156-215.71 · Question #561
When using vpn tu, which option must you choose if you only want to clear phase 2 for a specific IP (gateway)?
The correct answer is D. (5) Delete all IPsec SAs for a given peer (GW). See the full explanation below for the reasoning.
Question
When using vpn tu, which option must you choose if you only want to clear phase 2 for a specific IP (gateway)?
Options
- A(6) Delete all IPsec SAs for a given User (Client)
- B(7) Delete all IPsec+IKE SAs for a given peer (GW)
- C(8) Delete all IPsec+IKE SAs for a given User (Client)
- D(5) Delete all IPsec SAs for a given peer (GW)
How the community answered
(24 responses)- A4% (1)
- B4% (1)
- C17% (4)
- D75% (18)
Community Discussion
4
Samuel O.Nov 25, 2025Option D is your answer here. Option 5 in vpn tu targets only the IPsec SAs (phase 2) for a specific peer gateway, leaving the IKE SA (phase 1) intact, which is exactly what you want when you need to clear phase 2 without tearing down the full tunnel.
Mei-Ling H.Nov 13, 2025The word "only" in the question is doing a lot of work here, because option B also targets a peer/GW but adds IKE to the deletion, which would wipe phase 1 too, so the one that strips just IPsec SAs for the gateway is the safe pick. Can someone confirm whether clearing phase 1 (IKE) automatically forces a full re-negotiation of phase 2 as well, or can phase 2 sometimes survive a phase 1 teardown in certain configurations?
Brenda K.Nov 30, 2025Option A has to be it because the question says "specific IP" and a gateway is just another peer endpoint you are targeting by address, and deleting IPsec SAs only takes out phase 2 without touching IKE, so you stay surgical and avoid rebuilding the whole tunnel from scratch. On exam day do not overthink the wording, pick A and move on, this one costs you maybe 20 seconds max.
Samuel O.Dec 1, 2025Brenda, I appreciate the breakdown but the surgical argument actually cuts against A here, because if you leave the IKE phase 1 SA in place with a stale or mismatched state, phase 2 may just fail to renegotiate cleanly anyway, which is exactly why D targets the full SA pair for that peer and is what the exam is looking for.