300-410 VPN Technologies Practice Test 3 — 15 Questions

Question 1

A network administrator is configuring a DMVPN Phase 2 hub-and-spoke network. The hub is configured with `ip nhrp map multicast dynamic` and `ip nhrp network-id 1`. Spokes are configured with `ip nhrp map

`, `ip nhrp map multicast `, and `ip nhrp nhs `. Which additional command is required on the spokes to enable spoke-to-spoke communication in Phase 2?

Accepted Answer

ip nhrp network-id 1. For DMVPN to function, all routers in the same cloud must use the same NHRP network-id. The hub is configured with network-id 1, but the spokes lack it. Without a matching network-id, NHRP packets are ignored, and spokes cannot register or resolve each other's addresses. Thus, configuring `ip nhrp network-id 1` on the spokes is essential for spoke-to-spoke communication in Phase 2.

Answer

ip nhrp redirect

Answer

ip nhrp shortcut

Answer

ip nhrp holdtime 300

Question 2

A network administrator is troubleshooting a DMVPN Phase 3 deployment. Spoke routers are unable to establish direct spoke-to-spoke tunnels; all traffic between spokes is going through the hub. The hub is configured with 'ip nhrp redirect' and spokes with 'ip nhrp shortcut'. Which additional configuration is required on the spokes to enable direct spoke-to-spoke communication?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub uses 'ip nhrp redirect' to notify spokes of a better path, and spokes use 'ip nhrp shortcut' to install shortcut routes. However, for the spoke to process the redirect message and initiate a direct tunnel, it must also have 'ip nhrp redirect' configured. Without it, the spoke cannot handle the redirect and continues sending traffic through the hub.

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp nhs 10.0.0.1 nbma 192.0.2.1 multicast

Answer

ip nhrp network-id 100

Question 3

A network administrator is configuring a DMVPN Phase 2 hub-and-spoke network. The hub is configured with `ip nhrp map multicast dynamic` and `ip nhrp network-id 1`. Spokes are configured with `ip nhrp map <hub-tunnel-ip> <hub-nbma-ip>`, `ip nhrp map multicast <hub-nbma-ip>`, and `ip nhrp nhs <hub-tunnel-ip>`. Which additional command is required on the spokes to enable spoke-to-spoke communication in Phase 2?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

crypto isakmp policy 10; encryption aes; hash sha256; authentication pre-share. The IKE policy is configured with the crypto isakmp policy command, followed by parameters like encryption, hash, and authentication. To meet the requirements, the policy must specify AES encryption, SHA-256 hashing, and pre-shared key authentication. The correct set of commands includes all these elements in the proper context. The other options either use weaker algorithms, configure phase 2 instead of phase 1, or only set the pre-shared key without policy parameters.

Answer

crypto ipsec transform-set MYSET esp-aes esp-sha256-hmac

Answer

crypto isakmp policy 10; encryption 3des; hash sha; authentication pre-share

Answer

crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0

Question 4

A network administrator is troubleshooting a DMVPN Phase 2 network where spoke-to-spoke communication is failing. The hub is configured correctly, and the spokes have established tunnels to the hub. The administrator notices that the spokes are not learning each other's routes. Which configuration is missing on the spoke routers?

Accepted Answer

ip nhrp map multicast <hub-tunnel-ip>. In DMVPN Phase 2, spokes establish tunnels only to the hub and rely on the hub to forward traffic between spokes. For dynamic routing protocols to work over the tunnel, multicast packets must be sent from the spoke to the hub. The ip nhrp map multicast command on the spoke maps the hub's tunnel IP to its NBMA address for multicast traffic. Without this, the spoke cannot send multicast hellos to the hub, and routing adjacencies fail, preventing route learning.

Answer

ip nhrp redirect

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp shortcut

Question 5

A network engineer is deploying a DMVPN Phase 2 network with IPsec protection. The engineer wants to ensure that spoke-to-spoke traffic can be established directly without traversing the hub. Which two of the following configurations are required on the spokes to enable direct spoke-to-spoke tunnels? (Choose two.)

Accepted Answer

The spokes must have a route to the destination spoke's tunnel IP address via the hub.. In DMVPN Phase 2, direct spoke-to-spoke tunnels are established when a spoke sends an NHRP resolution request for the destination spoke's tunnel IP. For this to work, the spoke must have a route to the destination spoke's tunnel IP (often via a default route to the hub) and must have the correct IPsec profile to encrypt the traffic. NHRP shortcut and redirect are Phase 3 features, and static mappings are not used.

Answer

The spokes must be configured with NHRP shortcut.

Answer

The spokes must be configured with NHRP redirect.

