300-410 VPN Technologies Practice Test 2 — 15 Questions

Question 1

A network administrator is deploying a GET VPN solution using Cisco Group Encrypted Transport VPN. The administrator wants to ensure that the key server (KS) and group members (GMs) can successfully establish security associations. Which two statements about GET VPN are true? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The key server must be configured with a RSA key pair to authenticate group members and establish the GDOI control plane.. GET VPN relies on a key server to distribute GDOI policy including TEK and KEK to group members. The key server also uses RSA keys to secure the GDOI control plane. Group members use IPsec tunnel mode without GRE, and they can communicate directly but still depend on the key server for rekeys.

Answer

Group members use IPsec in tunnel mode to encapsulate original IP packets, preserving the original IP header for routing.

Answer

GET VPN requires the use of GRE tunnels between group members to transport encrypted traffic.

Answer

Group members can communicate directly with each other without the need for a central key server after initial key distribution.

Question 2

A network engineer is configuring a GRE tunnel between two Cisco IOS routers to carry multicast traffic. The tunnel interface is up, but multicast packets are not being forwarded. The engineer suspects that the tunnel interface needs to be enabled for multicast routing. Which command is required on the tunnel interface to allow multicast traffic to be forwarded?

Accepted Answer

ip pim sparse-mode. For multicast traffic to traverse a GRE tunnel, the tunnel interface must have PIM enabled. The ip pim sparse-mode command activates PIM-SM on the interface, allowing it to forward multicast packets. While global multicast routing must be enabled with ip multicast-routing, the interface-level PIM configuration is what actually permits multicast forwarding on the tunnel.

Answer

ip nhrp map multicast dynamic

Answer

ip multicast-routing

Answer

tunnel mode gre multipoint

Question 3

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router. The router has two VRFs: VRF-A and VRF-B. The engineer wants to encrypt traffic from VRF-A to a remote site using IPsec. Which additional configuration is required on the crypto map to support VRF-aware IPsec?

Accepted Answer

Specify the VRF name using the set vrf command under the crypto map.. To support VRF-aware IPsec, the crypto map must include the set vrf command to specify which VRF's routing table should be used for encrypted traffic. This ensures that the router looks up the remote peer and destinations in the correct VRF. Without this, the router would use the global routing table, potentially causing routing failures.

Answer

Enable VRF-aware IPsec globally with the crypto vrf command.

Answer

Configure the crypto map under the VRF-aware ISAKMP profile.

Answer

Apply the crypto map to the VRF interface instead of the physical interface.

Question 4

A network administrator is deploying a site-to-site VPN using Cisco IOS GET VPN (Group Encrypted Transport VPN) with GDOI. The key server (KS) and group members (GMs) are configured. Phase 1 and Phase 2 of GDOI are operational, and the KS has successfully pushed the policy to all GMs. However, traffic between two GMs on the same group is being dropped. The administrator verifies that the ACLs on both GMs match and that no firewall is blocking IPsec. Which action should be taken to resolve the issue?

Accepted Answer

Ensure that the GMs have the correct IPsec SA and that the KS has distributed the TEK, and verify that the GMs are using the same IPsec SA and that the traffic is being matched by the ACL and not dropped by the IPsec SA.. GET VPN relies on the KS to distribute a TEK to all GMs. Even after successful GDOI Phase 1 and Phase 2, traffic can be dropped if the TEK is not properly installed or if the IPsec SA is not correctly established on the GMs. Additionally, the ACL must match the traffic for encryption. Verifying these data plane elements is crucial to resolve the drop.

Answer

Ensure the ipsec sa policy includes the correct transform set and that the KS and GMs use the same TEK rekey parameters.

Answer

Confirm that the GMs are using the same IPsec SA and that the KS is configured with the correct rekey authentication, and ensure the GMs have the ip route for the remote subnet pointing to the tunnel.

Answer

Verify that the GMs have the same IPsec SA and that the KS has distributed the TEK, and check if the GMs are using the correct ACL for the traffic.

Question 5

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router. The router must support multiple customers, each with overlapping IP address spaces, and each customer's traffic must be encrypted separately. Which IPsec configuration element allows the router to select the correct crypto map for each VRF?

