300-410 DMVPN Practice Test 4 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot OSPF over DMVPN:

R1# debug ip ospf adj

OSPF: 2 Way Communication to 10.0.0.2 on Tunnel0, state 2WAY
OSPF: Send DBD to 10.0.0.2 on Tunnel0 seq 0x1234 opt 0x52 flag 0x7
OSPF: Rcv DBD from 10.0.0.2 on Tunnel0 seq 0x1235 opt 0x52 flag 0x2
OSPF: Exchange Done with 10.0.0.2 on Tunnel0
OSPF: Build router LSA for area 0, router ID 1.1.1.1

What does this output indicate?

Accepted Answer

OSPF adjacency with 10.0.0.2 is forming successfully and will reach FULL state.. The debug shows OSPF adjacency formation: 2-way state, database description exchange, and exchange done, indicating a full adjacency is being established.

Answer

OSPF adjacency with 10.0.0.2 is stuck in 2WAY state and not progressing.

Answer

OSPF is not enabled on Tunnel0.

Answer

There is an OSPF MTU mismatch causing the adjacency to fail.

Question 2

A network engineer runs the following command to verify OSPF database on a DMVPN hub:

R1# show ip ospf database router 2.2.2.2

OSPF Router with ID (1.1.1.1) (Process ID 1)

Router Link States (Area 0)

LS age: 100
  Options: (No TOS-capability, DC)
  LS Type: Router Links
  Link State ID: 2.2.2.2
  Advertising Router: 2.2.2.2
  LS Seq Number: 80000001
  Checksum: 0x1234
  Length: 48
  Number of Links: 1

Link connected to: a Transit Network
     (Link ID) Designated Router address: 10.0.0.1
     (Link Data) Router Interface address: 10.0.0.2
      Number of MTID metrics: 0
       TOS 0 Metrics: 10

What does this output indicate?

Accepted Answer

The router 2.2.2.2 is connected to the DR at 10.0.0.1 over the DMVPN tunnel with cost 10.. The output shows the router LSA from 2.2.2.2, advertising a link to a transit network (the DMVPN tunnel) with metric 10, indicating the spoke is connected to the hub's DR.

Answer

The router 2.2.2.2 is advertising a stub network via Tunnel0.

Answer

The router 2.2.2.2 is the DR for the DMVPN network.

Answer

The OSPF database is empty; no LSAs have been received.

Question 3

A network engineer runs the following command to troubleshoot IPsec on a DMVPN tunnel:

R1# debug crypto isakmp

ISAKMP: received peer 192.168.1.2, port 500, local 192.168.1.1
ISAKMP: SA created, initiating IKE Main Mode
ISAKMP: sent MM_SA proposal to 192.168.1.2
ISAKMP: received MM_SA response from 192.168.1.2
ISAKMP: Main Mode complete, starting Quick Mode
ISAKMP: sent QM_SA request to 192.168.1.2
ISAKMP: received QM_SA response from 192.168.1.2
ISAKMP: Quick Mode done, IPsec SA established

What does this output indicate?

Accepted Answer

IKE negotiation succeeded and an IPsec SA is now active.. The debug shows successful IKE Main Mode and Quick Mode exchanges, resulting in an established IPsec SA between 192.168.1.1 and 192.168.1.2.

Answer

IKE negotiation failed; no IPsec SA was established.

Answer

The peer 192.168.1.2 is not responding to IKE requests.

Answer

IKE is using Aggressive Mode instead of Main Mode.

Question 4

A network engineer runs the following command to verify IPsec transform sets on a DMVPN hub:

R1# show crypto ipsec transform-set

Transform set combined: { esp-aes 256 esp-sha-hmac }
   will negotiate = { Tunnel,  },

Transform set TS1: { esp-aes 256 esp-sha-hmac }
   will negotiate = { Transport,  },

What does this output indicate?

Accepted Answer

Both transform sets are configured with the same encryption and authentication algorithms.. The output shows two transform sets: 'combined' uses tunnel mode, 'TS1' uses transport mode. DMVPN typically uses transport mode for mGRE tunnels.

Answer

The transform set 'combined' is used for DMVPN because it uses tunnel mode.

Answer

No transform sets are configured; the output is empty.

Question 5

A network engineer runs the following command to verify crypto engine connections on a DMVPN spoke:

R2# show crypto engine connections active

Crypto Engine Connections

ID  Type    Algorithm           Encrypt  Decrypt LastSeqN  IP-Address
    1  IPsec   AES256-SHA         100      100     100       192.168.1.2

What does this output indicate?

Accepted Answer

An IPsec SA is active with 100 packets encrypted and decrypted, indicating traffic flow.. The output shows one active IPsec connection using AES256-SHA, with 100 packets encrypted and decrypted, indicating traffic is flowing over the DMVPN tunnel.

Answer

No IPsec SAs are active; the connection list is empty.

Answer

The IPsec SA is failing due to algorithm mismatch.

Answer

The connection is for IKE, not IPsec.

Question 6

In a DMVPN Phase 2 deployment using EIGRP as the routing protocol, what is the default hello timer value on the tunnel interface?

