Refer to the exhibit. An engineer must configure a remote access IPsec/IKEv2 VPN that will use SHA- 512 on a Cisco ASA firewall. The indicated configuration was applied to the firewall; however, the…

Question

Options

• Aintegrity sha512
• Bprotocol esp encryption sha512
• Cipsec-proposal sha512
• Dencryption sha512

• A
  10% (4)
• B
  5% (2)
• C
  83% (34)
• D
  2% (1)

Explanation

On a Cisco ASA, IKEv2 VPN configuration requires two separate components: a Phase 1 IKEv2 policy and a Phase 2 IPsec proposal. Option C (ipsec-proposal sha512) is correct because the exhibit's configuration is missing the crypto ipsec ikev2 ipsec-proposal definition - without it, Phase 2 negotiation cannot complete, causing the tunnel to fail even if Phase 1 succeeds.

Why the distractors are wrong:

• A (integrity sha512) belongs inside a crypto ikev2 policy block and configures Phase 1 integrity - it does not address the Phase 2 IPsec proposal that is missing.
• B (protocol esp encryption sha512) is semantically wrong: SHA-512 is a hashing/integrity algorithm, not an encryption algorithm. ESP encryption uses algorithms like AES.
• D (encryption sha512) makes the same mistake as B - SHA-512 cannot be used as an encryption algorithm regardless of context.

Memory tip: Think in two phases - "Policy = Phase 1 (IKE)" and "Proposal = Phase 2 (IPsec)." When a question asks about applying a hash like SHA-512 and the tunnel fails, ask yourself: is this a Phase 1 or Phase 2 problem? A missing ipsec-proposal always breaks Phase 2, leaving the tunnel stuck.

No community discussion yet for this question.