Accepted Answer

crypto map map-name 10 ipsec-isakmp vrf vrf-name. To support VRF-aware IPsec, the crypto map must be associated with a VRF using the 'vrf' keyword. This allows the router to maintain separate IPsec policies for each VRF, even with overlapping IP addresses. The crypto map is then applied to the VRF interface, ensuring that traffic from that VRF is encrypted according to its own policy.

Answer

crypto map map-name 10 ipsec-isakmp match address acl-name

Answer

crypto map map-name 10 ipsec-isakmp

Answer

crypto map map-name 10 ipsec-isakmp local-address Loopback0

Question 6

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that the VPN tunnel remains active even when there is no interesting traffic. Which configuration command should be applied to the crypto map to achieve this?

Accepted Answer

set security-association idle-time 0. To keep an IPsec VPN tunnel active without interesting traffic, the idle timeout must be disabled. The command set security-association idle-time 0 achieves this by setting the idle timer to zero, which means the security association will not expire due to lack of traffic. Other commands either set rekey timers or explicitly enable an idle timeout that would tear down the tunnel.

Answer

set security-association lifetime kilobytes 4608000

Answer

set security-association idle-time 60

Answer

set security-association lifetime seconds 3600

Question 7

A network engineer is configuring a GRE tunnel between two routers. The engineer wants to ensure that the tunnel interface remains up even if the physical interface goes down, as long as the tunnel destination is reachable via an alternative path. Which configuration is required?

Accepted Answer

Configure the tunnel source as a loopback interface and ensure the loopback is reachable via an alternative path.. To keep a GRE tunnel interface up when the physical interface fails, the tunnel source should be a loopback interface that is reachable via an alternative path. Loopback interfaces are always up, so the tunnel interface will remain up as long as the loopback is reachable. This design provides redundancy and is a best practice for GRE tunnels.

Answer

Set the tunnel mode to gre multipoint.

Answer

Configure keepalives on the tunnel interface.

Answer

Enable IPsec protection on the tunnel.

Question 8

A network administrator is troubleshooting a DMVPN Phase 3 configuration using mGRE and IPsec. Spoke-to-spoke communication fails, but spoke-to-hub communication works. The administrator verifies that NHRP registrations are successful and that the hub has a route to all spokes. Which of the following is the most likely cause?

Accepted Answer

The hub is not configured with NHRP redirect, and the spokes are not configured with NHRP shortcut.. In DMVPN Phase 3, spoke-to-spoke communication relies on NHRP redirect and shortcut. The hub must be configured with NHRP redirect to inform spokes about a better path, and spokes must have NHRP shortcut enabled to install direct routes. Without these, spokes may not establish direct tunnels and may fail to communicate if the hub is not forwarding traffic. Since spoke-to-hub works, the issue is specific to the spoke-to-spoke optimization features.

Answer

The hub does not have a route to the spokes' tunnel IP addresses.

Answer

The spokes do not have a route to the hub's tunnel IP address.

Answer

The IPsec transform set does not support the encryption algorithm used for spoke-to-spoke traffic.

Question 9

A network engineer is deploying a DMVPN Phase 3 network with IPsec protection. The engineer wants to ensure that spoke-to-spoke traffic is encrypted and that spokes can dynamically create direct tunnels. Which two configurations are required on the spoke routers? (Choose two.)

Accepted Answer

Configure the spoke's tunnel interface with the same IPsec profile as the hub.. On DMVPN Phase 3 spokes, NHRP shortcut is required to act on redirect messages from the hub and create direct tunnels. Additionally, the spoke must use the same IPsec profile as the hub to ensure consistent encryption. These two configurations enable secure dynamic spoke-to-spoke communication.

Answer

Configure the spoke's tunnel interface with a unique NHRP network ID.

Answer

Enable NHRP redirect on the spoke's tunnel interface.

Answer

Configure the spoke's tunnel interface as a point-to-point GRE tunnel.

Question 10

A network engineer is deploying a GET VPN solution using Cisco IOS routers. The engineer wants to ensure that the group members can communicate securely over the public internet while maintaining any-to-any connectivity. Which two components are required in a GET VPN deployment? (Choose two.)

Accepted Answer

Group member (GM). A GET VPN deployment requires a key server to manage keys and policies, and group members to encrypt and decrypt traffic. The key server distributes group keys, and group members use them to secure communication. Other components like CA or GDOI server are either optional or protocol names, not core components.

