300-730 · Question #63
Which two cryptographic technologies are recommended for use with FlexVPN? (Choose two.)
The correct answer is A. SHA (HMAC variant). SHA (HMAC variant) and Diffie-Hellman are the two recommended cryptographic technologies for FlexVPN; DES and MD5 are deprecated and considered cryptographically weak.
Question
Options
- ASHA (HMAC variant)
- BDiffie-Hellman
- CDES
- DMD5 (HMAC variant)
How the community answered
(37 responses)- A95% (35)
- B3% (1)
- D3% (1)
Why each option
SHA (HMAC variant) and Diffie-Hellman are the two recommended cryptographic technologies for FlexVPN; DES and MD5 are deprecated and considered cryptographically weak.
SHA HMAC variants (SHA-256, SHA-384, SHA-512) provide strong integrity verification and authentication for IKEv2 and IPsec, which form the foundation of FlexVPN. They are explicitly recommended by Cisco and NIST as replacements for weaker hashing algorithms in modern VPN deployments.
DES uses a 56-bit key that has been cryptographically broken and is officially deprecated; it is not permitted in modern IKEv2/IPsec configurations including FlexVPN.
MD5 HMAC is considered cryptographically weak due to known collision vulnerabilities and has been superseded by SHA-based algorithms in all current Cisco and IETF recommendations for IKEv2.
Concept tested: Recommended cryptographic algorithms for FlexVPN IKEv2
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/xe-16/sec-flex-vpn-xe-16-book/sec-cfg-flex-vpn.html
Topics
Community Discussion
No community discussion yet for this question.