300-410 VPN Technologies Practice Test 4 — 15 Questions

Question 1

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which of the following configurations correctly defines the interesting traffic for this VPN?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

crypto map MYMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set MYSET
 match address 100
access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255. The correct configuration uses an extended ACL that permits IP traffic from the local subnet 10.1.1.0/24 to the remote subnet 10.2.2.0/24. The crypto map references this ACL with 'match address', so only traffic matching these criteria is encrypted. Other options either match too broadly (any any or any destination) or use incorrect wildcard masks that do not match the entire subnets.

Answer

crypto map MYMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set MYSET
 match address 100
access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
access-list 100 deny ip any any

Answer

crypto map MYMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set MYSET
 match address 100
access-list 100 permit ip 10.1.1.0 0.0.0.255 any

Answer

crypto map MYMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set MYSET
 match address 100
access-list 100 permit ip any any

Question 2

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which of the following configurations correctly defines the interesting traffic for this VPN?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip local pool. To define an IP address pool for Easy VPN clients on the server, the ip local pool command is used. This creates a pool of addresses that can be assigned to clients. The pool is then referenced in the ISAKMP group configuration with the crypto isakmp client configuration address-pool local command. This allows the server to assign addresses dynamically to connecting clients.

Answer

crypto map client configuration address-pool

Answer

ip address-pool

Answer

crypto isakmp client configuration address-pool local

Question 3

A network engineer is configuring a VTI-based IPsec VPN between two Cisco routers. The engineer wants to enable dynamic routing over the VPN using OSPF. Which configuration is necessary on the VTI interface to allow OSPF to form an adjacency?

Accepted Answer

Assign an IP address to the VTI interface.. To run OSPF over a VTI, the VTI interface must have an IP address. This allows OSPF to send and receive hellos and form an adjacency. Other options like point-to-point network type can be helpful but are not mandatory. Passive would prevent adjacency, and non-broadcast would require manual neighbors.

Answer

Configure the VTI interface as passive.

Answer

Set the OSPF network type to non-broadcast.

Answer

Configure the VTI interface as a point-to-point network type.

Question 4

A network administrator is troubleshooting an IPsec VPN between two Cisco routers. The VPN tunnel is up, but traffic from the local network to the remote network is not passing through the tunnel. The administrator notices that the IPsec SA counters are incrementing, but the remote router is not receiving the traffic. Which of the following is the most likely cause?

Accepted Answer

The IPsec SA is encrypting packets, but the packets are being dropped due to an ACL on the remote router's outside interface.. The symptom of incrementing IPsec SA counters on the local router while the remote router does not receive traffic indicates that the local router is encrypting and sending packets, but they are being dropped in transit or at the remote router. An ACL on the remote router's outside interface that blocks IPsec protocols (ESP, AH, or IKE) would cause this. Other options would prevent the tunnel from coming up or affect return traffic, but not inbound encrypted packets.

Answer

The crypto ACL on the local router is misconfigured, causing traffic to be sent unencrypted.

Answer

The transform set on the local router does not match the remote router, causing packets to be dropped.

Answer

The routing on the remote router does not have a route back to the local network, so return traffic is not sent.

Question 5

A network engineer is configuring a GRE over IPsec tunnel between two Cisco routers. The engineer wants to ensure that the GRE tunnel remains up even if the IPsec tunnel goes down, to allow dynamic routing protocols to detect failures quickly. Which configuration is most appropriate?

Accepted Answer

Configure the GRE tunnel to use the IPsec tunnel as its transport and enable routing protocol hellos with IPsec state tracking.. To allow dynamic routing protocols to detect IPsec failures quickly, you can use IPsec state tracking to bring down the routing adjacency when IPsec fails. This is often done by configuring the routing protocol to track the IPsec tunnel state or by using object tracking. The GRE tunnel itself will go down if IPsec fails, but the key is to ensure that the routing protocol reacts promptly. The correct approach involves using IPsec state tracking in conjunction with routing protocol hellos.

Answer

Configure the GRE tunnel with keepalives and adjust the keepalive interval and retries.

Answer

Configure IPsec to use a static VTI and enable tunnel protection on the GRE tunnel.

