What is a common result of mismatched IPsec SA lifetime values between two VPN peers?

The tunnel uses the longer lifetime for both peers

The tunnel fails to establish immediately

The tunnel establishes, but renegotiation may occur at unexpected times or fail

The tunnel uses the shorter lifetime for both peers

A new FTD is deployed at a branch office. The site-to-site VPN to headquarters does not establish. The FTD's `debug crypto ikev2` shows no output when the remote peer initiates. `show interface ip brief` shows the outside interface is up/up with the correct IP. What should you check first?

Verify that an access rule allows UDP 500 and UDP 4500 from the remote peer to the outside interface.

Check the crypto map configuration to ensure the peer IP is correct.

Verify that the IKEv2 proposal on the FTD matches the remote peer's proposal.

Confirm that the pre-shared key is correctly configured on both ends.

What is the role of a trust point in certificate-based VPN authentication on Cisco FTD?

It defines the CA certificate and associated key pair used to validate peer certificates

It stores the pre-shared keys for all VPN peers

It configures the encryption algorithms for the IKE SA

It specifies the IP address of the certificate revocation list (CRL) server

How can a NAT policy on a Cisco FTD prevent a site-to-site VPN tunnel from establishing?

By encrypting the IKE packets, making them unreadable to the peer

By blocking UDP port 500 on the inside interface

By changing the routing table to send IKE packets to the wrong next hop

By translating the VPN peer's IP address before it reaches the crypto engine

A site-to-site VPN between two FTDs is failing. The local FTD's `debug crypto ikev2` shows 'Received notification: NO_PROPOSAL_CHOSEN' during CREATE_CHILD_SA. The IKE SA was established successfully. What is the most likely cause?

The pre-shared key on the local FTD does not match the remote FTD's key.

The IKEv2 proposal on the local FTD does not match the remote FTD's proposal.

The IPsec transform set on the local FTD does not match the remote FTD's transform set.

The crypto map ACL on the local FTD does not include the remote subnet.

CiscoCertified Network Professional Security

Domain 2Objective 10

2.10 Troubleshoot VPN Tunnel Establishment on Cisco Secure Firewall (FTD) 350-701 Practice Questions (Page 1)

Part of the Network Security domain, which accounts for 25% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

7concepts

25%of the exam

Questions 1–5

1foundation · easy
What is a common result of mismatched IPsec SA lifetime values between two VPN peers?
Select an answer first
2application · medium
A new FTD is deployed at a branch office. The site-to-site VPN to headquarters does not establish. The FTD's `debug crypto ikev2` shows no output when the remote peer initiates. `show interface ip brief` shows the outside interface is up/up with the correct IP. What should you check first?
Select an answer first
3foundation · easy
What is the role of a trust point in certificate-based VPN authentication on Cisco FTD?
Select an answer first
4foundation · easy
How can a NAT policy on a Cisco FTD prevent a site-to-site VPN tunnel from establishing?
Select an answer first
5application · medium
A site-to-site VPN between two FTDs is failing. The local FTD's `debug crypto ikev2` shows 'Received notification: NO_PROPOSAL_CHOSEN' during CREATE_CHILD_SA. The IKE SA was established successfully. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.