CAS-005 · Question #518
A security engineer is troubleshooting an outage of a site-to-site VPN between New York City and Atlanta. The tunnel is configured with a pre-shared key on two VPN concentrators. The Atlanta site…
The correct answer is D. Configure the New York City site as the initiator. The output shows that the Atlanta VPN is set as the initiator but is inactive, while the New York City VPN is active but not initiating the Security Association (SA). Since Atlanta is supposed to always listen, the New York City site must be configured as the initiator to…
Question
A security engineer is troubleshooting an outage of a site-to-site VPN between New York City and Atlanta. The tunnel is configured with a pre-shared key on two VPN concentrators. The Atlanta site should be configured to always listen for connections from the New York City site. The security engineer issues the following command on both devices:
show crypto ike2 sa detailed The devices return the following output:
Which of the following actions should the security engineer take to resolve the issue?
Options
- AModify cipher suites to use AES256-GCM.
- BContact the Atlanta site's staff to restart the VPN concentrator.
- CAdd a third VPN concentrator.
- DConfigure the New York City site as the initiator.
How the community answered
(18 responses)- A6% (1)
- B11% (2)
- C6% (1)
- D78% (14)
Explanation
The output shows that the Atlanta VPN is set as the initiator but is inactive, while the New York City VPN is active but not initiating the Security Association (SA). Since Atlanta is supposed to always listen, the New York City site must be configured as the initiator to establish the tunnel
Community Discussion
No community discussion yet for this question.