Cisco 300-540 Exam - Topic 1 Question 5 Discussion

Actual exam question for Cisco's 300-540 exam

Question #: 5
Topic #: 1

Refer to the exhibit.

Refer to the exhibit. An engineer must configure an IPsec VPN connection between site 1 and site 2. The indicated configuration was applied to router R1; however, the tunnel fails to come up. Which command must be run on R1 to resolve the issue?

A. ip route 0.0.0.0 0.0.0.0 10.1.1.2 B. crypto isakmp key vpnuser address 192.168.20.2 C. ip route 0.0.0.0 0.0.0.0 192.168.20.2 D. crypto isakmp key vpnuser address 10.1.1.2

Show Suggested Answer

Suggested Answer:

For a site-to-site IPsec VPN, each peer must configure a pre-shared key tied to the public IP address of the remote VPN peer:

crypto isakmp key <KEY> address <REMOTE_PUBLIC_IP>

From the diagram:

R1 outside IP: 192.168.10.1/24

R2 outside IP: 192.168.20.2/24 remote peer for R1

In the current R1 configuration, the ISAKMP key is incorrectly bound to 192.168.10.2, which is a local next-hop/ISP address on R1's own subnet, not the R2 public IP. Because the pre-shared-key address does not match the source IP of R2's IKE packets, phase 1 negotiation fails and the tunnel never comes up.

The correct configuration on R1 must therefore be:

crypto isakmp key vpnuser address 192.168.20.2

Options A and C incorrectly change the default route (next hop must be the local ISP router, not R2's public IP or a LAN address). Option D uses an internal address (10.1.1.2), which is not the IP used for IKE on the Internet.

by Glory at Dec 20, 2025, 12:20 AM

Limited Time Offer

25%

Off

Get Premium 300-540 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lavonna

4 months ago

I agree with D. The address should point to the remote site.

upvoted 0 times

...

Genevieve

4 months ago

I’m not sure, but B makes sense for authentication.

upvoted 0 times

...

Raina

4 months ago

I disagree, A might be needed for default routing.

upvoted 0 times

...

Clay

5 months ago

I'm leaning towards C. The route seems crucial for the tunnel.

upvoted 0 times

...

Cassi

5 months ago

I feel like option D is the right choice. The address should be the local router.

upvoted 0 times

...

Ming

5 months ago

I think it's option B. The key needs to match the peer.

upvoted 0 times

...

Monte

5 months ago

Surprised this is even a question, it's pretty straightforward!

upvoted 0 times

...

Doyle

5 months ago

Wait, why would you use 10.1.1.2? That seems off.

upvoted 0 times

...

Paz

5 months ago

Definitely B, no doubt about it!

upvoted 0 times

...

Roslyn

6 months ago

The exhibit looks like a hot mess. I'd rather just use a cloud-based VPN service and let someone else deal with all this complexity.

upvoted 0 times

...

Leslie

6 months ago

I'm surprised they didn't try turning it off and back on again. That's the first step in any troubleshooting process, right?

upvoted 0 times

...

Zena

7 months ago

Option D is just asking for trouble. Putting the ISAKMP key in the address is a security nightmare waiting to happen.

upvoted 0 times

...

Joanna

7 months ago

Haha, I bet the engineer who set this up was just winging it. Looks like they need to brush up on their IPsec VPN configuration skills.

upvoted 0 times

...

Lacresha

7 months ago

I feel like I might have seen a question like this before, and I remember that the routing command could be crucial for the tunnel to establish.

upvoted 0 times

...

Maddie

7 months ago

I think option B makes sense because it specifies the correct address for the key, but I'm a bit hesitant about the other options.

upvoted 0 times

...

Lazaro

7 months ago

This question feels similar to one we practiced where we had to set up a VPN. I think it might be related to the ISAKMP key.

upvoted 0 times

...

Tatum

7 months ago

I remember studying IPsec configurations, but I'm not entirely sure which command is needed here.

upvoted 0 times

...

Herman

8 months ago

Alright, I'm feeling pretty confident about this one. I'll go with option C to fix the routing issue, and then verify the ISAKMP key just to be sure.

upvoted 0 times

...

Carmela

8 months ago

Wait, I'm a bit confused. The routing seems off too. Maybe I should double-check the routes before deciding on the ISAKMP key.

upvoted 0 times

...

Elli

8 months ago

Ah, I think I see the problem. The ISAKMP key is configured for the wrong address. I'd go with option B to resolve this.

upvoted 0 times

...

Samira

8 months ago

Okay, let's see. The tunnel isn't coming up, so I'm guessing it's an issue with the ISAKMP key or the routing. I'll start by checking the ISAKMP key first.

upvoted 0 times

...

Herminia

8 months ago

Hmm, this looks tricky. I'll need to carefully review the configuration details and the options to figure out what's missing.

upvoted 0 times

...

Tamar

8 months ago

The correct answer is C. ip route 0.0.0.0 0.0.0.0 192.168.20.2. The tunnel is failing to come up due to a routing issue, and this command will resolve it.

upvoted 0 times