300-410 VPN Technologies Practice Test 11 — 15 Questions

Question 1

A network engineer is configuring a DMVPN Phase 3 network with mGRE and NHRP. The hub router must be able to dynamically learn spoke routes and advertise them to other spokes. Which two statements are true regarding the configuration of the hub to support spoke-to-spoke communication in DMVPN Phase 3? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The hub must have a route to all spoke networks, either through a routing protocol or summary route.. In DMVPN Phase 3, the hub must be configured with 'ip nhrp redirect' to inform spokes of a better direct path, and it must have a route to all spoke networks to provide initial connectivity and forwarding. The spokes require 'ip nhrp shortcut' to act on redirects. The other options are either not specific to Phase 3 or are configured on spokes.

Answer

The hub must have 'ip nhrp shortcut' configured on its tunnel interface.

Answer

The hub must have 'ip nhrp network-id' configured with the same value as the spokes.

Answer

The hub must have 'ip nhrp map multicast dynamic' configured to support multicast traffic.

Question 2

A network engineer is deploying GET VPN across an MPLS L3VPN service provider network. The key server is reachable by all group members, and the engineer wants to avoid rekeying storms when many group members reboot simultaneously after a power outage. Which mechanism should the engineer configure on the key server to spread rekey retransmissions over a period of time?

Accepted Answer

Configure the key server with a rekey retransmit interval and a retransmit limit, and enable the rekey acknowledgment feature so members request unicast retransmissions.. The key server in GET VPN distributes the group key via multicast and then uses reliable rekey retransmission with acknowledgment to unicast the rekey to members that did not receive it. Configuring a retransmit interval and retransmit limit spreads those unicast retransmissions over time, so a large number of members rebooting simultaneously do not overload the key server. This preserves key synchronization across the group without disabling the reliability mechanism that guarantees delivery.

Answer

Configure the key server with a rekey retransmit interval and disable the rekey acknowledgment, forcing members to pull rekeys at randomized intervals.

Answer

Configure the group members with a longer registration timeout so they wait longer before contacting the key server after reboot.

Answer

Configure the key server to use a shorter rekey lifetime so that keys expire quickly and members are forced to re-register frequently.

Question 3

A network administrator is deploying FlexVPN between a Cisco IOS headend and several remote spokes. The design requires that each spoke be assigned a unique virtual IP address from a pool on the headend, and that the headend pushes a specific DNS server address to each spoke during IKEv2 negotiation. Which configuration element on the headend provides the DNS server address to the spokes?

Accepted Answer

An IKEv2 authorization policy that specifies the DNS server and is referenced by the IKEv2 profile.. FlexVPN uses IKEv2 configuration attributes to deliver parameters such as virtual IP addresses, DNS servers, and split-tunnel information to spokes. The headend's IKEv2 authorization policy defines these attributes, and the IKEv2 profile references the authorization policy so the values are returned during IKE_AUTH. The local IP pool supplies addresses, but the DNS server specifically comes from the authorization policy, making it the correct element for the stated requirement.

Answer

A crypto pki trustpoint that includes the DNS server in the certificate subject alternative name field.

Answer

A local IP pool configured with the ip local pool command and referenced under the virtual-template interface.

Answer

A dynamic routing protocol such as OSPF configured on the virtual-template interface to advertise the DNS server.

Question 4

A network administrator is troubleshooting an IPsec VPN tunnel between two Cisco IOS routers using IKEv2. Phase 1 is up, but Phase 2 fails to establish. The administrator runs 'show crypto ipsec sa' and sees no active SAs. Which action should the administrator take to resolve the issue?

Accepted Answer

Verify that the IPsec transform set or profile matches on both peers.. Phase 2 failure with no active SAs typically indicates a mismatch in the IPsec transform set or profile. Since Phase 1 is up, IKEv2 parameters like the proposal and pre-shared key are correct. The crypto ACL defines interesting traffic but does not prevent SA establishment. Therefore, verifying the transform set or profile match is the correct action.

