CCSP SECUR FAQ : Building a VPN Using IPSec

CCSP SECUR FAQ : Building a VPN Using IPSec

Q1. What is the purpose of the intranet VPN?
A. For dialup users to access the intranet
B. For business partners to trade data
C. To securely interconnect business locations
D. To allow access to the intranet server
E. None of the above

Answer: C

Q2. What should you be most aware of when using the debug crypto isakmp command?
A. The command generates traffic that could bring the VPN down.
B. The command generates a tremendous amount of output.
C. The command should only be used in high-traffic environments.
D. The command resets your IKE SAs.
E. This is not a valid command.

Answer: B

Q3. What are two methods of peer authentication used with IKE? (Choose two.)
A. RSA digitized signatures
B. RSA-encrypted nonces
D. Diffie-Hellman signatures
E. Preshared keys

Answer: B, C

Q4. What command tells you the state of your connection to your IKE SA peer?
A. show crypto sa
B. show sa peer ipsec
C. show ipsec peer sa
D. show crypto isakmp sa
E. show crypto ipsec sa

Answer: D

Q5. Diffie-Hellman Key Exchange is a public key cryptography protocol. Group 1 consists of -bit encryption.
A. 168
B. 1024
C. 768
D. 128
E. 1536

Answer: C

Q6. What UDP port cannot be blocked on the perimeter router for IKE to function?
A. 443
B. 500
C. 505
D. 1521
E. None of the above

Answer: B

Q7. What steps are required to configure IKE on the router?
A. Enable IKE, configure preshared key, create the IKE policy, and verify the IKE configuration.

B. Verify connectivity, enable IKE, create the ACLs, and verify the IKE configuration.

C. Verify the IKE configuration, enable IKE, configure preshared key, and reboot the router.

D. Enter the global config mode, enter the interface config mode, enable IKE, test connectivity, and configure IKE.

Answer: A

Q8. What happens if you configure multiple transform sets on the router?
A. The peers do not connect.
B. The peers look for a match.
C. The router does not send clear-text data.
D. Authentication works but not encryption.
E. Only bidirectional traffic is possible.

Answer: B

Q9. What is the correct command syntax for configuring the IPSec SA lifetime?
A. crypto ipsec sa lifetime
B. ipsec sa time
C. crypto sa timeout
D. crypto ipsec security-association lifetime
E. None of the above

Answer: D

Q10. What information does the show crypto key pubkey-chain rsa give you?
A. It tells you whether the information was manually configured or extracted from a certificate.

B. It gives you the host name of the peer.

C. It provides the IP address of the peer.

D. All of the above.

E. None of the above.

Answer: D

Q11. What is the preferred key distribution method for configuring VPN peers?

Answer: ISAKMP is the preferred method.

Q12. What is DES?

Answer: Data Encryption Standard is a 56-bit symmetric encryption algorithm.

Q13. Of the two hash algorithms, which is more secure?

Answer: SHA-1 is more secure than MD5.

Q14. What are the protocol numbers for ESP and AH?

Answer: ESP is 50, and AH is 51.

Q15. Why is it a good idea to verify connectivity before attempting to configure a VPN connection?

Answer: Because if you cannot establish a connection between the protected networks, you won’t be able to get a VPN established.”

Q16. What is a policy priority?

Answer: The policy priority is a number between 1 and 10,000 that is assigned when the IKE policy is created.

Q17. What is the first command you should input when creating an IKE policy?

Answer: crypto isakmp enable

Q18. What policy priority number has greater precedence?

Answer: The lower number.

Q19. What is the default timeout for the global IPSec SA lifetime?

Answer: 1 hour.

Q20. True or False: Crypto access lists are bidirectional?

Answer: False.

Q21. What must you do to activate a crypto map?

Answer: Apply the crypto map to the correct interface.

Q22. What does Cisco recommend about manual IPSec?

Answer: It should not be used because it is static and could be relatively insecure.

Q23. How could you find out the router host name and domain name of your peer?

Answer: By using the show crypto key pubkey-chain rsa command.

Q24. What is the command for generating RSA key pairs?

Answer: crypto key generate rsa

More Resources

About the author


Leave a Comment