Accepted Answer

5 seconds. EIGRP uses a default hello timer of 5 seconds on high-speed interfaces (including tunnel interfaces) and 60 seconds on low-speed interfaces. DMVPN tunnel interfaces are treated as high-speed by default.

Answer

10 seconds

Answer

30 seconds

Answer

60 seconds

Question 7

In DMVPN Phase 3 using OSPF, what is the default network type on a multipoint GRE tunnel interface?

Accepted Answer

NBMA. By default, a multipoint GRE tunnel interface is treated as an OSPF NBMA network type. This requires manual neighbor configuration unless the interface is set to broadcast or point-to-multipoint.

Answer

broadcast

Answer

point-to-multipoint

Answer

point-to-point

Question 8

Which statement about the Next Hop Resolution Protocol (NHRP) in DMVPN is correct regarding the purpose of NHRP Registration Request packets?

Accepted Answer

They are used to register the spoke's tunnel IP and NBMA address with the hub.. NHRP Registration Request packets are sent from spoke routers to the hub to register their tunnel IP address (NHS) and corresponding NBMA address. This allows the hub to build a mapping database for forwarding.

Answer

They are used to resolve the NBMA address of a destination tunnel IP address.

Answer

They are used to purge outdated NHRP cache entries on the hub.

Answer

They are used to establish an IPsec security association between spokes.

Question 9

In DMVPN Phase 2, what is the default behavior of the 'ip nhrp redirect' command on the hub router?

Accepted Answer

It is disabled by default and is used in Phase 3 to enable NHRP redirects.. In DMVPN Phase 2, the 'ip nhrp redirect' command is not enabled by default on the hub. It is used in Phase 3 to enable NHRP redirects, which allow the hub to inform spokes that a better path exists directly to another spoke. In Phase 2, spoke-to-spoke tunnels are established based on NHRP resolution triggered by traffic, not by redirect messages.

Answer

It is enabled by default and causes the hub to send redirect messages to spokes.

Answer

It is disabled by default and must be configured for spoke-to-spoke direct communication.

Answer

It is enabled by default and is used to disable NHRP shortcut switching.

Question 10

What is the default OSPF metric for a route learned over a DMVPN tunnel interface when the OSPF network type is broadcast?

Accepted Answer

1. OSPF default metric for a route is based on the reference bandwidth (default 100 Mbps) divided by the interface bandwidth. For a tunnel interface, the default bandwidth is 100 Mbps (on many platforms), so the metric is 1. However, if the tunnel bandwidth is set differently, the metric changes. The default metric is 1 when bandwidth is 100 Mbps.

Answer

10

Answer

100

Answer

0

Question 11

In DMVPN Phase 3, which loop prevention mechanism is used by default to prevent routing loops when using EIGRP?

Accepted Answer

Feasibility Condition. EIGRP uses the Feasibility Condition (FC) as its loop prevention mechanism. In DMVPN Phase 3, with EIGRP stub routing and summarization, the FC ensures that only feasible successors are used, preventing loops. Additionally, the 'no ip split-horizon' is often required on the hub, but loop prevention relies on EIGRP's DUAL algorithm and the FC.

Answer

Split horizon

Answer

Route poisoning

Answer

Hold-down timers

Question 12

What is the default authentication type for NHRP in a DMVPN configuration?

Accepted Answer

No authentication. By default, NHRP does not use any authentication. Authentication can be configured using the 'ip nhrp authentication' command, but it is disabled by default.

Answer

Plaintext password

Answer

MD5 hash

Answer

IPsec

Question 13

In DMVPN, what is the default holdtime value for NHRP mappings on a spoke router?

Accepted Answer

7200 seconds. The default NHRP holdtime is 7200 seconds (2 hours) for mappings learned from the hub. This can be changed with the 'ip nhrp holdtime' command.

Answer

300 seconds

Answer

600 seconds

Answer

3600 seconds

Question 14

Which statement about the default behavior of 'auto-summary' in EIGRP for DMVPN tunnel interfaces in IOS-XE is correct?

Accepted Answer

Auto-summary is disabled by default, preventing classful summarization.. In modern IOS-XE versions (15.x and later), auto-summary is disabled by default for EIGRP. This is a change from older IOS versions where it was enabled by default. Disabling auto-summary is essential in DMVPN to prevent incorrect summarization at classful boundaries.

Answer

Auto-summary is enabled by default and summarizes routes at classful boundaries.

Answer

Auto-summary is enabled by default but only for tunnel interfaces.

Answer

Auto-summary is disabled by default but can be enabled only for DMVPN.

Question 15

Drag and drop the steps to establish a DMVPN Phase 2 spoke-to-spoke tunnel into the correct order, from first to last.

Accepted Answer

Configure NHRP and mGRE on hub and spokes. In DMVPN Phase 2, spoke-to-spoke tunnels are built dynamically. First, the spoke must have a valid NHRP registration to the hub. When traffic from one spoke to another triggers an NHRP resolution request, the hub forwards it to the target spoke, which replies. The spoke then initiates a direct mGRE tunnel, and finally, the spoke-to-spoke IPsec session is established.