Answer

Verify that the IKEv2 proposal matches on both peers.

Answer

Ensure that the crypto ACL or IPsec profile matches the traffic to be encrypted.

Answer

Check that the IKEv2 keyring contains the correct pre-shared key.

Question 5

A network engineer is troubleshooting a Cisco IOS FlexVPN IKEv2 hub that terminates many spokes using a single IKEv2 profile. A new spoke fails to complete IKEv2 authentication even though the same pre-shared key is configured on both peers. The hub logs show the failure occurs during IKE_AUTH. The spoke is not sending a certificate and there is no local AAA authentication configured on the hub for IKEv2. Which configuration change on the hub is most likely to resolve the authentication failure?

Accepted Answer

Add the spoke's identity to the IKEv2 keyring as a peer entry with the matching pre-shared key. Cisco IOS IKEv2 pre-shared key authentication relies on the IKEv2 keyring to look up the key associated with the peer's identity. The IKEv2 profile references the keyring, but the key itself must exist in a peer or subnet entry that matches the spoke. Because no AAA authentication is configured, the keyring is the only source of the key, so adding the spoke identity with the matching key fixes the IKE_AUTH failure.

Answer

Configure a local AAA authorization list on the IKEv2 profile to authorize the spoke's group policy

Answer

Bind the IKEv2 profile to a virtual template interface used for the spoke's virtual access interface

Answer

Enable RSA signature authentication on the IKEv2 profile so the hub can validate the spoke without a keyring

Question 6

A network administrator is troubleshooting a DMVPN Phase 3 network. Spokes register with the hub, and routing adjacencies are up. However, spoke-to-spoke traffic is not taking the optimal path; it still goes through the hub. The hub is configured with `ip nhrp redirect` and `ip nhrp map multicast dynamic`. The administrator verifies that the spokes have `ip nhrp shortcut` configured. What is the most likely cause?

Accepted Answer

The routing protocol is not advertising specific routes to the spokes.. In DMVPN Phase 3, the hub uses `ip nhrp redirect` to inform spokes of a better path, but spokes also need a specific route to the destination to trigger NHRP resolution. If the hub only advertises a default route or summary, spokes lack the specific route and continue forwarding through the hub. Advertising specific routes from the hub enables spokes to resolve next hops and build direct tunnels.

Answer

The spokes are not configured with `ip nhrp redirect`.

Answer

The hub is not configured with `ip nhrp summary-map`.

Answer

The spokes are not configured with `ip nhrp network-id`.

Question 7

A network engineer is implementing a DMVPN Phase 3 network with NHRP and mGRE on the hub. The design requires that spoke-to-spoke traffic be able to bypass the hub after resolution, and that the hub not be required to advertise specific routes to the spokes. Which two configuration elements are required to achieve shortcut switching and default-route-only behavior on the spokes? (Choose two.)

Accepted Answer

Configure the hub to summarize or advertise a default route to the spokes, and configure the spokes to use the hub as their default gateway.. DMVPN Phase 3 combines a hub-advertised default route with NHRP redirect and shortcut switching. The spokes point their default route at the hub, so unknown destinations initially go through the hub. When the hub sees traffic that could take a better path, NHRP redirect tells the source spoke to resolve the destination, and NHRP shortcut installs a direct route. This yields small spoke routing tables plus optimized spoke-to-spoke paths.

Answer

Disable NHRP shortcut on the spokes so they always forward through the hub first.

Answer

Configure the spokes with a static NHRP map for every other spoke in the topology.

Answer

Configure the hub with a route map that tags the default route so spokes prefer the hub path over shortcuts.

Question 8

A network engineer is deploying DMVPN Phase 3 with NHRP and wants spoke-to-spoke traffic to be built directly between spokes without traversing the hub after initial resolution. On the hub router, the engineer issues the command 'ip nhrp redirect' on the tunnel interface and 'ip nhrp shortcut' on each spoke tunnel interface. After configuration, spokes can reach the hub but spoke-to-spoke traffic still hairpins through the hub. Which additional configuration is required on the spoke routers for the shortcut path to be installed?

