CCNP VPN Technologies Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on Router R7:

R7# show crypto ikev2 sa detail

IKEv2 SAs:

Session-id:1, Status:UP-ACTIVE, IKE count:1, Child count:1

Tunnel-id Local              Remote               Status         Role
   1         10.1.1.1/4500      10.2.2.2/4500        READY          INITIATOR
      Encr: AES-CBC 256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/3600 sec

Child SA: Local selector  10.1.1.0/0 - 10.1.1.255/65535
             Remote selector 10.2.2.0/0 - 10.2.2.255/65535
             ESP spi in/out: 0x12345678/0x87654321

Based on this output, what can be concluded?

Accepted Answer

The tunnel is using pre-shared keys for authentication.. The IKEv2 SA is UP-ACTIVE with status READY. The encryption is AES-CBC 256, hash SHA256, DH Group 14, and authentication is PSK. The tunnel is working correctly.

Answer

The IKEv2 SA is in a failed state because it is READY.

Answer

The tunnel is using RSA signatures for authentication.

Answer

The IKEv2 SA has expired because the life time is 86400 seconds.

Question 2

A network engineer runs the following command on Router R8:

R8# show ip nhrp

10.0.0.1/32 via 10.0.0.1
   Tunnel0 created 00:10:00, expire 01:50:00
   Type: dynamic, Flags: unique registered
   NBMA address: 192.168.1.1
10.0.0.2/32 via 10.0.0.2
   Tunnel0 created 00:05:00, expire 01:55:00
   Type: dynamic, Flags: unique registered
   NBMA address: 192.168.1.2

Based on this output, what can be concluded?

Accepted Answer

The router is a DMVPN hub with two registered spokes.. The NHRP cache shows two dynamic entries for 10.0.0.1 and 10.0.0.2 with NBMA addresses 192.168.1.1 and 192.168.1.2. Both are registered and unique, indicating a DMVPN spoke registration.

Answer

The router has static NHRP mappings configured.

Answer

The NHRP entries are about to expire because the expire time is less than 2 hours.

Answer

The router is a spoke because it has only two entries.

Question 3

A network engineer runs the following command on Router R9:

R9# show ip interface tunnel 0
Tunnel0 is up, line protocol is up
  Internet address is 10.0.0.9/24
  Broadcast address is 255.255.255.255
  Address determined by non-volatile memory
  MTU is 1400 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is disabled
  Local Proxy ARP is disabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP CEF switching is enabled
  IP CEF switching turbo vector
  IP Null turbo vector
  IP multicast fast switching is enabled
  IP multicast distributed fast switching is disabled
  IP route-cache flags are Fast, CEF
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Probe proxy name replies are disabled
  Policy routing is disabled
  Network address translation is disabled
  WCCP Redirect outbound is disabled
  WCCP Redirect inbound is disabled
  WCCP Redirect exclude is disabled
  BGP Policy Mapping is disabled

Based on this output, what can be concluded?

Accepted Answer

The MTU of 1400 bytes suggests this is a GRE or IPsec tunnel.. The tunnel interface is up/up with an MTU of 1400 bytes. The MTU is reduced from the default 1500, which is typical for GRE/IPsec tunnels to accommodate encapsulation overhead. This indicates the tunnel is likely a GRE or IPsec tunnel.

Answer

The tunnel is down because the line protocol is up.

Answer

The tunnel is using IP compression because TCP/IP header compression is disabled.

Answer

The tunnel has a helper address configured for DHCP.

Question 4

Given the following configuration on a Cisco IOS-XE router:

interface Tunnel100
 ip address 10.0.0.1 255.255.255.252
 tunnel source GigabitEthernet0/0/0
 tunnel destination 192.168.1.1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile MYPROFILE

What is the effect of this configuration?

Accepted Answer

It creates a VTI (Virtual Tunnel Interface) that encrypts all traffic routed into the tunnel using IPsec.. This configuration creates a point-to-point tunnel interface that uses IPsec to encrypt traffic between the local router and the remote peer at 192.168.1.1. The tunnel mode ipsec ipv4 enables IPsec encapsulation of IPv4 packets, and the tunnel protection command applies an IPsec profile for encryption.

Answer

It creates a GRE tunnel with IPsec encryption.

Answer

It creates a DMVPN phase 1 tunnel with mGRE.

Answer

It creates a L2TPv3 tunnel for layer 2 transport.

