300-410 VPN Technologies Practice Test 10 — 15 Questions

Question 1

A network administrator is troubleshooting an IPsec VPN between two Cisco routers. The VPN tunnel is up, but only small pings succeed; larger packets fail. The administrator suspects an MTU or fragmentation issue. Which action is most likely to resolve the problem while maintaining security?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adjust the tunnel interface MTU and TCP MSS clamping on the tunnel interface.. IPsec and GRE encapsulation add overhead, reducing the effective MTU. When large packets are sent, they may exceed the path MTU and get dropped if fragmentation is not allowed. Adjusting the tunnel interface MTU and configuring TCP MSS clamping ensures that TCP sessions negotiate a smaller MSS, preventing fragmentation and packet loss while keeping the VPN secure.

Answer

Enable path MTU discovery (PMTUD) on the tunnel and rely on ICMP unreachable messages.

Answer

Increase the IP MTU on the physical interface to accommodate larger packets.

Answer

Disable IPsec encryption on the tunnel to eliminate overhead.

Question 2

A network administrator is deploying DMVPN Phase 3 with IKEv2 IPsec protection. The hub router is configured with a multipoint GRE tunnel interface and NHRP. Spoke routers register with the hub and can communicate directly with each other. The administrator wants to ensure that spoke-to-spoke traffic is encrypted. Which statement about the IPsec configuration is true?

Accepted Answer

A single IPsec profile on the hub and spokes can protect both hub-to-spoke and spoke-to-spoke traffic.. In DMVPN Phase 3, the same IPsec profile applied to the multipoint GRE tunnel interface on all routers (hub and spokes) protects all traffic, including spoke-to-spoke. When a spoke initiates a direct tunnel to another spoke, the IPsec session is established using the same profile. This uniform configuration is a primary benefit of DMVPN, allowing scalable and secure any-to-any connectivity.

Answer

IPsec must be configured on the physical interfaces of the spokes.

Answer

IPsec encryption for spoke-to-spoke traffic requires a separate IPsec profile on each spoke.

Answer

Spoke-to-spoke traffic bypasses IPsec encryption because it does not traverse the hub.

Question 3

A network administrator is configuring a point-to-point GRE tunnel between two Cisco routers. The administrator wants to verify that the tunnel is operational and that the correct encapsulation is being used. Which command should be used to display the tunnel interface status, including the encapsulation and tunnel source/destination?

Accepted Answer

show interfaces tunnel 0. The show interfaces tunnel 0 command provides comprehensive details about the tunnel interface, including its operational status, encapsulation type (GRE), and the configured tunnel source and destination. This allows the administrator to verify that the tunnel is up and correctly configured. The other commands do not provide the necessary tunnel-specific information.

Answer

show ip interface brief

Answer

show crypto ipsec sa

Answer

show ip route

Question 4

A network engineer is configuring a GRE over IPsec tunnel between two Cisco IOS routers. The engineer wants to ensure that the GRE tunnel traffic is encrypted by IPsec. Which of the following configurations is required to achieve this?

Accepted Answer

The crypto ACL must permit GRE traffic (protocol 47) between the tunnel source and destination IP addresses.. In a GRE over IPsec configuration, the GRE tunnel encapsulates the private traffic, and then IPsec encrypts the GRE packets. Therefore, the crypto ACL must match GRE traffic (protocol 47) between the tunnel endpoints. This ensures that the entire GRE packet, including the original private IP packet, is encrypted. Permitting the private IP traffic in the crypto ACL would cause IPsec to encrypt the private packets before GRE encapsulation, which is not desired.

Answer

The transform set must include the GRE protocol as the encapsulation mode.

Answer

The crypto map must be applied to the GRE tunnel interface instead of the physical interface.

Answer

The crypto ACL must permit IP traffic between the private networks that are routed over the GRE tunnel.

Question 5

A network engineer is deploying DMVPN Phase 3 with IPsec protection on a Cisco IOS router acting as a hub. The engineer wants to ensure that spoke-to-spoke traffic is encrypted and that spoke routers can dynamically establish direct tunnels. Which two statements are true about this deployment? (Choose two.)

