Skip to content
AvailabilitySign inBook a DemoJoin Waitlist
All CCNA topics

4.0 Network Services and Security

IPsec VPNs Practice Questions

Updated for CCNA v2.0

Remote access and site-to-site VPNs, ESP and AH, tunnel and transport modes, and IKE.

CCNA v2.0 objective 4.5 · objective map

Author-reviewed by LabFabric · 25 September 2026 · Report a content issue

One solved question, so you can see how these are marked

Two branch routers use IPsec so that all traffic between the branch LANs is protected, without any software on the users' computers. Which VPN type is this?

Site-to-site VPN

A site-to-site VPN connects networks through gateways and is transparent to the hosts behind them. A remote access VPN connects an individual user's device, typically with client software.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

Find related practice in the CCNA path
All 8 IPsec VPNs questions in this set

Answers and explanations appear when you work through the set above.

  1. A traveling employee connects a laptop to the corporate network using Cisco Secure Client. Which VPN type is this?

    • Remote access VPN
    • Site-to-site VPN
    • MPLS VPN
    • Point-to-point leased line

  2. Which IPsec protocol provides confidentiality (encryption) as well as authentication and integrity?

    • ESP
    • AH
    • GRE
    • ICMP

  3. Which IPsec mode encapsulates the entire original IP packet inside a new IP packet, and is the usual mode between two VPN gateways?

    • Tunnel mode
    • Transport mode
    • Promiscuous mode
    • Passive mode

  4. Which statement describes ESP transport mode?

    • The original IP header is kept and only the payload is encrypted, usually for traffic between two hosts
    • A completely new IP header is added around the whole original packet
    • The packet is protected only at Layer 2
    • It is used only between routers with no hosts involved

  5. Which protocol and port are used by IKE to negotiate IPsec security associations?

    • UDP 500
    • TCP 22
    • UDP 123
    • TCP 80

  6. Which security service does the Authentication Header (AH) NOT provide?

    • Confidentiality
    • Data integrity
    • Origin authentication
    • Anti-replay protection

  7. Why is a plain GRE tunnel not considered a secure VPN on its own?

    • GRE encapsulates traffic but provides no encryption or authentication
    • GRE cannot carry IP packets
    • GRE only works within a single VLAN
    • GRE requires a hardware token

  8. In IKE negotiation, what is a security association (SA)?

    • An agreed set of keys and parameters that define how traffic between two peers is protected
    • A user account on the VPN concentrator
    • A VLAN reserved for VPN traffic
    • A firewall rule that allows all IPsec traffic