300-410 VPN Technologies — All Questions With Answers

Question 1mediummultiple choice

A network engineer is configuring a GRE tunnel between two Cisco IOS routers, R1 and R2, to carry OSPF traffic over an ISP network. The tunnel source on R1 is GigabitEthernet0/0 (IP 203.0.113.1), and the tunnel destination is R2's GigabitEthernet0/0 (IP 203.0.113.2). The engineer enters the following commands on R1:

interface Tunnel0
 ip address 10.0.0.1 255.255.255.252

tunnel source GigabitEthernet0/0 tunnel destination 203.0.113.2 tunnel mode gre ip

After configuration, the tunnel interface is up/up, but OSPF adjacency does not form. What is the most likely cause?

Question 2mediummultiple choice

300-410 VPN Technologies — All Questions With Answers

A network administrator is configuring a VRF-aware IPSec VPN on a Cisco IOS router. The router must support overlapping IP addresses for two different customers. The administrator has created VRF CUST-A and VRF CUST-B. Which configuration is required to enable IPSec to operate within a VRF?

A network engineer is implementing DMVPN Phase 2 with EIGRP as the routing protocol. To ensure proper spoke-to-spoke communication, the engineer must configure the hub and spokes correctly. Which two statements about DMVPN Phase 2 with EIGRP are true? (Choose two.)

A network administrator is deploying a GET VPN solution using Cisco Group Encrypted Transport VPN. The administrator wants to ensure that the key server (KS) and group members (GMs) can successfully establish security associations. Which two statements about GET VPN are true? (Choose two.)

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router. The router has two VRFs: VRF-A and VRF-B. The engineer wants to encrypt traffic from VRF-A to a remote site using IPsec. Which additional configuration is required on the crypto map to support VRF-aware IPsec?

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that the VPN tunnel remains active even when there is no interesting traffic. Which configuration command should be applied to the crypto map to achieve this?

A network engineer is configuring a GRE tunnel between two routers. The engineer wants to ensure that the tunnel interface remains up even if the physical interface goes down, as long as the tunnel destination is reachable via an alternative path. Which configuration is required?

A network engineer is deploying a DMVPN Phase 3 network with IPsec protection. The engineer wants to ensure that spoke-to-spoke traffic is encrypted and that spokes can dynamically create direct tunnels. Which two configurations are required on the spoke routers? (Choose two.)

A network engineer is deploying a GET VPN solution using Cisco IOS routers. The engineer wants to ensure that the group members can communicate securely over the public internet while maintaining any-to-any connectivity. Which two components are required in a GET VPN deployment? (Choose two.)

An engineer is deploying a site-to-site VPN using Cisco IOS routers. The requirement is to use a technology that provides encryption and supports multicast traffic over the VPN without additional configuration. Which VPN technology should be used?

A network engineer is deploying DMVPN Phase 2 with EIGRP as the routing protocol. The engineer notices that spoke-to-spoke communication is not working, and the spokes are not forming direct tunnels. Which configuration change is required on the hub to allow spoke-to-spoke communication?

A network engineer is configuring a GRE over IPsec tunnel between two Cisco IOS routers. The engineer wants to ensure that multicast traffic, such as OSPF hello packets, is encrypted and forwarded across the tunnel. Which two configurations are required to achieve this? (Choose two.)

A network administrator is setting up a DMVPN Phase 2 network. The hub router must be able to dynamically learn the public IP addresses of spokes. Which command should be configured on the hub to enable this?

A network administrator is configuring a FlexVPN site-to-site tunnel between two Cisco IOS routers. The administrator wants to use IKEv2 and wants to ensure that the tunnel uses a pre-shared key for authentication. Which command is used to configure the pre-shared key on the local router?

A network engineer is configuring a site-to-site GRE over IPsec tunnel between two Cisco IOS routers. The engineer wants to protect the GRE traffic with IPsec while allowing multicast routing protocols to run over the tunnel. Which configuration is required to achieve this?