Accepted Answer

The hub must be configured with 'ip nhrp redirect' to signal spokes about a better path.. In DMVPN Phase 3, the hub uses 'ip nhrp redirect' to notify spokes of a better path, and spokes use 'ip nhrp shortcut' to install shortcut routes for direct spoke-to-spoke tunnels. These two features work together to enable dynamic spoke-to-spoke communication. IPsec protection is typically implemented using IPsec profiles, not static crypto maps, and multicast mapping is separate from this functionality.

Answer

The hub must be configured with 'ip nhrp map multicast dynamic' to support dynamic multicast mapping.

Answer

Spoke routers must have a static crypto map entry for each possible destination spoke.

Answer

The hub must use a crypto map with 'ipsec-isakmp' to encrypt all GRE traffic.

Question 6

A network engineer is implementing FlexVPN with IKEv2 between a hub and multiple spokes. The hub uses a single IKEv2 profile and a single IPsec profile. The engineer wants to ensure that each spoke can authenticate using a unique pre-shared key. Which IKEv2 keyring configuration should be used on the hub?

Accepted Answer

A single keyring with multiple peer entries, each specifying a different pre-shared key and matching the spoke's IP address.. FlexVPN supports a single IKEv2 keyring with multiple peer entries. Each peer entry can specify a unique pre-shared key and match criteria based on the spoke's identity, such as IP address or FQDN. The hub's IKEv2 profile references this keyring, and during IKEv2 authentication, the hub selects the appropriate key based on the peer's identity. This allows unique keys per spoke without needing multiple profiles or keyrings.

Answer

A single keyring with multiple peer entries, each specifying the same pre-shared key but different identities.

Answer

Multiple keyrings, each with a single peer entry, and multiple IKEv2 profiles referencing each keyring.

Answer

A single keyring with a single peer entry using a wildcard pre-shared key that matches all spokes.

Question 7

A network engineer is configuring a DMVPN Phase 3 hub router. The hub must dynamically discover spoke-to-spoke tunnels while still using the hub for initial registration. Which technology allows the hub to redirect spoke traffic directly to another spoke?

Accepted Answer

NHRP redirect. In DMVPN Phase 3, the hub uses NHRP redirect to inform a source spoke that a more optimal direct path exists to the destination spoke. The hub inspects incoming packets and, upon determining that the destination is reachable via another spoke, sends an NHRP redirect message. The source spoke then initiates NHRP resolution for the destination and establishes a direct spoke-to-spoke tunnel, achieving Phase 3 shortcuts.

Answer

NHRP shortcut

Answer

NHRP registration

Answer

NHRP resolution

Question 8

A network administrator is troubleshooting an IPsec VPN between two Cisco routers. The VPN tunnel is up, but only small pings succeed; larger packets fail. The administrator suspects an MTU or fragmentation issue. Which action is most likely to resolve the problem while maintaining security?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mismatched transform sets. A QM FSM error during Phase 2 typically points to a mismatch in the quick mode parameters, most commonly the transform set. The transform set defines the encryption and authentication algorithms for the IPsec SA. If the initiator proposes a transform set that the responder does not have configured or does not support, the responder may reject the proposal, causing the initiator to log a QM FSM error. Verifying that both peers have identical transform sets resolves the issue.

Answer

Mismatched encryption algorithm in Phase 1

Answer

Mismatched DH group in Phase 1

Answer

Mismatched IKEv1 pre-shared keys

Question 9

Which protocol should be used to dynamically distribute encryption keys for a GET VPN deployment?

Accepted Answer

GDOI. GET VPN uses the Group Domain of Interpretation (GDOI) protocol for group key management. The key server uses GDOI to distribute encryption keys, rekey messages, and security policies to all group members. This allows members to encrypt traffic to each other without establishing point-to-point tunnels, preserving the any-to-any nature of the underlying network.

Answer

IKEv2

Answer

ISAKMP

Answer

IPsec

Question 10

A network administrator is troubleshooting an IPsec VPN between two Cisco routers. The VPN tunnel is up, but only small pings succeed; larger packets fail. The administrator suspects an MTU or fragmentation issue. Which action is most likely to resolve the problem while maintaining security?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

There is no route for the remote subnet pointing to the tunnel interface or next-hop.. In an IPsec site-to-site VPN, the tunnel can be up due to traffic from other sources or because the peers established it, but for specific traffic to pass, the router must have a route to the remote subnet pointing to the tunnel or the next-hop. Without this route, packets are not sent through the tunnel and may be dropped or routed elsewhere. The crypto ACL matching is necessary but not sufficient; routing is equally important.

