What are two purposes of the key server in Cisco IOS GETVPN? (Choose two.)

Downloading encryption keys is the role of the group member, which registers with the key server to receive the TEK and KEK - the key server distributes rather than downloads keys.

The key server stores and manages the Group Security Association (GSA) including encryption transforms, rekey timers, and security policies that all group members must enforce, providing a single authoritative policy source for the GETVPN domain. It distributes the Traffic Encryption Key (TEK) and Key Encryption Key (KEK) so that group members can encrypt and decrypt traffic using a shared, centrally controlled policy.

GETVPN does not manage or distribute routing information; routing is handled independently by the underlying WAN infrastructure and is outside the scope of the key server.

The key server does not participate in data-plane encryption; group members perform all data traffic encryption themselves using the keys and policies received from the key server.

While group member authentication occurs during the GETVPN registration process, it functions as a prerequisite mechanism supporting policy and key distribution rather than a standalone independent purpose of the key server.