A network engineer is configuring a VTI-based IPsec VPN between two Cisco routers. The engineer wants to enable dynamic routing over the VPN using OSPF. Which configuration is necessary on the VTI interface to allow OSPF to form an adjacency?

A network engineer is configuring a GRE over IPsec tunnel between two Cisco routers. The engineer wants to ensure that the GRE tunnel remains up even if the IPsec tunnel goes down, to allow dynamic routing protocols to detect failures quickly. Which configuration is most appropriate?

A network engineer is configuring a Cisco IOS router to establish a site-to-site VPN using IKEv1. The engineer wants to ensure that the pre-shared key is encrypted when displayed in the running configuration. Which command should be used?

A network engineer is troubleshooting an IPsec VPN between two Cisco IOS routers. The IKEv2 negotiation fails. The engineer has verified that the IKEv2 proposal, keyring, and profile are correctly configured on both routers. Which two additional items should the engineer check? (Choose two.)

A network engineer is deploying DMVPN Phase 2 with OSPF as the routing protocol. The engineer wants to ensure that spoke-to-spoke communication works without traffic traversing the hub. Which two statements about the OSPF configuration are true? (Choose two.)

A network administrator is configuring a GRE tunnel between two Cisco routers. The administrator wants to ensure that the tunnel interface remains up even if the physical interface goes down. Which command should be used on the tunnel interface?

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router. The engineer wants to ensure that the IPsec tunnel traffic is forwarded using the correct VRF. Which command must be used under the crypto map to specify the VRF?

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router. The engineer needs to ensure that IPsec tunnel traffic is forwarded within the correct VRF after decryption. Which configuration is required to map the IPsec tunnel to a specific VRF?

A network administrator is troubleshooting an IPsec VPN tunnel between two Cisco IOS routers using IKEv2. Phase 1 is up, but Phase 2 fails. The administrator sees the log message `%IPSEC-3-REPLAY_ERR: IPsec pkt from 203.0.113.2 has no SA`. Which action is most likely to resolve the Phase 2 failure?

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router. The engineer must ensure that IPsec tunnel traffic is forwarded within the correct VRF. Which two configurations are required to achieve this? (Choose two.)

A network administrator is configuring a GRE over IPsec tunnel between two Cisco IOS routers to support multicast traffic. The administrator notices that multicast packets are not being forwarded through the tunnel. Which configuration is required to allow multicast traffic over the GRE tunnel?

A network engineer is configuring a DMVPN Phase 2 hub-and-spoke topology using mGRE and NHRP. The engineer wants to ensure that spoke-to-spoke communication works correctly. Which two statements describe the required configuration or behavior for this deployment? (Choose two.)

A network administrator is configuring a VRF-aware IPsec VPN on a Cisco IOS router. The engineer wants to ensure that IPsec tunnel traffic is forwarded within the correct VRF. Which command should be used to associate the IPsec profile with a VRF?

A network engineer is implementing DMVPN Phase 3 with OSPF. The hub router must advertise a default route to all spokes, but spokes should not advertise routes to each other. Which configuration on the hub router accomplishes this?

A network engineer is troubleshooting an IPsec site-to-site VPN between two Cisco routers. The VPN tunnel is up, but traffic is not passing through it. The engineer suspects a routing issue. Which command should be used to verify that the remote subnet is being routed through the tunnel interface?

A network engineer is troubleshooting an IPsec site-to-site VPN between two Cisco IOS routers. Phase 1 is up, but Phase 2 fails to establish. The engineer suspects a mismatch in the IPsec proposal. Which command would show the configured IPsec transform set and the algorithms being used?

A network engineer is configuring a site-to-site DMVPN Phase 3 hub-and-spoke topology. Spokes must be able to communicate directly without traffic traversing the hub. Which command must be configured on the hub to enable spoke-to-spoke direct tunnels?