Accepted Answer

Ensure the routing protocol on the spokes has a route to the destination spoke's tunnel network, typically via a summary or default from the hub, so traffic triggers NHRP resolution.. DMVPN Phase 3 shortcut switching requires the spoke to have a route covering the remote spoke prefix so that forwarded traffic triggers an NHRP resolution. The hub uses 'ip nhrp redirect' to notify spokes of a better path, and the spoke uses 'ip nhrp shortcut' to act on that notification. Without a route toward the destination spoke network, the spoke never originates the resolution and the shortcut never installs.

Answer

Enable 'ip nhrp map multicast dynamic' on the spoke tunnel interfaces.

Answer

Enable 'ip nhrp network-id' with the same value on all spoke tunnel interfaces.

Answer

Configure the tunnel interface with 'ip nhrp nhs <hub-NBMA>' so the spoke registers to the hub.

Question 9

A network administrator is setting up a site-to-site VPN between two Cisco IOS routers and wants to use IKEv2 with certificate-based authentication. The administrator has already installed the identity certificate and the CA certificate on both routers. Which additional configuration is required on each router so that IKEv2 can validate the peer's certificate during the IKE_AUTH exchange?

Accepted Answer

Reference the PKI trustpoint in the IKEv2 profile using the pki trustpoint command so the router knows which CA to use for validation.. IKEv2 certificate authentication requires the router to select a trustpoint that identifies its own certificate and the CA chain used to validate the peer. The pki trustpoint command under the IKEv2 profile provides that binding. With the trustpoint referenced, the router can present its identity certificate and verify the peer's certificate during IKE_AUTH, completing authentication even though the certificates were already installed.

Answer

Configure a pre-shared key on both routers as a fallback in case certificate validation fails.

Answer

Configure the IKEv2 profile with the authentication local rsa-sig command only, without referencing a trustpoint.

Answer

Enable the crypto pki server on both routers so each can issue certificates to the other.

Question 10

A network engineer is implementing GET VPN using GDOI on Cisco IOS routers. The key server must distribute the group policy, and the group members must register and receive rekey messages. The engineer needs to verify which components are required for the group members to successfully join the group and decrypt traffic. (Choose two.)

Accepted Answer

Group members must be configured with the group identity and a matching GDOI group configuration referencing the key server.. GET VPN GDOI group members must be configured with the correct group identity and key server reference, and they must successfully register to receive the KEK and TEK from the key server. These two elements are fundamental: the local group configuration identifies which key server to contact, and successful registration provides the keys needed to decrypt the group's encrypted traffic. Authentication uses IKEv1 rather than IKEv2 with a CA, and the encryption ACL comes from the downloaded policy.

Answer

Group members must have a static VRF configured to isolate the GET VPN traffic from the global routing table.

Answer

Group members must be configured with the same ACL as the key server to define interesting traffic for the encryption policy.

Answer

Group members must have IKEv2 configured with a certificate authority to authenticate to the key server.

Question 11

A network administrator is troubleshooting a site-to-site IPsec VPN between two Cisco IOS routers using IKEv1. Phase 1 completes successfully, but Phase 2 fails with the message 'QM_IDLE' and no IPSec SA is established. The administrator verifies that the transform sets on both peers contain matching encryption and hash algorithms. Which configuration mismatch is the most likely cause of the Phase 2 failure?

Accepted Answer

The crypto ACLs on the two peers do not mirror each other for the interesting traffic.. In IKEv1, Phase 2 quick mode negotiates the IPSec SA using proxy identities derived from the crypto ACLs. These ACLs must be mirror images between peers so that the source and destination selectors align. If they do not mirror each other, quick mode fails and no IPSec SA is created, even though Phase 1 is established and transform sets match.