Answer

The spokes must have a static NHRP mapping for every other spoke's tunnel IP address.

Question 6

A network engineer is troubleshooting a DMVPN Phase 2 network where spoke-to-spoke communication is not working. The hub router is configured correctly with mGRE and NHRP. Spoke routers are configured with tunnel mode gre multipoint and NHRP. The engineer notices that NHRP resolution requests from one spoke to another are failing. Which action should the engineer take to resolve this issue?

Accepted Answer

Ensure that the spokes have a route to the destination spoke's tunnel network via the hub.. In DMVPN Phase 2, spoke-to-spoke communication relies on the spokes having a route to the destination spoke's tunnel network via the hub. This route allows the spoke to forward the initial packet to the hub, which then triggers NHRP resolution. Without this route, the spoke cannot initiate the NHRP request, and direct spoke-to-spoke tunnels are not established.

Answer

Verify that the hub is configured with NHRP redirect and shortcut switching.

Answer

Change the tunnel mode to gre ip on the spokes.

Answer

Configure NHRP authentication on all spokes and the hub.

Question 7

A network engineer is deploying DMVPN Phase 2 with EIGRP as the routing protocol. The engineer notices that spoke-to-spoke communication is not working, and the spokes are not forming direct tunnels. Which configuration change is required on the hub to allow spoke-to-spoke communication?

Accepted Answer

Disable split horizon on the hub's tunnel interface.. In DMVPN Phase 2, the hub must propagate routes between spokes. EIGRP split horizon, enabled by default, prevents the hub from advertising routes learned from one spoke to another. Disabling split horizon on the hub's tunnel interface allows the hub to advertise spoke routes to other spokes, enabling them to establish direct tunnels. Without this, spokes only have a default route or summary to the hub and cannot reach other spokes directly.

Answer

Change the tunnel mode to GRE multipoint on the spokes.

Answer

Enable NHRP redirect on the hub.

Answer

Configure 'ip nhrp shortcut' on the hub.

Question 8

A network engineer is deploying a FlexVPN solution using Cisco IOS headend and branch routers. The engineer wants to use IKEv2 and IPsec to provide secure connectivity. The headend is configured with a virtual-template and IKEv2 profile. The branch routers are configured with IKEv2 and IPsec. After configuration, the branch routers fail to establish IKEv2 security associations with the headend. Which two actions should the engineer take to troubleshoot the issue? (Choose two.)

Accepted Answer

Verify that the IKEv2 proposal, policy, and keyring are correctly configured and match on both peers.. IKEv2 SA establishment requires matching proposals, policies, and keyrings on both peers. Additionally, on the headend, the virtual-template must be correctly associated with the IKEv2 profile, which specifies authentication and keyring. These two actions directly address the most common causes of IKEv2 SA failure. Checking transform sets or generic connectivity is either premature or too broad.

Answer

Ensure that the IPsec transform set is identical on both peers, including the encapsulation mode (tunnel or transport).

Answer

Check that the IKEv2 profile on the headend is configured with the correct match criteria for the branch's identity, such as FQDN or IP address.

Answer

Verify that the branch routers have a route to the headend's public IP address and that no firewall is blocking UDP ports 500 and 4500.

Question 9

A network engineer is configuring a GRE over IPsec tunnel between two Cisco IOS routers. The engineer wants to ensure that multicast traffic, such as OSPF hello packets, is encrypted and forwarded across the tunnel. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Configure a crypto map with 'set peer' and 'set transform-set' and apply it to the physical interface.. To carry multicast traffic such as OSPF hellos over an IPsec tunnel, GRE encapsulation is required because IPsec does not support multicast. The GRE tunnel interface encapsulates the multicast packets, and then the physical interface encrypts the GRE packets using a crypto map. Thus, the two required configurations are a GRE tunnel interface with 'tunnel mode gre ip' and a crypto map applied to the physical interface.

Answer

Enable 'crypto ipsec profile' on the tunnel interface.

Answer

Apply a crypto map to the GRE tunnel interface.

Answer

Configure 'ip nhrp map multicast dynamic' on the hub.

Question 10

A network administrator is setting up a DMVPN Phase 2 network. The hub router must be able to dynamically learn the public IP addresses of spokes. Which command should be configured on the hub to enable this?

Accepted Answer

ip nhrp map multicast dynamic. The hub uses 'ip nhrp map multicast dynamic' to dynamically learn the NBMA addresses of spokes for multicast replication. This allows routing protocol hellos to be sent to all spokes without static configuration. The other commands are either static mappings or unrelated to dynamic learning.