Answer

Group domain of interpretation (GDOI) server

Answer

Certificate authority (CA)

Answer

Dynamic multipoint VPN (DMVPN) hub

Question 11

A network engineer is configuring a DMVPN Phase 2 network with EIGRP as the routing protocol. The hub router is configured with a multipoint GRE tunnel interface. Spoke routers are configured with point-to-point GRE tunnels to the hub. The engineer wants to ensure that spoke routers can dynamically learn the hub's tunnel IP address and register with NHRP. Which two commands are required on the spoke routers to achieve this? (Choose two.)

Accepted Answer

ip nhrp nhs 10.0.0.1. On DMVPN spoke routers, the ip nhrp nhs command identifies the hub as the next hop server, and the ip nhrp map command statically maps the hub's tunnel IP to its public NBMA address. Together, these commands allow the spoke to send NHRP registration requests to the hub and to resolve the hub's address for tunnel establishment. Without both, the spoke cannot register or communicate with the hub, breaking the DMVPN.

Answer

ip nhrp registration timeout 100

Answer

ip nhrp network-id 1

Answer

ip nhrp redirect

Question 12

A network engineer is configuring a site-to-site VPN using Cisco IOS XE FlexVPN with IKEv2. The engineer wants to ensure that the spoke router can dynamically obtain its IP address from the hub and that the hub can authenticate the spoke using pre-shared keys. Which two commands are required on the spoke router to achieve these goals? (Choose two.)

Accepted Answer

crypto ikev2 profile IKEv2-PROF. To enable a FlexVPN spoke to authenticate using pre-shared keys and dynamically obtain an IP address, the spoke must have an IKEv2 profile that specifies the pre-shared key and a matching IPsec profile that defines the data protection. The IKEv2 profile is used during IKEv2 negotiation, and the IPsec profile is referenced on the tunnel interface to protect traffic. The combination of these two profiles allows the spoke to initiate the VPN and receive configuration from the hub.

Answer

crypto ikev2 authorization policy default

Answer

crypto ikev2 keyring KEYRING

Answer

crypto ikev2 client flexvpn FLEXVPN-CLIENT

Question 13

A network engineer is configuring a FlexVPN hub-and-spoke topology using IKEv2. The engineer wants to ensure that spoke routers can authenticate using digital certificates and that the hub can dynamically assign IP addresses to spokes from a local pool. Which IKEv2 configuration element is required on the hub to enable dynamic IP address assignment?

Accepted Answer

crypto ikev2 authorization policy default. In FlexVPN with IKEv2, dynamic IP address assignment is achieved by configuring an IKEv2 authorization policy that references a local IP pool. The policy is then applied in the IKEv2 profile. The authorization policy is the key element that ties the pool to the IKEv2 negotiation, allowing the hub to assign addresses to spokes.

Answer

ip local pool SPOKES 10.0.0.1 10.0.0.100

Answer

crypto ikev2 profile FLEX

Answer

aaa authorization network default local

Question 14

A network engineer is configuring a GRE over IPsec tunnel between two Cisco IOS routers. The engineer wants to ensure that the tunnel interface is protected by IPsec and that routing protocols can run over the tunnel. Which two commands are required on both routers to complete this configuration? (Choose two.)

Accepted Answer

crypto map MYMAP 10 ipsec-isakmp. To configure GRE over IPsec using crypto maps, you must define a transform set to specify encryption and authentication algorithms, and a crypto map to tie together the peer, ACL, and transform set. The ACL must permit GRE traffic between tunnel endpoints. These commands are required on both routers to ensure IPsec protection. The tunnel interface itself is configured with GRE encapsulation and an IP address, but that alone does not encrypt the traffic.

Answer

tunnel mode gre ip

Answer

tunnel protection ipsec profile MYPROFILE

Answer

interface tunnel 0

Question 15

An engineer is deploying a site-to-site VPN using Cisco IOS routers. The requirement is to use a technology that provides encryption and supports multicast traffic over the VPN without additional configuration. Which VPN technology should be used?

Accepted Answer

DMVPN with IPsec tunnel protection. DMVPN with IPsec tunnel protection uses GRE, which natively supports multicast. This allows multicast traffic to traverse the VPN without extra configuration. Other options either require additional multicast configuration or are not designed for multicast support. Thus, DMVPN with IPsec is the correct choice for the given requirement.

Answer

IPsec VTI

Answer

GET VPN

Answer

FlexVPN with IKEv2