Refer to the exhibit. An engineer must configure VPN load balancing across two Cisco ASA. The indicated configuration was applied to each firewall; however, the load-balancing encryption scheme…

Question

Exhibits

Options

• Acluster port 9024
• Bcrypto ikev1 policy 1
• Chash sha-256
• Dencryption aes 256
• Ecluster encryption

• A
  5% (2)
• B
  63% (24)
• C
  11% (4)
• D
  21% (8)

Explanation

Enabling VPN load-balancing encryption on Cisco ASA requires two things working together: cluster encryption (option E) activates encrypted communication between the ASA cluster peers, and crypto ikev1 policy 1 (option B) provides the IKEv1 framework that the cluster encryption feature relies on to negotiate and establish that encrypted channel. Without both, the ASA has no IKE policy to reference when cluster encryption tries to initialize, so the feature silently fails.

Why the distractors are wrong:

• A (cluster port 9024): The cluster port controls which UDP port cluster peers communicate on - it has nothing to do with whether that communication is encrypted.
• C (hash sha-256): This is an attribute within an IKEv1 policy, not a standalone fix; the policy itself (option B) must exist first, and the default hash is sufficient for the feature to function.
• D (encryption aes 256): Same reasoning as C - it's a nested attribute inside an IKEv1 policy, not a missing top-level command causing the failure.

Memory tip: Think of it as a two-key ignition - cluster encryption is the intent (turn the key), and crypto ikev1 policy is the engine (what actually runs). You must declare both; one without the other leaves you with no power.

No community discussion yet for this question.