Objective 5.5
200-301Describe IPsec remote access and site-to-site VPNs.
Objective 5.5 sits in Security Fundamentals, which carries 15% of the CCNA exam. The questions below are original, written from the official objective title above, and each explanation cites the Cisco page it rests on.
Objective title verbatim from the official objectives. Cisco exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A LAN to LAN IPsec tunnel between two ASAs is up, and you are tracing which ISAKMP exchange carries which protection. What does each phase build?
Correct.
Checked against cisco.com, August 2026Concept
IPsec comes up in two stages so that the bargaining itself is not exposed. The first stage builds a protected channel for the exchange, and only inside that cover does the pair settle the keys that will carry production traffic.
Why D
The first tunnel exists to shield the ISAKMP messages that follow it. The second exchange negotiates the IPsec security association under that shield, and it is the association user traffic actually rides.
Source
Cisco ASA Series VPN CLI Configuration Guide 9.17: LAN-to-LAN IPsec VPNs, checked August 2026ISAKMP separates negotiation into two phases: Phase 1 and Phase 2. Phase 1 creates the first tunnel, which protects later ISAKMP negotiation messages. Phase 2 creates the tunnel that protects data.
Now you: objective 5.5 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
Remote clients finish IKE phase 1 with the ASA, but no IPsec security association forms and no data passes. Which condition produces that result?
Sample question 2 of 3
A company links two offices with an IPsec tunnel using ESP and must record what the tunnel protects. Which two services does ESP provide? (Choose two.)
Sample question 3 of 3
A site-to-site tunnel must protect IP traffic between two offices. Which architecture document defines the elements of such a system?
That’s 3 of the full CCNA bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
More objectives in Security Fundamentals
- 5.1 Define key security concepts (threats, vulnerabilities, exploits, and mitigation techniques).
- 5.2 Describe security program elements (user awareness, training, and physical access control).
- 5.4 Describe security password policy elements, such as management, complexity, and password alternatives (multifactor authentication, certificates, and biometrics).
- 5.6 Configure and verify access control lists.
- 5.7 Configure and verify Layer 2 security features (DHCP snooping, dynamic ARP inspection, and port security).
- 5.8 Compare authentication, authorization, and accounting concepts.
- 5.9 Describe wireless security protocols (WPA, WPA2, and WPA3).
- 5.10 Configure and verify WLAN within the GUI using WPA2 PSK.