An administrator is establishing a new site-to-site VPN connection on a Cisco IOS router. The organization needs to ensure that the ISAKMP key on the hub is used only for terminating traffic from the

Question

Options

• Acrypto ca identity 172.19.20.24
• Bcrypto isakmp key Cisco0l23456789 172.19.20.24
• Ccrypto enrollment peer address 172.19.20.24
• Dcrypto isakmp identity address 172.19.20.24

• A
  2% (1)
• B
  80% (39)
• C
  4% (2)
• D
  14% (7)

Explanation

Option B uses the correct Cisco IOS syntax crypto isakmp key <keystring> address <peer-ip>, which binds a pre-shared key to a specific peer IP address - exactly what's needed to restrict ISAKMP key use to traffic originating from 172.19.20.24.

Why the distractors fail:

• A (crypto ca identity) doesn't exist as written; crypto ca commands deal with Certificate Authority enrollment, not pre-shared keys.
• C (crypto enrollment peer address) is also fabricated syntax - enrollment commands relate to PKI certificate workflows, not ISAKMP keys.
• D (crypto isakmp identity address) is a real command, but it sets how the router identifies itself to peers (by IP vs. hostname) - it does not bind a key to a specific remote peer address.

Memory tip: Read B as "give this key to this address" - the command order mirrors plain English: crypto isakmp key [THE_KEY] [THE_PEER_ADDRESS]. If the command doesn't contain the actual key string followed by the peer IP, it's not doing what this question asks.

No community discussion yet for this question.