A network engineer is configuring a site-to-site VPN between two Cisco IOS routers using IPsec. The engineer wants to ensure that only traffic from the 10.1.1.0/24 network to the 10.2.2.0/24 network is encrypted. Which type of ACL must be used in the crypto map to define the interesting traffic?

A network administrator is implementing GET VPN on Cisco IOS routers. The key server is configured with a policy that includes the `rekey` command. Which statement accurately describes the behavior of the rekey mechanism in GET VPN?

A network engineer is configuring DMVPN Phase 3 on a hub router. The hub has a public IP address and is reachable. Spokes are behind NAT devices and have dynamic public IP addresses. Which technology allows spokes to communicate directly without routing traffic through the hub?

A network engineer is configuring DMVPN Phase 3 with IKEv2. The hub router is a Cisco IOS XE device, and the goal is to allow spoke-to-spoke traffic to bypass the hub after initial registration. Which command must be configured on the hub to enable NHRP redirects?

A network administrator is troubleshooting an IPsec site-to-site VPN between two Cisco IOS routers. The tunnel is up, but traffic is not passing. The administrator suspects a routing issue. Which command should be used to verify that the crypto ACL matches the traffic being sent?

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology. The hub router must dynamically learn spoke-to-spoke routes without requiring a full mesh of tunnels. Which technology should be implemented on the hub to allow spoke routers to resolve next-hop addresses directly?

A network engineer is configuring a GRE tunnel over an IPsec VPN to support multicast traffic between two sites. The engineer notices that multicast traffic is not passing through the tunnel, although unicast traffic works. Which of the following is the most likely reason?

A network engineer is configuring a site-to-site IPsec VPN between two Cisco routers. The engineer wants to use a pre-shared key for authentication. Which command is used to configure the pre-shared key on the router?

A network technician is configuring a GRE tunnel between two Cisco routers. The tunnel interface is up, but no traffic is passing. Which command should be used to verify that the tunnel source and destination are reachable?

A network engineer is configuring a VRF-aware IPsec VPN. The engineer needs to ensure that the IPsec tunnel traffic is forwarded within the correct VRF on the router. Which command must be configured under the crypto map to bind the IPsec tunnel to a specific VRF?

A network engineer is implementing DMVPN Phase 3 with IPsec tunnel protection. The hub router must be configured to support NHRP redirect. Which command is required on the hub's tunnel interface?

A network administrator is configuring a site-to-site IPsec VPN between two Cisco IOS XE routers. The administrator wants to ensure that the VPN tunnel only encrypts traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet. Which configuration element defines the traffic to be encrypted?

A network engineer is configuring a GRE over IPsec tunnel between two Cisco routers. The engineer wants to ensure that multicast traffic, such as OSPF hello packets, is encrypted and sent over the tunnel. Which statement about the configuration is true?

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology on Cisco IOS routers. The hub router must dynamically learn spoke-to-spoke routes and allow direct spoke-to-spoke tunnels. Which command must be configured on the hub's tunnel interface to enable Phase 3 behavior?

A network administrator is troubleshooting an IPsec VPN between two Cisco routers. The VPN tunnel is up, but only small pings succeed; larger packets fail. The administrator suspects an MTU or fragmentation issue. Which action is most likely to resolve the problem while maintaining security?

A network engineer is configuring a GRE over IPsec tunnel between two Cisco IOS routers. The engineer wants to ensure that the GRE tunnel traffic is encrypted by IPsec. Which of the following configurations is required to achieve this?

A network engineer is configuring a DMVPN Phase 3 hub router. The hub must dynamically discover spoke-to-spoke tunnels while still using the hub for initial registration. Which technology allows the hub to redirect spoke traffic directly to another spoke?

A network administrator is troubleshooting an IPsec VPN between two Cisco routers. Phase 1 completes successfully, but Phase 2 fails. The administrator sees the log message 'QM FSM error' on the initiator. Which configuration mismatch is the most likely cause?

Which protocol should be used to dynamically distribute encryption keys for a GET VPN deployment?