Exam Bundle

IKE establishes successfully and logs show compatible negotiated parameters. This would be relevant evidence for a different failure: An FTD site-to-site VPN shows no active IKE security association despite route reachability, usually addressed by Inspect IKE proposals, peer identity, authentication, and exchange logs before changing data-plane policy. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: The VPN remains established through NAT with reliable bidirectional protected flows.

Corrected child SAs form and packet encryption and decryption counters increment. This would be relevant evidence for a different failure: IKE succeeds but there are no IPsec child SAs when users send protected traffic, usually addressed by Compare IPsec proposals, traffic selectors, PFS settings, and the actual interesting traffic. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: The VPN remains established through NAT with reliable bidirectional protected flows.

Protected traffic uses the intended encrypted path rather than an ordinary Internet route. This would be relevant evidence for a different failure: Tunnel SAs exist but packets reach a wrong next hop instead of the VPN egress interface, usually addressed by Correct routing and policy-based forwarding toward the appropriate protected tunnel. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: The VPN remains established through NAT with reliable bidirectional protected flows.

Check secure peer key agreement and effective authentication profile on both sides. That action fits another problem: Site-to-site VPN negotiation repeatedly fails just after a PSK rotation. It does not directly remediate the current finding at Frostline Distribution: A tunnel drops traffic only when behind a NAT device that changes the peer's translated address. The relevant corrective control for this case is: Verify NAT traversal configuration and peer reachability for UDP-encapsulated IPsec.

Assess path MTU and MSS handling for the VPN without disabling encryption. That action fits another problem: A tunnel passes small pings but application sessions fail after encapsulation overhead. It does not directly remediate the current finding at Frostline Distribution: A tunnel drops traffic only when behind a NAT device that changes the peer's translated address. The relevant corrective control for this case is: Verify NAT traversal configuration and peer reachability for UDP-encapsulated IPsec.

Correct routing and policy-based forwarding toward the appropriate protected tunnel. That action fits another problem: Tunnel SAs exist but packets reach a wrong next hop instead of the VPN egress interface. It does not directly remediate the current finding at Frostline Distribution: A tunnel drops traffic only when behind a NAT device that changes the peer's translated address. The relevant corrective control for this case is: Verify NAT traversal configuration and peer reachability for UDP-encapsulated IPsec.

Protected traffic uses the intended encrypted path rather than an ordinary Internet route. This would be relevant evidence for a different failure: Tunnel SAs exist but packets reach a wrong next hop instead of the VPN egress interface, usually addressed by Correct routing and policy-based forwarding toward the appropriate protected tunnel. It does not demonstrate that the current problem at Frostline Distribution was resolved. The specific required evidence is: The VPN remains established through NAT with reliable bidirectional protected flows.

Negotiation succeeds with the current credential while the old PSK remains invalid. This would be relevant evidence for a different failure: Site-to-site VPN negotiation repeatedly fails just after a PSK rotation, usually addressed by Check secure peer key agreement and effective authentication profile on both sides. It does not demonstrate that the current problem at Frostline Distribution was resolved. The specific required evidence is: The VPN remains established through NAT with reliable bidirectional protected flows.

An application transaction succeeds across typical payload sizes after tuning. This would be relevant evidence for a different failure: A tunnel passes small pings but application sessions fail after encapsulation overhead, usually addressed by Assess path MTU and MSS handling for the VPN without disabling encryption. It does not demonstrate that the current problem at Frostline Distribution was resolved. The specific required evidence is: The VPN remains established through NAT with reliable bidirectional protected flows.

Compare IPsec proposals, traffic selectors, PFS settings, and the actual interesting traffic. That action fits another problem: IKE succeeds but there are no IPsec child SAs when users send protected traffic. It does not directly remediate the current finding at Boreal Foods: Site-to-site VPN negotiation repeatedly fails just after a PSK rotation. The relevant corrective control for this case is: Check secure peer key agreement and effective authentication profile on both sides.

Assess path MTU and MSS handling for the VPN without disabling encryption. That action fits another problem: A tunnel passes small pings but application sessions fail after encapsulation overhead. It does not directly remediate the current finding at Boreal Foods: Site-to-site VPN negotiation repeatedly fails just after a PSK rotation. The relevant corrective control for this case is: Check secure peer key agreement and effective authentication profile on both sides.

