1D0-571 · Question #37
At the beginning of an IPsec session, which activity occurs during the Internet Key Exchange (IKE)?
The correct answer is B. Negotiating the authentication method. See the full explanation below for the reasoning.
Question
At the beginning of an IPsec session, which activity occurs during the Internet Key Exchange (IKE)?
Options
- ADetermining the number of security associations
- BNegotiating the authentication method
- CDetermining the network identification number
- DNegotiating the version of IP to be used
How the community answered
(20 responses)- A5% (1)
- B75% (15)
- C15% (3)
- D5% (1)
Community Discussion
7
Bao N.Jun 18, 2026B is your answer. IKE exists specifically to negotiate how both sides will authenticate each other and agree on encryption parameters before any protected traffic flows, so "negotiating the authentication method" is exactly what IKE Phase 1 is doing when a session kicks off.
Mateus R.Jun 20, 2026Phase 1 nails down the secure channel itself (the ISAKMP SA), but the actual authentication method, whether pre-shared key or certificates, is something both peers have to agree on before they can even trust each other enough to build that channel, so calling it "negotiating the authentication method" is right but undersells the full handshake happening there.
Mateus R.Jun 27, 2026So IKE is basically two strangers agreeing on a secret handshake before sharing anything, right, but which part of agreeing on that handshake does it handle first?
Brenda K.Jun 27, 2026C is a lock, because IKE has to nail down the network identification before anything else can happen, otherwise neither peer knows who they are actually talking to, and the whole session setup falls apart before it even starts. Clock this one as a fast pick and move on, it is not a flag-and-revisit question at all.
Mateus R.Jun 27, 2026Brenda, the network identification piece you are describing is actually handled in Phase 1, not as a separate first step within IKE, so C is not the right fit here. B is correct because IKEv2 begins by negotiating the security association parameters (encryption, integrity, PRF, and DH group) in the initial exchange, which is the foundation everything else builds on, the way you have to agree on a shared language before you can have any real conversation.
Viktor S.Jun 27, 2026Look, I keep coming back to D on this one because IKE literally has to sort out the underlying transport layer before anything else can happen, and that means figuring out whether you are running IPv4 or IPv6, since the encapsulation and addressing behavior differs enough that you cannot just assume. The whole handshake falls apart if both peers are not speaking the same IP version from the jump, so it makes sense that version negotiation is the first order of business. B sounds tempting but authentication feels like a later phase concern, something you do once the channel parameters are already agreed upon. I will be genuinely surprised if D is wrong here because the logic holds up end to end for me.
Bao N.Jun 27, 2026Viktor, IKE does not actually negotiate IP version, that is handled at the network layer before IKE even starts, so D is out. Authentication is exactly what Phase 1 is built around, which is why B holds up as the answer.