Answer

The ISAKMP policy priority numbers are different on the two peers.

Answer

The IKEv1 aggressive mode is enabled on one peer but not the other.

Answer

The pre-shared keys on the two peers do not match.

Question 12

A network engineer is deploying a GET VPN solution across an MPLS L3VPN service provider network. The design requires that all group members use identical encryption keys and that the key server remain the single point of rekey distribution. The engineer must choose the protocol the key server uses to push rekey messages to group members. Which protocol should be configured for this purpose?

Accepted Answer

Group Domain of Interpretation (GDOI). GET VPN uses the Group Domain of Interpretation so that a key server can distribute a shared Group Security Association and push rekey messages to all group members. Members register with the key server, obtain the same keys and policies, and then encrypt traffic directly with one another over the provider network without building point-to-point tunnels. This preserves the any-to-any model and keeps rekeying centralized on the key server.

Answer

IKEv2 with a hub-and-spoke profile on the key server

Answer

IPsec SA negotiation using ISAKMP aggressive mode

Answer

NHRP with a next-hop server mapping

Question 13

A network administrator is troubleshooting a site-to-site IPsec VPN between two Cisco IOS routers. IKEv1 Phase 1 completes and the peer is authenticated, but the administrator sees that no IPsec SA is installed and interesting traffic is dropped. The administrator confirms the transform sets, ACLs, and pre-shared keys match on both sides. Which configuration element should the administrator verify next on both routers?

Accepted Answer

The Phase 2 proposal parameters, including encryption, hash, and PFS group. When IKE Phase 1 succeeds but no IPsec SA appears, the failure is almost always in the Phase 2 exchange. Both peers must agree on identical IPsec proposal parameters: encryption, integrity or hash, and the PFS Diffie-Hellman group if enabled. A single mismatch in any of these causes the responder to reject quick mode, leaving Phase 1 up while interesting traffic is dropped.

Answer

The crypto map sequence numbers and the ACL referenced by each map

Answer

The IKEv1 Phase 1 lifetime values on each peer

Answer

The routing table entries for the remote protected subnet

Question 14

A network engineer is deploying a DMVPN Phase 3 hub-and-spoke topology using mGRE and NHRP, and wants spokes to reach other spokes directly without routing through the hub for every packet. The engineer must configure the hub so that it advertises a default route to the spokes while still allowing spoke-to-spoke shortcut tunnels. (Choose two.)

Accepted Answer

Enable NHRP redirect on the hub so it can inform spokes of a better path to the destination.. DMVPN Phase 3 achieves spoke-to-spoke shortcuts through two cooperating NHRP features. The hub enables NHRP redirect so it can tell a spoke that a better path exists, and each spoke enables NHRP shortcut so it can resolve the destination and install a temporary direct route. Together these allow direct tunnels while the hub still advertises a summarizable default route to all spokes.

Answer

Disable split horizon on the hub's mGRE interface to allow spoke routes to be re-advertised.

Answer

Configure the hub with a default route pointing to the provider and redistribute it into the routing protocol with a metric that spokes accept.

Answer

Configure the spokes with a static route for every remote spoke subnet pointing at the hub.

Question 15

A network engineer is deploying GET VPN with Cisco IOS routers to provide any-to-any encrypted communication over a private MPLS WAN. The design requires that a router joining the group automatically receives the current group security policy from the group controller without any manual pre-shared key configuration on the member. Which protocol should the engineer configure to dynamically distribute the group encryption keys from the key server to the group members?

Accepted Answer

GDOI. GET VPN relies on GDOI for group key management. The key server (group controller/key server) distributes the group security policy and encryption keys to registered group members via rekey messages, enabling scalable any-to-any encryption over a private WAN without point-to-point tunnels. GDOI is the protocol that dynamically distributes the group encryption keys, satisfying the requirement for automatic key delivery without manual pre-shared key configuration on each member.

Answer

IKEv2

Answer

ISAKMP

Answer

NHRP