Correct routing and policy-based forwarding toward the appropriate protected tunnel. That action fits another problem: Tunnel SAs exist but packets reach a wrong next hop instead of the VPN egress interface. It does not directly remediate the current finding at Boreal Foods: Site-to-site VPN negotiation repeatedly fails just after a PSK rotation. The relevant corrective control for this case is: Check secure peer key agreement and effective authentication profile on both sides.

An application transaction succeeds across typical payload sizes after tuning. This would be relevant evidence for a different failure: A tunnel passes small pings but application sessions fail after encapsulation overhead, usually addressed by Assess path MTU and MSS handling for the VPN without disabling encryption. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: Negotiation succeeds with the current credential while the old PSK remains invalid.

Corrected child SAs form and packet encryption and decryption counters increment. This would be relevant evidence for a different failure: IKE succeeds but there are no IPsec child SAs when users send protected traffic, usually addressed by Compare IPsec proposals, traffic selectors, PFS settings, and the actual interesting traffic. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: Negotiation succeeds with the current credential while the old PSK remains invalid.

Protected traffic uses the intended encrypted path rather than an ordinary Internet route. This would be relevant evidence for a different failure: Tunnel SAs exist but packets reach a wrong next hop instead of the VPN egress interface, usually addressed by Correct routing and policy-based forwarding toward the appropriate protected tunnel. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: Negotiation succeeds with the current credential while the old PSK remains invalid.

Verify NAT traversal configuration and peer reachability for UDP-encapsulated IPsec. That action fits another problem: A tunnel drops traffic only when behind a NAT device that changes the peer's translated address. It does not directly remediate the current finding at Horizon Energy Services: Site-to-site VPN negotiation repeatedly fails just after a PSK rotation. The relevant corrective control for this case is: Check secure peer key agreement and effective authentication profile on both sides.

Assess path MTU and MSS handling for the VPN without disabling encryption. That action fits another problem: A tunnel passes small pings but application sessions fail after encapsulation overhead. It does not directly remediate the current finding at Horizon Energy Services: Site-to-site VPN negotiation repeatedly fails just after a PSK rotation. The relevant corrective control for this case is: Check secure peer key agreement and effective authentication profile on both sides.

Inspect routing, protected network selectors, access control, and NAT treatment for that subnet. That action fits another problem: An FTD tunnel has healthy SAs but one internal subnet cannot reach the remote peer. It does not directly remediate the current finding at Horizon Energy Services: Site-to-site VPN negotiation repeatedly fails just after a PSK rotation. The relevant corrective control for this case is: Check secure peer key agreement and effective authentication profile on both sides.

Traffic from each approved subnet crosses the tunnel and unrelated networks stay blocked. This would be relevant evidence for a different failure: An FTD tunnel has healthy SAs but one internal subnet cannot reach the remote peer, usually addressed by Inspect routing, protected network selectors, access control, and NAT treatment for that subnet. It does not demonstrate that the current problem at Horizon Energy Services was resolved. The specific required evidence is: Negotiation succeeds with the current credential while the old PSK remains invalid.

An application transaction succeeds across typical payload sizes after tuning. This would be relevant evidence for a different failure: A tunnel passes small pings but application sessions fail after encapsulation overhead, usually addressed by Assess path MTU and MSS handling for the VPN without disabling encryption. It does not demonstrate that the current problem at Horizon Energy Services was resolved. The specific required evidence is: Negotiation succeeds with the current credential while the old PSK remains invalid.

The VPN remains established through NAT with reliable bidirectional protected flows. This would be relevant evidence for a different failure: A tunnel drops traffic only when behind a NAT device that changes the peer's translated address, usually addressed by Verify NAT traversal configuration and peer reachability for UDP-encapsulated IPsec. It does not demonstrate that the current problem at Horizon Energy Services was resolved. The specific required evidence is: Negotiation succeeds with the current credential while the old PSK remains invalid.

Correct routing and policy-based forwarding toward the appropriate protected tunnel. That action fits another problem: Tunnel SAs exist but packets reach a wrong next hop instead of the VPN egress interface. It does not directly remediate the current finding at Oak River Energy: An FTD tunnel has healthy SAs but one internal subnet cannot reach the remote peer. The relevant corrective control for this case is: Inspect routing, protected network selectors, access control, and NAT treatment for that subnet.