Answer

The crypto map is applied to the wrong interface.

Answer

The crypto ACL is configured with the wrong source and destination addresses.

Answer

The transform set is mismatched between peers.

Question 11

A network administrator is configuring DMVPN Phase 3 with a hub-and-spoke topology. The administrator wants to enable spoke-to-spoke communication directly without traversing the hub. Which command must be configured on the hub router to allow spoke-to-spoke tunnels?

Accepted Answer

ip nhrp redirect. The correct answer is 'ip nhrp redirect' on the hub. In DMVPN Phase 3, the hub uses NHRP redirect messages to inform spokes about a better direct path to other spokes. When a spoke receives a redirect, it can establish a direct tunnel to the destination spoke, reducing latency and hub load. This command is essential on the hub to enable this behavior. The spoke routers must also have 'ip nhrp shortcut' configured to act on the redirects.

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut

Answer

ip nhrp map multicast dynamic

Question 12

A network engineer is troubleshooting a site-to-site IPsec VPN that fails to establish. The engineer suspects that the pre-shared key is incorrect. Which command can be used to verify the pre-shared key configuration on a Cisco IOS router?

Accepted Answer

show running-config | include crypto isakmp key. The correct answer is to use the 'show running-config | include crypto isakmp key' command. This command filters the running configuration to show only the lines that contain the pre-shared key configuration. It displays the key and the associated peer address, allowing the engineer to verify if the key matches on both ends. Other commands like 'show crypto isakmp policy' or 'show crypto isakmp sa' provide information about Phase 1 and Phase 2 parameters but do not reveal the pre-shared key.

Answer

show crypto isakmp sa

Answer

show crypto isakmp key

Answer

show crypto isakmp policy

Question 13

A network engineer is configuring a site-to-site DMVPN Phase 3 hub router. The hub uses a single mGRE tunnel interface with the IP address 10.0.0.1/24. Spoke routers are configured with NHS 10.0.0.1 and are in the same subnet. The engineer wants spoke-to-spoke traffic to bypass the hub after the initial resolution. Which command must be configured on the hub to enable Phase 3 shortcut switching?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub must be configured with ip nhrp redirect to send redirect messages to spokes when it forwards traffic to another spoke. The spokes must have ip nhrp shortcut to act on those redirects. Together, they allow spoke-to-spoke direct tunnels after initial hub-based resolution. The hub's role is to redirect, so ip nhrp redirect is the correct command on the hub.

Answer

ip nhrp shortcut

Answer

ip nhrp network-id 100

Answer

ip nhrp map multicast dynamic

Question 14

A network administrator is troubleshooting an IPsec VPN between two Cisco routers. The VPN tunnel is up, but only small pings succeed; larger packets fail. The administrator suspects an MTU or fragmentation issue. Which action is most likely to resolve the problem while maintaining security?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the routing table to ensure that the remote protected subnet is reachable via the tunnel interface or that the next hop is correct.. When IPsec SAs are up but packet counters remain at zero, the router is not identifying or routing traffic into the VPN. The most common cause is a routing issue: the remote subnet is not reachable via the tunnel, or a more specific route directs traffic elsewhere. Verifying the routing table and ensuring the tunnel interface is the next hop for the protected subnet resolves the problem.

Answer

Confirm that the transform set matches on both peers.

Answer

Ensure that the preshared key is identical on both peers.

Answer

Verify that the crypto ACL on the remote peer is a mirror image of the local ACL.

Question 15

A network engineer is deploying a GET VPN solution using Cisco IOS routers. The key server must be configured to rekey group members. Which protocol does GET VPN use to distribute encryption keys and policies to group members?

Accepted Answer

Group Domain of Interpretation (GDOI). GET VPN uses the Group Domain of Interpretation (GDOI) protocol to distribute encryption keys and policies from the key server to group members. GDOI enables scalable group key management, allowing the key server to send rekey messages to all members. IKEv2 is for point-to-point VPNs, and the other options are not used for GET VPN key distribution.

Answer

Group Key Management Protocol (GKMP)

Answer

Multicast Group Management Protocol (MGMP)

Answer

Internet Key Exchange version 2 (IKEv2)