View all questions & answers for the NSE 6 - Network Security 7.6 Support Engineer Materials exam

NSE 6 - Network Security 7.6 Support Engineer Materials - Question #20 Discussion

Comment Image Comment Image Comment Image

What can cause an IKEv2 tunnel to go down after it was initially brought up successfully? (Choose one answer)

  • A. A mismatched proposal was detected during the IKE_AUTH exchange.
  • B. A mismatched Diffie-Hellman group was detected during the IKE_SA_INIT exchange.
  • C. A mismatched pre-shared key was detected during the IKE_AUTH exchange.
  • D. Mismatched quick-mode selectors were detected during the Create_Child_SA exchange.
Correct Answer: D

Brave-Dump Community Votes

Answer: D (4 votes) 80%
Answer: B (1 vote) 20%

Community Explanations & Comments (5)

Brave-Dumps.com Admin 1 year ago
Selected: B
Verified by Network Security Support Engineer Study Guide page 511
Fatma Salih 9 months ago
Selected: D
I think the answer is D. If there was a DH mismatch, the tunnel wouldn't come up in the 1st place.
Adam 9 months ago
Selected: D
IKEv2 exchanges:
1- IKE_SA_INIT exchange -> equivalent of IKEv1 phase1
2- IKE_Auth exchange -> authentication + first Child SA (equivalent of IKEv1 phase2 without DH Group)
3- Create_Child_SA exchange -> creates a new child SA or rekeys an existing child SA (with DH Group)
4- Informational exchange

As option B mentions DH Group mismatch in IKE_SA_INIT (phase1), then phase 1 won't be up initially to begin with, so option B should be wrong.
James 9 months ago
Selected: D
If the tunnel was initially brought up successfully, both of these phases must have succeeded.
Anonymous User 6 months ago
Selected: D
A, B, and C: All of these (mismatched proposals, DH groups, or Pre-Shared Keys) are checked during the initial handshake (IKE_SA_INIT or IKE_AUTH). If any of these were misconfigured, the tunnel would fail immediately at the start and would never be "initially brought up successfully."