue with the IPsec security association (SA) lifetime. Which IKE phase is responsible for renegotiating the IPsec SA before it expires?
Select an answer first
28foundation · easy
Which IPsec mode is most commonly used for site-to-site VPNs?
Select an answer first
29application · medium
A company wants to allow employees to securely access internal resources from home. The IT team plans to deploy IPsec remote access VPNs. Which statement correctly describes a key characteristic of this deployment?
Select an answer first
30application · medium
During IPsec troubleshooting, an engineer captures packets and sees that the original IP packet is encapsulated in a new IP header with a protocol field of 50. Which IPsec protocol is in use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-301

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-301” is a trademark of its owner, used for identification only.

5.5 Describe IPsec Remote Access and Site-To-Site VPNs 200-301 Practice Questions (Page 6)

Questions 26–30

A network administrator is troubleshooting an IPsec site-to-site VPN that is not passing traffic. The administrator runs 'show crypto isakmp sa' and sees that the IKE SA is in QM_IDLE state. The administrator then runs 'show crypto ipsec sa' and sees no IPsec SAs. What is the most likely cause?

Which IPsec mode is most commonly used for site-to-site VPNs?

A company wants to allow employees to securely access internal resources from home. The IT team plans to deploy IPsec remote access VPNs. Which statement correctly describes a key characteristic of this deployment?

During IPsec troubleshooting, an engineer captures packets and sees that the original IP packet is encapsulated in a new IP header with a protocol field of 50. Which IPsec protocol is in use?

Keep studying — Security Fundamentals