Match each Internet Key Exchange version 2 (IKEv2) exchange or association with its role.

### The pairs\n| Item | Matches | Why |\n|---|---|---|\n| IKE_SA_INIT | Agrees on initial cryptographic parameters and exchanges Diffie-Hellman values and nonces | Peers select compatible initial settings and derive keys for later protected messages. |\n| IKE_AUTH | Authenticates peers and establishes the first Child Security Association (CHILD SA) | This exchange verifies peer identities and establishes the first data-protection association. |\n| CREATE_CHILD_SA | Creates or rekeys security associations | Peers use it to add or renew traffic-protection associations. |\n| IKE Security Association (IKE SA) | Protects control exchanges between peers | The IKE SA protects negotiation and management messages, rather than the user packets themselves. |\n\n### Terms\n- **IKEv2**: Internet Key Exchange version 2, the VPN negotiation protocol.\n\n### Remember\nINIT negotiates, AUTH authenticates, and CHILD SAs protect user traffic.