Which of the following descriptions about IPsec IKEv1 is correct?

Question

Options

• AThe purpose of phase one of IKE negotiation is to transmit IPsec SA data
• BThe purpose of phase two of IKE negotiation is to establish a secure tunnel has been established
• CTwo IKE SAs need to be established between two IPsec peers to transmit control packets and data packets respectively
• DAfter IKE phase one is established, all ISAKMP messages between peers will pass encryption and verification

• A
  9% (3)
• B
  15% (5)
• C
  3% (1)
• D
  73% (24)

Explanation

D is correct because IKEv1 Phase 1 exists specifically to build a secure, authenticated channel (the ISAKMP SA) between peers - once that SA is in place, all subsequent ISAKMP messages, including the Phase 2 negotiation, are both encrypted and integrity-verified using the keying material derived in Phase 1.

Why the distractors are wrong:

• A is backwards: Phase 1 establishes the ISAKMP/IKE SA (control-plane security), not IPsec SA data - that happens in Phase 2.
• B is backwards: Phase 2 negotiates the IPsec SAs used to protect actual data traffic; the "secure tunnel" (ISAKMP SA) is what Phase 1 creates.
• C confuses SA types: only one bidirectional IKE SA is established in Phase 1; Phase 2 produces IPsec SAs (not a second IKE SA) for data traffic.

Memory tip: Think of IKEv1 as a two-room building process - Phase 1 builds the locked room (ISAKMP SA encrypts all control messages from that point on), and Phase 2 negotiates inside that locked room (IPsec SAs for data). If Phase 1 didn't encrypt what came after it, the whole purpose of the two-phase design would be defeated.

No community discussion yet for this question.