Answer

ip nhrp map multicast 224.0.0.5

Answer

ip nhrp registration no-unique

Answer

ip nhrp network-id 1

Question 11

A network administrator is configuring a FlexVPN site-to-site tunnel between two Cisco IOS routers. The administrator wants to use IKEv2 and wants to ensure that the tunnel uses a pre-shared key for authentication. Which command is used to configure the pre-shared key on the local router?

Accepted Answer

crypto ikev2 keyring KEYRING. For FlexVPN with IKEv2, pre-shared keys are configured using a keyring via the crypto ikev2 keyring command. The keyring contains peer definitions and their associated keys. The IKEv2 profile then references this keyring. This approach separates key management from the profile, allowing flexibility. IKEv1 commands like crypto isakmp key are not used in IKEv2 deployments.

Answer

crypto isakmp key KEY address 0.0.0.0 0.0.0.0

Answer

crypto ipsec profile IPSEC-PROFILE

Answer

crypto ikev2 profile PROFILE

Question 12

A network engineer is deploying a DMVPN Phase 2 network with EIGRP as the routing protocol. The hub router is configured with 'ip nhrp map multicast dynamic' and 'ip nhrp network-id 1'. Spokes are configured with 'ip nhrp nhs nbma multicast' and 'ip nhrp network-id 1'. However, spoke-to-spoke communication is not working; spokes can only reach the hub. Which configuration change is most likely to resolve the issue?

Accepted Answer

Disable split horizon on the hub's tunnel interface.. In DMVPN Phase 2, spoke-to-spoke communication relies on the hub forwarding routing updates between spokes. If split horizon is enabled on the hub's tunnel interface, the hub will not advertise routes learned from one spoke to another, preventing direct spoke-to-spoke tunnels. Disabling split horizon on the hub's tunnel interface resolves this issue.

Answer

Configure 'ip nhrp map multicast dynamic' on the spokes.

Answer

Enable 'ip nhrp redirect' on the hub and 'ip nhrp shortcut' on the spokes.

Answer

Change the network-id on the spokes to match the hub.

Question 13

A network engineer is configuring a site-to-site GRE over IPsec tunnel between two Cisco IOS routers. The engineer wants to protect the GRE traffic with IPsec while allowing multicast routing protocols to run over the tunnel. Which configuration is required to achieve this?

Accepted Answer

Apply the crypto map to the GRE tunnel interface.. To protect GRE traffic with IPsec while allowing multicast, the crypto map must be applied to the GRE tunnel interface. This ensures that the GRE packets are encrypted after encapsulation, and the inner packets (including multicast) are carried over the tunnel. Applying the crypto map to the physical interface would encrypt all traffic and prevent GRE encapsulation.

Answer

Configure IPsec in transport mode on the physical interface.

Answer

Apply the crypto map to the physical interface that carries the GRE traffic.

Answer

Use a dynamic VTI and apply the IPsec profile to the physical interface.

Question 14

A network engineer is configuring a site-to-site VPN between two Cisco IOS routers. The engineer wants to use VTI-based IPsec with IKEv2 for its simplicity and support for dynamic routing protocols. After applying the configuration, the engineer notices that the tunnel interface is up, but no traffic is passing through. The engineer verifies that the IKEv2 proposal and keyring are correct, and the IPsec profile is applied to the tunnel interface. What is the most likely cause of the issue?

Accepted Answer

The IPsec profile is missing the set transform-set command.. For VTI-based IPsec, the IPsec profile must reference a transform set to define the encryption and integrity algorithms. Without the transform set, the router cannot establish the IPsec security association, so traffic is dropped even though the tunnel interface remains up. The other components like IKEv2 profile and keyring are necessary for IKEv2 negotiation, but the transform set is essential for the IPsec SA.

Answer

The IKEv2 keyring is missing the pre-shared-key command.

Answer

The crypto ipsec profile is missing the set ikev2-profile command.

Answer

The tunnel destination is not reachable.

Question 15

A network engineer is configuring a VRF-lite environment to support overlapping IP addresses for two customers. The engineer must ensure that traffic from each VRF is isolated and that each VRF can reach the global routing table if needed. Which two commands are required to allow communication between a VRF and the global routing table? (Choose two.)

Accepted Answer

ip route vrf 0.0.0.0 0.0.0.0 global. To allow a VRF to communicate with the global routing table, you can configure a static default route within the VRF that points to a global next-hop. The commands 'ip route vrf 0.0.0.0 0.0.0.0 global' and 'ip route vrf 0.0.0.0 0.0.0.0 ' both achieve this. The 'global' keyword explicitly forces next-hop resolution in the global table, while without it, the router may still resolve in the global table if no VRF-specific route exists.

Answer

import map

Answer

ip vrf forwarding

Answer

ip route 0.0.0.0 0.0.0.0 vrf