Answer

Configure the GRE tunnel interface to be independent of IPsec by using a separate physical interface for GRE.

Question 6

A network engineer is configuring a Cisco IOS router to establish a site-to-site VPN using IKEv1. The engineer wants to ensure that the pre-shared key is encrypted when displayed in the running configuration. Which command should be used?

Accepted Answer

crypto isakmp key address password. To store IKEv1 pre-shared keys in encrypted form, the crypto isakmp key command includes the password keyword. When you enter the key after the password keyword, the router encrypts it before saving it to the configuration. This prevents the key from being visible in plain text in show running-config. The other options either do not encrypt the key or use invalid syntax.

Answer

crypto isakmp key address

Answer

crypto isakmp key address password

Answer

crypto isakmp key address encrypted

Question 7

A network engineer is troubleshooting an IPsec VPN between two Cisco IOS routers. The IKEv2 negotiation fails. The engineer has verified that the IKEv2 proposal, keyring, and profile are correctly configured on both routers. Which two additional items should the engineer check? (Choose two.)

Accepted Answer

The pre-shared key in the IKEv2 keyring matches on both peers.. IKEv2 negotiation requires that both peers agree on a proposal (encryption, integrity, PRF, DH group) and authenticate successfully. Mismatched proposals or pre-shared keys are common causes of failure. The transform set is for IPsec SA, not IKEv2, and the IPsec profile application and identity matching are part of the already-verified configuration. Therefore, the engineer should check the proposal algorithms and the pre-shared key.

Answer

The transform set is correctly referenced in the IPsec profile.

Answer

The IPsec profile is applied to the physical interface.

Answer

The IKEv2 profile matches the peer's identity.

Question 8

A network engineer is deploying DMVPN Phase 2 with OSPF as the routing protocol. The engineer wants to ensure that spoke-to-spoke communication works without traffic traversing the hub. Which two statements about the OSPF configuration are true? (Choose two.)

Accepted Answer

The spokes should be configured with 'ip ospf priority 0' to prevent them from becoming DR.. In DMVPN Phase 2 with OSPF, the tunnel network must support broadcast or point-to-multipoint to allow OSPF neighbor adjacencies. The hub should be configured with 'ip ospf network broadcast' or 'point-to-multipoint' to enable proper neighbor formation. Additionally, setting the spokes' OSPF priority to 0 prevents them from becoming DR, ensuring the hub remains DR and manages the network. This configuration facilitates spoke-to-spoke communication by allowing the hub to relay routing information and spokes to establish direct tunnels.

Answer

The hub should be configured with 'ip ospf priority 0' to ensure it never becomes DR.

Answer

Spokes must be configured with 'ip ospf network point-to-multipoint' to prevent DR election.

Answer

The hub must be configured as a designated router (DR) and spokes as non-DR.

Question 9

A network engineer is configuring DMVPN Phase 3 with OSPF. The hub router must advertise a default route to all spokes, but the spokes should not have a static default route. The engineer configures the hub with 'ip route 0.0.0.0 0.0.0.0 Null0' and 'router ospf 1' then 'default-information originate'. However, the spokes do not receive the default route. Which configuration change on the hub will resolve this issue?

Accepted Answer

Add the 'always' keyword to the 'default-information originate' command.. The hub uses a static route to Null0 to create a default route, but OSPF does not advertise a default route unless it is present in the routing table and not a discard route. The 'always' keyword overrides this check, forcing OSPF to advertise the default route even when the hub lacks a valid default route. This is a common configuration in DMVPN hubs to provide default routing to spokes.

Answer

Change the static route to point to the physical interface instead of Null0.

Answer

Configure 'default-information originate' under the OSPF process on each spoke.

Answer

Add a static route on the hub for the default route with a next-hop of the ISP router.

Question 10

A network engineer is configuring a DMVPN Phase 2 network with EIGRP as the routing protocol. The hub router must summarize the routes from all spokes into a single summary route to reduce the size of the routing table on the spokes. Which command should be configured on the hub's tunnel interface to accomplish this?