Assess path MTU and MSS handling for the VPN without disabling encryption. That action fits another problem: A tunnel passes small pings but application sessions fail after encapsulation overhead. It does not directly remediate the current finding at Oak River Energy: An FTD tunnel has healthy SAs but one internal subnet cannot reach the remote peer. The relevant corrective control for this case is: Inspect routing, protected network selectors, access control, and NAT treatment for that subnet.

Verify NAT traversal configuration and peer reachability for UDP-encapsulated IPsec. That action fits another problem: A tunnel drops traffic only when behind a NAT device that changes the peer's translated address. It does not directly remediate the current finding at Oak River Energy: An FTD tunnel has healthy SAs but one internal subnet cannot reach the remote peer. The relevant corrective control for this case is: Inspect routing, protected network selectors, access control, and NAT treatment for that subnet.

An application transaction succeeds across typical payload sizes after tuning. This would be relevant evidence for a different failure: A tunnel passes small pings but application sessions fail after encapsulation overhead, usually addressed by Assess path MTU and MSS handling for the VPN without disabling encryption. It does not demonstrate that the current problem at Oak River Energy was resolved. The specific required evidence is: Traffic from each approved subnet crosses the tunnel and unrelated networks stay blocked.

The VPN remains established through NAT with reliable bidirectional protected flows. This would be relevant evidence for a different failure: A tunnel drops traffic only when behind a NAT device that changes the peer's translated address, usually addressed by Verify NAT traversal configuration and peer reachability for UDP-encapsulated IPsec. It does not demonstrate that the current problem at Oak River Energy was resolved. The specific required evidence is: Traffic from each approved subnet crosses the tunnel and unrelated networks stay blocked.

Protected traffic uses the intended encrypted path rather than an ordinary Internet route. This would be relevant evidence for a different failure: Tunnel SAs exist but packets reach a wrong next hop instead of the VPN egress interface, usually addressed by Correct routing and policy-based forwarding toward the appropriate protected tunnel. It does not demonstrate that the current problem at Oak River Energy was resolved. The specific required evidence is: Traffic from each approved subnet crosses the tunnel and unrelated networks stay blocked.

Inspect IKE proposals, peer identity, authentication, and exchange logs before changing data-plane policy. That action fits another problem: An FTD site-to-site VPN shows no active IKE security association despite route reachability. It does not directly remediate the current finding at Harbor Point Medical: An FTD tunnel has healthy SAs but one internal subnet cannot reach the remote peer. The relevant corrective control for this case is: Inspect routing, protected network selectors, access control, and NAT treatment for that subnet.

Verify NAT traversal configuration and peer reachability for UDP-encapsulated IPsec. That action fits another problem: A tunnel drops traffic only when behind a NAT device that changes the peer's translated address. It does not directly remediate the current finding at Harbor Point Medical: An FTD tunnel has healthy SAs but one internal subnet cannot reach the remote peer. The relevant corrective control for this case is: Inspect routing, protected network selectors, access control, and NAT treatment for that subnet.

Check secure peer key agreement and effective authentication profile on both sides. That action fits another problem: Site-to-site VPN negotiation repeatedly fails just after a PSK rotation. It does not directly remediate the current finding at Harbor Point Medical: An FTD tunnel has healthy SAs but one internal subnet cannot reach the remote peer. The relevant corrective control for this case is: Inspect routing, protected network selectors, access control, and NAT treatment for that subnet.

The VPN remains established through NAT with reliable bidirectional protected flows. This would be relevant evidence for a different failure: A tunnel drops traffic only when behind a NAT device that changes the peer's translated address, usually addressed by Verify NAT traversal configuration and peer reachability for UDP-encapsulated IPsec. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: Traffic from each approved subnet crosses the tunnel and unrelated networks stay blocked.

IKE establishes successfully and logs show compatible negotiated parameters. This would be relevant evidence for a different failure: An FTD site-to-site VPN shows no active IKE security association despite route reachability, usually addressed by Inspect IKE proposals, peer identity, authentication, and exchange logs before changing data-plane policy. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: Traffic from each approved subnet crosses the tunnel and unrelated networks stay blocked.

Negotiation succeeds with the current credential while the old PSK remains invalid. This would be relevant evidence for a different failure: Site-to-site VPN negotiation repeatedly fails just after a PSK rotation, usually addressed by Check secure peer key agreement and effective authentication profile on both sides. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: Traffic from each approved subnet crosses the tunnel and unrelated networks stay blocked.