VPN & IKE Practice Questions

Answers and explanations appear when you work through the set above.

1. In IKEv2 configuration on Cisco IOS XE, what element defines the proposal parameters (encryption, integrity, Diffie-Hellman group) for establishing the IKE SA control tunnel?

   • crypto ikev2 proposal
   • crypto ipsec transform-set
   • crypto map
   • pki trustpoint

2. What is the primary advantage of IKEv2 over IKEv1 during the initial SA negotiation exchange?

   • It needs as few as 4 messages and builds in NAT traversal and asymmetric authentication.
   • It removes the Diffie-Hellman exchange entirely, so no key material is computed during setup.
   • It supports only pre-shared keys and drops certificate authentication to simplify setup.
   • It cannot negotiate Child SAs, so all traffic is carried inside the single IKE SA.

3. What does IKEv1 Quick Mode negotiate, and what does IKEv2 negotiate when creating or rekeying a Child SA?

   • The Diffie-Hellman group and hash algorithm that protect the IKE control session for its entire lifetime.
   • The IPsec SA transforms (encryption and integrity) and the traffic selectors for the data traffic.
   • The certificate authority trustpoint each peer uses to validate the other's certificate.
   • The hostname or FQDN each peer sends as its ISAKMP identity payload during authentication.

4. Which IOS XE command defines the encryption, hash, authentication method, and DH group used specifically for an IKEv1 Phase 1 ISAKMP policy?

   • crypto isakmp policy <priority>
   • crypto ipsec transform-set <name>
   • crypto map <name> ipsec-isakmp
   • access-list 100 permit ip

5. What does Perfect Forward Secrecy (PFS) add to an IPsec Phase 2 rekey when enabled?

   • It reuses the original Phase 1 Diffie-Hellman shared secret to derive the keys for every later Phase 2 rekey.
   • It runs a fresh Diffie-Hellman exchange at each Phase 2 rekey, so one leaked key does not expose other SAs.
   • It turns off encryption during rekeying so that new SAs can be installed more quickly.
   • It removes the need for a pre-shared key or certificate when the peers authenticate.

6. In a site-to-site IPsec VPN using a crypto map, what does the associated extended ACL (interesting traffic ACL) actually control?

   • Which VLANs are allowed to trunk across the WAN link toward the remote peer site.
   • Which traffic flows trigger the tunnel and are encrypted under that crypto map entry.
   • Which OSPF neighbors may form adjacencies across the tunnel with the local router.
   • Which DHCP pool hands out inside addresses to remote access VPN clients when they connect.

7. Why is Dead Peer Detection (DPD) configured on an IPsec VPN tunnel between two IOS XE routers?

   • To negotiate the Diffie-Hellman group that the peers use when the IPsec SAs are rekeyed.
   • To detect a dead IKE peer so its SAs are cleared and traffic fails over instead of being black-holed.
   • To encrypt the tunnel keepalive messages with AES-GCM so they cannot be spoofed by attackers.
   • To assign static inside IP addresses to remote VPN clients from an address pool on the headend router.

8. What is the main architectural difference between policy-based IPsec VPNs (crypto map with an ACL) and route-based IPsec VPNs (such as a GRE or VTI tunnel protected by IPsec)?

   • Policy-based VPNs use a routable virtual tunnel interface, while route-based VPNs rely entirely on a crypto ACL to define which traffic is encrypted.
   • Route-based VPNs use a routable tunnel interface that can run routing protocols; policy-based VPNs use an ACL to pick what is encrypted.
   • There is no meaningful difference between the two approaches on IOS XE, only the CLI keywords differ.
   • Policy-based VPNs require BGP to exchange routes, while route-based VPNs can use only static routes.

9. Which IKEv2 exchange is responsible for mutually authenticating the two peers after the initial Diffie-Hellman key material has already been exchanged?

   • IKE_SA_INIT
   • IKE_AUTH
   • CREATE_CHILD_SA
   • INFORMATIONAL