Accepted Answer

ip summary-address eigrp 1 10.0.0.0 255.0.0.0. EIGRP summarization on a DMVPN hub is configured with the 'ip summary-address eigrp' command on the tunnel interface. This advertises a summary route to the spokes, reducing their routing table size and simplifying routing. In DMVPN Phase 2, summarization is often used to allow spokes to reach all networks via the hub. The command requires the EIGRP AS number, the summary network, and the mask.

Answer

ip summary-address eigrp 1 10.0.0.0 255.0.0.0 5

Answer

ip summary-address eigrp 1 10.0.0.0 255.0.0.0 leak-map ALLOW

Answer

auto-summary

Question 11

A network administrator is configuring a GRE tunnel between two Cisco routers. The administrator wants to ensure that the tunnel interface remains up even if the physical interface goes down. Which command should be used on the tunnel interface?

Accepted Answer

tunnel source Loopback0. To keep a GRE tunnel interface up when a physical interface fails, the tunnel source should be a loopback interface. Loopback interfaces are virtual and always up, so the tunnel interface remains up as long as there is a route to the destination. This provides redundancy and stability. Using a physical interface as the source would cause the tunnel to go down if that physical interface fails.

Answer

keepalive 10 3

Answer

tunnel destination 10.1.1.2

Answer

tunnel mode gre multipoint

Question 12

A network engineer is configuring a DMVPN Phase 2 network with EIGRP as the routing protocol. The engineer wants to ensure that spoke routers can dynamically establish direct tunnels to other spokes. Which two commands must be configured on the spoke routers to enable this functionality? (Choose two.)

Accepted Answer

ip nhrp shortcut. The two required commands on spoke routers are 'ip nhrp shortcut' and 'ip nhrp network-id'. 'ip nhrp shortcut' allows the spoke to create direct tunnels to other spokes upon receiving an NHRP redirect from the hub. 'ip nhrp network-id' is mandatory on all DMVPN routers to identify the NHRP network. Without these, spoke-to-spoke communication will not work. The other commands are either hub-specific or optional.

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp redirect

Answer

ip nhrp authentication <password>

Question 13

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router. The engineer wants to ensure that the IPsec tunnel traffic is forwarded using the correct VRF. Which command must be used under the crypto map to specify the VRF?

Accepted Answer

set vrf . The correct command is 'set vrf ' under the crypto map. This command specifies the VRF that the IPsec tunnel will use for forwarding encrypted traffic. In VRF-aware IPsec, it is essential to associate the crypto map with the correct VRF to maintain traffic isolation and correct routing. Without it, the tunnel traffic would use the global routing table, potentially causing routing issues or security breaches.

Answer

vrf forwarding <vrf-name>

Answer

match vrf <vrf-name>

Answer

set ip vrf <vrf-name>

Question 14

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco router. The router has two VRFs: VRF-A and VRF-B. The engineer wants to encrypt traffic from VRF-A to a remote peer using a crypto map. The crypto map is applied to the physical interface. Which additional configuration is required to ensure that traffic from VRF-A is encrypted and forwarded correctly?

Accepted Answer

Configure the crypto map with the set vrf VRF-A command and ensure the crypto ACL matches the VRF-A traffic.. To encrypt traffic from a specific VRF, the crypto map must include the set vrf command to associate the IPsec tunnel with that VRF. This ensures that the router uses the VRF's routing table for tunnel establishment and for routing encrypted packets. The crypto ACL must also match the interesting traffic from that VRF. Without set vrf, the tunnel may attempt to use the global routing table, leading to failure.

Answer

Configure a separate crypto map for each VRF and apply both to the physical interface.

Answer

Configure the crypto ACL to match traffic from VRF-A and apply the crypto map to the VRF-A interface.

Answer

Configure the crypto map with the set vrf VRF-A command.

Question 15

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which of the following configurations correctly defines the interesting traffic for this VPN?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reverse Route Injection (RRI). Reverse Route Injection (RRI) dynamically adds a route for the remote subnet when the IPsec tunnel is established and removes it when the tunnel goes down. This ensures that traffic is only forwarded into the tunnel when the peer is reachable, preventing black holes. DPD and keepalives detect peer failure but do not affect routing, and idle timeout is based on traffic inactivity, not reachability.

Answer

IPsec idle timeout

Answer

IKEv2 keepalives

Answer

IPsec Dead Peer Detection (DPD)