Question 5

Examine the following IPsec configuration snippet:

crypto ikev2 proposal IKEV2_PROP
 encryption aes-cbc-256
 integrity sha256
 group 14
!
crypto ikev2 policy IKEV2_POL
 proposal IKEV2_PROP
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac
 mode tunnel
!
crypto ipsec profile IPSEC_PROF
 set transform-set TSET
 set ikev2-profile IKEV2_POL

Which statement about this configuration is true?

Accepted Answer

The transform set uses ESP with AES-256 encryption and SHA-256 HMAC for authentication.. The configuration defines an IKEv2 proposal with AES-256 encryption, SHA-256 integrity, and Diffie-Hellman group 14. The IPsec transform set uses AES-256 and SHA-256. The IPsec profile references both the transform set and the IKEv2 profile. However, the IKEv2 policy is not directly used in the profile; the profile uses the IKEv2 profile, not the policy. The correct statement is that the transform set uses ESP with AES-256 encryption and SHA-256 HMAC.

Answer

The IKEv2 proposal uses AES-256, SHA-256, and DH group 14, but the IPsec profile will not apply because the ikev2-profile command is missing the 'set' keyword.

Answer

The transform set is configured in transport mode, which is incorrect for site-to-site VPN.

Answer

The IPsec profile is incomplete because it does not include a PFS (Perfect Forward Secrecy) setting.

Question 6

Consider the following DMVPN configuration on a hub router:

interface Tunnel0
 ip address 10.0.0.1 255.255.255.0
 no ip redirects
 ip nhrp map multicast dynamic
 ip nhrp network-id 100
 tunnel source GigabitEthernet0/0/0
 tunnel mode gre multipoint

What is the effect of the command 'ip nhrp map multicast dynamic'?

Accepted Answer

It enables the hub to dynamically add spoke NBMA addresses to the multicast NHRP map for forwarding multicast traffic to all spokes.. The 'ip nhrp map multicast dynamic' command allows the hub to dynamically learn the NBMA addresses of spoke routers when they register via NHRP, and then automatically add those addresses to the multicast list for forwarding multicast traffic (such as routing protocol hellos) to all spokes.

Answer

It statically maps the hub's own NBMA address to the multicast group.

Answer

It configures the hub to send NHRP registration requests to the multicast address 224.0.0.1.

Answer

It disables multicast forwarding over the tunnel interface.

Question 7

Given this configuration on a Cisco IOS-XE router:

crypto ikev2 keyring KEYRING
 peer SPOKE1
  address 192.168.2.1
  pre-shared-key cisco123
!
crypto ikev2 profile IKEV2_PROF
 match identity remote address 192.168.2.1 255.255.255.255
 authentication remote pre-share
 authentication local pre-share
 keyring KEYRING
!

What is missing from this configuration for a successful IKEv2 tunnel to the peer at 192.168.2.1?

Accepted Answer

The IKEv2 proposal and policy are not defined and must be referenced by the profile or the IPsec profile.. The configuration includes an IKEv2 keyring with a pre-shared key and an IKEv2 profile that matches the peer identity and specifies pre-shared key authentication. However, the IKEv2 proposal and policy are not referenced. The profile must be associated with an IKEv2 policy that defines encryption, integrity, and DH group parameters. Without a proposal/policy, IKEv2 cannot negotiate the security parameters.

Answer

The configuration is complete; no additional commands are needed.

Answer

The profile is missing the 'set transform-set' command to specify the IPsec transform set.

Answer

The keyring must use a different name to match the profile.

Question 8

Examine this configuration for a site-to-site VPN on a Cisco router:

crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 lifetime 86400
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.1
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/0/0
 ip address 10.0.0.1 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255

Which statement about this configuration is true?

Accepted Answer

The access-list 101 defines the traffic that will be encrypted; traffic from 192.168.10.0/24 to 192.168.20.0/24 will be protected.. This is a classic crypto map-based site-to-site IPsec VPN. The ISAKMP policy defines phase 1 parameters, the transform set defines phase 2, and the crypto map binds them together with the peer and interesting traffic ACL. The ACL 101 specifies traffic from 192.168.10.0/24 to 192.168.20.0/24 to be encrypted.

Answer

The crypto map uses IKEv2 for key exchange because the transform set uses SHA-256.

