Refer to the exhibit. An engineer must configure a remote access IPsec/IKEv1 VPN that will use AES256 and SHA256 on a Cisco ASA firewall. The indicated configuration was applied to the firewall…

Question

Options

• Aencryption aes-256
• Bipsec-proposal sha-256-aes-256
• Cintegrity aes-256
• Dipsec-proposal AES256-SHA256
• Ehash sha-256

• A
  76% (32)
• B
  14% (6)
• C
  5% (2)
• D
  5% (2)

Explanation

Within a Cisco ASA crypto ikev1 policy block, the correct commands for specifying encryption and hashing algorithms are encryption aes-256 (option A) and hash sha-256 (option E) - these two together satisfy the AES-256 and SHA-256 requirements for Phase 1 negotiation.

Why the distractors are wrong:

• B & D (ipsec-proposal ...) are not valid IKEv1 policy subcommands; ipsec-proposal is used in IKEv2 proposal configuration (crypto ikev2 proposal), not IKEv1.
• C (integrity aes-256) is doubly wrong: integrity is an IKEv2 keyword (not IKEv1), and AES-256 is an encryption algorithm - it cannot serve as an integrity/hash algorithm.

Memory tip: Think IKEv1 = "Hash", IKEv2 = "Integrity". If the question says IKEv1, your Phase 1 policy uses encryption + hash. If it says IKEv2, you use encryption + integrity. Mixing these keywords between versions is exactly the trap this question sets.

No community discussion yet for this question.