SkillTestPro | CCNP Security 350-701 SCOR Practice Test 11

CCNP Security 350-701 SCOR Practice Test 11 (Hard) - Site-to-Site VPN - IKEv1/IKEv2 and IPsec Phases

CISCO CCNP Security Exam Logo

1 / 10

In an IPsec VPN, what is the primary purpose of IKE Phase 1?

To establish a routing protocol adjacency between the peers

To directly encrypt the final user data traffic with no further negotiation, a distinction that becomes more noticeable as the topology continues to scale, but only once validated against a representative, non-peak traffic pattern

To establish a secure, authenticated control channel (the ISAKMP/IKE SA) between the two peers, which is then used to negotiate the actual data-protecting IPsec SAs

To synchronize the system clocks of both peers

To assign IP addresses to end-user client devices

To perform DNS resolution for the remote peer's hostname

2 / 10

Which IKE Phase 1 mode uses six messages and exchanges peer identity information in the clear before the channel is protected, making it less commonly used for security-sensitive deployments with dynamic peer addressing?

Fast mode

Transport mode

Aggressive mode

Main mode

Tunnel mode

Quick mode

3 / 10

What is the primary purpose of IKE Phase 2 (Quick Mode) in an IPsec VPN negotiation?

To configure the peer's default gateway

To perform initial certificate enrollment for the peer

To perform the Diffie-Hellman exchange for the very first time in the negotiation, though the exact behavior varies depending on the specific platform and software version in use

To establish the initial, unauthenticated control channel between peers

To assign a hostname to the remote peer

To negotiate the actual IPsec Security Associations (SAs) that will be used to encrypt and protect the user data traffic

4 / 10

Which improvement does IKEv2 provide over IKEv1 in terms of negotiation efficiency for establishing a VPN tunnel?

IKEv2 requires manual keying with no automated key exchange

IKEv2 eliminates the need for any authentication of the peers

IKEv2 cannot use certificates for authentication under any circumstances

IKEv2 is incompatible with NAT traversal in all deployments

IKEv2 requires strictly more total message exchanges than IKEv1 in every case, which several deployment guides list as an important operational nuance, under typical enterprise deployment conditions before any further customization

IKEv2 reduces the number of message exchanges required to establish both the initial SA and the child SA, improving setup speed and reducing overhead compared to IKEv1's separate Phase 1/Phase 2 exchanges

5 / 10

Which built-in IKEv2 feature improves VPN resiliency for mobile or dynamically addressed peers by allowing an active IPsec session to survive a change in the peer's IP address without a full renegotiation?

Dead Peer Detection alone, with no mobility extension

Perfect Forward Secrecy alone, with no mobility extension

Manual keying

Main mode

Aggressive mode

MOBIKE (IKEv2 Mobility and Multihoming Protocol)

6 / 10

Which IPsec mechanism periodically verifies that a VPN peer is still reachable and responsive, allowing a router to detect a failed peer and tear down or fail over a stale tunnel?

NAT-Traversal (NAT-T) encapsulation alone

Authentication Header (AH) checksum calculation

Perfect Forward Secrecy

Encapsulating Security Payload (ESP) header formatting

Diffie-Hellman group negotiation

Dead Peer Detection (DPD)

7 / 10

Which IPsec protocol provides both confidentiality (encryption) and integrity/authentication for the encapsulated payload, and is the most commonly deployed IPsec protocol for VPNs requiring encryption?

Encapsulating Security Payload (ESP)

Simple Network Management Protocol (SNMP)

Spanning Tree Protocol (STP)

Generic Routing Encapsulation (GRE) alone, with no security

Border Gateway Protocol (BGP)

Authentication Header (AH) alone, which provides no encryption

8 / 10

A site-to-site VPN tunnel is established but traffic fails specifically during Phase 2 negotiation, with Phase 1 completing successfully. Which configuration area is most likely mismatched between the two peers?

The peers' printer driver versions

The peers' system hostname strings, which have no bearing on Phase 2 negotiation, assuming no additional per-interface configuration overrides the default behavior

The IPsec transform set / proposal parameters (such as encryption algorithm, hash algorithm, or Perfect Forward Secrecy group) configured for Phase 2

The peers' desktop wallpaper settings

The peers' physical cable colors

The peers' keyboard layout settings

9 / 10

Which scenario would require NAT-Traversal (NAT-T) to be enabled for a site-to-site IPsec VPN to function correctly?

The VPN uses only IKEv1 Main Mode with no IPsec traffic at all

One or both VPN peers are located behind a device performing Network Address Translation between the peer and the public internet

Both peers are on the exact same local subnet with no WAN path at all

Both peers have public, non-NATed IP addresses with no NAT device anywhere in the path, a distinction that becomes more noticeable as the topology continues to scale

The VPN tunnel is used exclusively for internal DNS queries

The VPN is configured with manual keying and no automated negotiation

10 / 10

Which design consideration would be most important when planning a site-to-site VPN between two organizations that need strong forward secrecy, ensuring that a future compromise of long-term keys cannot decrypt previously captured traffic?

Disabling all rekeying so the same session key is used indefinitely

Enabling Perfect Forward Secrecy (PFS) with a fresh Diffie-Hellman exchange for each Phase 2 rekey, so session keys are not derived solely from long-term keys

Disabling Phase 1 authentication entirely to simplify configuration

Using the weakest available encryption algorithm to reduce CPU load

Using manual keying with a single static key shared out-of-band forever

Avoiding Diffie-Hellman entirely and relying solely on pre-shared keys with no key exchange, but only once validated against a representative, non-peak traffic pattern

Your score is

The average score is 0%