Answer

The ISAKMP policy lifetime of 86400 seconds is too long and will cause the tunnel to fail.

Answer

The crypto map should be applied to the tunnel interface, not the physical interface.

Question 9

Consider the following configuration for a FlexVPN spoke router:

interface Tunnel0
 ip address 10.0.0.2 255.255.255.0
 tunnel source GigabitEthernet0/0/0
 tunnel mode gre ip
 tunnel protection ipsec profile FLEXPROF
 ip nhrp network-id 100
 ip nhrp nhs 10.0.0.1
 ip nhrp map 10.0.0.1 192.168.1.1

What is the purpose of the 'ip nhrp map 10.0.0.1 192.168.1.1' command?

Accepted Answer

It provides a static mapping from the hub's tunnel IP (10.0.0.1) to the hub's physical IP (192.168.1.1) so the spoke can reach the hub.. In FlexVPN (or DMVPN), the 'ip nhrp map' command statically maps a tunnel IP address (10.0.0.1) to a physical NBMA address (192.168.1.1). This is used by the spoke to know the hub's physical address for NHRP registration and communication.

Answer

It maps the spoke's tunnel IP to its own physical interface IP for local routing.

Answer

It enables multicast mapping for dynamic spoke discovery.

Answer

It configures the spoke to register with the hub using the specified physical address.

Question 10

What is the default IKEv1 (ISAKMP) lifetime in seconds on Cisco IOS routers?

Accepted Answer

86400 seconds. The default IKEv1 lifetime is 86400 seconds (1 day). This can be changed with the 'lifetime' command under the ISAKMP policy.

Answer

3600 seconds

Answer

28800 seconds

Answer

7200 seconds

Question 11

Which IPsec protocol provides both encryption and authentication within a single ESP header?

Accepted Answer

ESP (Encapsulating Security Payload). ESP (Encapsulating Security Payload) provides both encryption (confidentiality) and authentication (integrity) in a single header. AH only provides authentication without encryption.

Answer

AH (Authentication Header)

Answer

IKE (Internet Key Exchange)

Answer

GRE (Generic Routing Encapsulation)

Question 12

In a DMVPN phase 2 network, what is the primary advantage of using phase 2 over phase 1?

Accepted Answer

Phase 2 allows spoke-to-spoke direct tunnels, bypassing the hub for data traffic.. DMVPN phase 2 allows spoke-to-spoke tunnels to be established dynamically without traffic having to traverse the hub. This reduces latency and hub load. Phase 1 only supports hub-and-spoke topology where all traffic goes through the hub.

Answer

Phase 2 supports dynamic routing protocols over the tunnel, while phase 1 does not.

Answer

Phase 2 uses mGRE on both hub and spokes, while phase 1 uses p2p GRE on spokes.

Answer

Phase 2 supports IPsec encryption natively, while phase 1 requires additional configuration.

Question 13

Drag and drop the steps of IKEv2 IPsec tunnel establishment into the correct order, from first to last.

Accepted Answer

IKE_SA_INIT exchange. IKEv2 uses a two-phase process: Phase 1 (IKE_SA_INIT) establishes a secure channel, then Phase 2 (IKE_AUTH and CREATE_CHILD_SA) authenticates peers and creates IPsec SAs. The order is: 1. IKE_SA_INIT exchange, 2. IKE_AUTH exchange, 3. CREATE_CHILD_SA exchange, 4. IPsec SA installation, 5. Data encryption/decryption.

Question 14

Drag and drop the steps of configuring a site-to-site IPsec VPN on Cisco IOS into the correct order, from first to last.

Accepted Answer

Define IKE policy. The correct order for configuring a site-to-site IPsec VPN is: first define the IKE policy (Phase 1 parameters), then define the IPsec transform set (Phase 2 parameters), then create the crypto ACL to match interesting traffic, then configure the crypto map to bind all parameters, and finally apply the crypto map to the outgoing interface.

Question 15

Drag and drop the steps of DMVPN Phase 3 NHRP registration and spoke-to-spoke tunnel establishment into the correct order, from first to last.

Accepted Answer

Spoke registers with hub via NHRP. In DMVPN Phase 3, the spoke first registers its NHRP mapping with the hub, then the hub propagates the mapping. When a spoke needs to reach another spoke, it sends an NHRP resolution request to the hub, the hub replies with the mapping, and then the spoke initiates a direct IPsec tunnel to the target spoke.