Which interface setting on a Cisco FTD could prevent IKE packets from being processed, causing VPN tunnel establishment to fail?

The interface is configured with a secondary IP address

The interface has a high speed setting

During IPsec SA negotiation, if the two peers propose different encryption algorithms, what is the most likely outcome?

The IPsec SA is established but with reduced security

The peers automatically use the strongest algorithm from either proposal

The peers use the first algorithm listed in the initiator's proposal

The IPsec SA negotiation fails because no common proposal is found

A site-to-site VPN between two FTDs is failing. The local FTD's `debug crypto ikev2` shows that IKE_SA_INIT is sent and a response is received, but then the debug shows 'Received notification: NO_PROPOSAL_CHOSEN' during IKE_AUTH. What is the most likely cause?

The crypto map ACL on the local FTD does not include the remote subnet.

The IPsec transform set on the local FTD does not match the remote FTD's transform set.

The pre-shared key on the local FTD does not match the remote FTD's key.

The IKEv2 authentication method (e.g., pre-shared key vs. certificate) configured on the local FTD does not match the remote FTD's configuration.

A site-to-site VPN between two FTDs is failing. The local FTD's `debug crypto ikev2` shows 'Received notification: AUTHENTICATION_FAILED' during IKE_AUTH. Which configuration issue is most likely?

The IKEv2 proposal on the local FTD does not match the remote FTD's proposal.

The IPsec transform set on the local FTD does not match the remote FTD's transform set.

The crypto map ACL on the local FTD does not include the remote subnet.

The pre-shared key configured on the local FTD does not match the remote FTD's key.

A site-to-site VPN between two Cisco FTDs fails to establish. Which configuration mismatch is a common cause of IKEv2 SA negotiation failure?

Mismatched tunnel interface MTU settings

Different hostnames on the FTDs

Mismatched pre-shared keys (PSKs)

Different management interface IP addresses

CiscoCertified Network Professional Security

Domain 2Objective 10

2.10 Troubleshoot VPN Tunnel Establishment on Cisco Secure Firewall (FTD) 350-701 Practice Questions (Page 4)

Part of the Network Security domain, which accounts for 25% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

7concepts

25%of the exam

Questions 16–20

16foundation · easy
Which interface setting on a Cisco FTD could prevent IKE packets from being processed, causing VPN tunnel establishment to fail?
Select an answer first
17foundation · easy
During IPsec SA negotiation, if the two peers propose different encryption algorithms, what is the most likely outcome?
Select an answer first
18application · medium
A site-to-site VPN between two FTDs is failing. The local FTD's `debug crypto ikev2` shows that IKE_SA_INIT is sent and a response is received, but then the debug shows 'Received notification: NO_PROPOSAL_CHOSEN' during IKE_AUTH. What is the most likely cause?
Select an answer first
19application · medium
A site-to-site VPN between two FTDs is failing. The local FTD's `debug crypto ikev2` shows 'Received notification: AUTHENTICATION_FAILED' during IKE_AUTH. Which configuration issue is most likely?
Select an answer first
20foundation · easy
A site-to-site VPN between two Cisco FTDs fails to establish. Which configuration mismatch is a common cause of IKEv2 SA negotiation failure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.