nerdexam
Cisco

350-701 · Question #634

What describes the function of the crypto isakmp key C1$c451090787 address 0.0.0.0 0.0.0.0 command when configuring an IPsec VPN tunnel on a Cisco IOS router?

The correct answer is A. It allows connections from any hosts using the defined preshared key. The crypto isakmp key ... address 0.0.0.0 0.0.0.0 command configures a global pre-shared key for IPsec IKEv1, allowing any peer to use this key for authentication.

Submitted by fatima_kr· Mar 30, 2026

Question

What describes the function of the crypto isakmp key C1$c451090787 address 0.0.0.0 0.0.0.0 command when configuring an IPsec VPN tunnel on a Cisco IOS router?

Options

  • AIt allows connections from any hosts using the defined preshared key.
  • BIt defines that all data is going to be encrypted via the VPN.
  • CIt configures the IP address and subnet mask of the VPN server.
  • DIt drops spoofed VPN traffic using 0.0.0.0 as the source or destination IP address.

How the community answered

(28 responses)
  • A
    89% (25)
  • B
    7% (2)
  • C
    4% (1)

Why each option

The `crypto isakmp key ... address 0.0.0.0 0.0.0.0` command configures a global pre-shared key for IPsec IKEv1, allowing any peer to use this key for authentication.

AIt allows connections from any hosts using the defined preshared key.Correct

The `address 0.0.0.0 0.0.0.0` portion of the `crypto isakmp key` command specifies that the pre-shared key `C1$c451090787` should be used for any remote IPsec peer attempting to establish an IKEv1 Phase 1 negotiation, essentially acting as a default key for all unspecified peers. This allows connections from any host that knows this specific pre-shared key, simplifying configuration for environments with dynamic or unknown peer IP addresses.

BIt defines that all data is going to be encrypted via the VPN.

This command only configures the authentication key for the IKE negotiation; it does not define which data traffic is encrypted. Data encryption is defined by crypto maps and access lists.

CIt configures the IP address and subnet mask of the VPN server.

The command configures a pre-shared key for IKE authentication, not the IP address or subnet mask of a VPN server.

DIt drops spoofed VPN traffic using 0.0.0.0 as the source or destination IP address.

This command is for IKE authentication key configuration, not for dropping spoofed VPN traffic; 0.0.0.0 0.0.0.0 specifies "any" peer, not a dropping condition.

Concept tested: IPsec IKEv1 global pre-shared key configuration

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ikevpn/configuration/xe-3s/sec-ike-vpn-xe-3s-book/sec-ike-preshared-keys.html

Topics

#IPsec VPN#IKEv1#Preshared Key#Cisco IOS CLI

Community Discussion

No community discussion yet for this question.

Full 350-701 Practice