300-410 VPN Technologies Practice Test 5 — 15 Questions

Question 1

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers using IKEv2. The engineer wants to ensure that the tunnel remains operational even if the peer's IP address changes, and also wants to authenticate using certificates. Which IKEv2 configuration element is required to achieve these goals?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure IKEv2 with `match identity remote any` and use a certificate map for authentication.. The IKEv2 profile with `match identity remote any` allows the router to accept IKEv2 negotiations from any remote IP address, which is essential when the peer's address is not fixed. Certificate authentication is configured via a certificate map that ties certificate attributes to the IKEv2 profile. This combination provides both flexibility and strong authentication.

Answer

Enable IKEv2 fragmentation and configure a pre-shared key for authentication.

Answer

Use IKEv2 profile with `match identity remote address` and configure a certificate map.

Answer

Configure a dynamic crypto map with the `set peer` command specifying a hostname.

Question 2

A network engineer is deploying DMVPN Phase 2 with EIGRP. The hub is configured with `ip nhrp map multicast dynamic` and `ip nhrp network-id 1`. Spokes register successfully, and EIGRP neighbors form. However, spoke-to-spoke traffic still traverses the hub instead of building direct tunnels. Which configuration change on the spoke routers is required to enable direct spoke-to-spoke tunnels?

Accepted Answer

Configure `ip nhrp shortcut` on the spoke tunnel interfaces.. In DMVPN Phase 2, spoke-to-spoke tunnels are built dynamically. The hub must have `ip nhrp redirect` to notify spokes of a better path, and each spoke must have `ip nhrp shortcut` to install a temporary route and NHRP mapping for the destination spoke. Without the shortcut command, the spoke continues to forward traffic through the hub even though a direct tunnel is possible.

Answer

Configure `ip nhrp redirect` on the spoke tunnel interfaces.

Answer

Configure `ip next-hop-self` on the hub tunnel interface.

Answer

Configure `ip nhrp map multicast dynamic` on the spoke tunnel interfaces.

Question 3

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router. The engineer needs to ensure that IPsec tunnel traffic is forwarded within the correct VRF after decryption. Which configuration is required to map the IPsec tunnel to a specific VRF?

Accepted Answer

Configure 'vrf forwarding' on the tunnel interface and reference the VRF in the crypto map.. VRF-aware IPsec requires mapping the tunnel to a VRF by configuring 'vrf forwarding' on the tunnel interface and referencing the VRF in the crypto map, often with front-door VRF. This ensures decrypted traffic is forwarded in the correct VRF. The other options are either invalid commands or incorrect syntax.

Answer

Set the 'vrf' keyword under the crypto map or IPsec profile.

Answer

Configure 'ip vrf forwarding' on the crypto map.

Answer

Use the 'crypto map vrf ' command on the physical interface.

Question 4

A network engineer is deploying a GET VPN solution using Cisco IOS routers. The key server (KS) is configured with a RSA key pair and the group members (GMs) are configured to register with the KS. The engineer notices that GMs are unable to register. Which action should be taken to resolve this issue?

Accepted Answer

Verify that the GM's GDOI group configuration includes the correct group identity and that the KS is reachable.. GET VPN relies on GDOI for group member registration. The GM must be configured with the same group identity as the KS, and it must be able to reach the KS on UDP port 848. Common registration failures stem from mismatched group identities, incorrect KS IP addresses, or network access issues blocking UDP 848. Verifying these elements is the first troubleshooting step.

Answer

Configure the KS to use a pre-shared key instead of RSA keys for authentication.

Answer

Ensure that the GM's IKEv2 policy matches the KS's IKEv2 policy for the registration phase.

Answer

Enable IKEv2 fragmentation on the KS to allow large registration packets.

Question 5

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router. The goal is to allow traffic from different VRFs to be encrypted and sent over a single IPsec tunnel. The engineer has configured the crypto map with the 'set vrf' command to specify the VRF for the tunnel. However, traffic from other VRFs is not being encrypted. Which additional configuration is required to allow multiple VRFs to use the same IPsec tunnel?

Accepted Answer

Configure the 'set vrf' command with the 'front-door' keyword and ensure that the crypto map is applied to the FVR interface.. VRF-aware IPsec allows multiple VRFs to share a single IPsec tunnel by using the 'set vrf' command with the 'front-door' keyword. The front-door VRF (FVR) is used for the IPsec tunnel endpoints, and the crypto map is applied to the interface in the FVR. Traffic from other VRFs is then encrypted and sent over the tunnel. This is a key feature for service providers and large enterprises that need to securely connect multiple VPNs over a single IPsec tunnel.

Answer

Configure a separate crypto map for each VRF and apply them to the same interface.

Answer

Configure a GRE tunnel for each VRF and then apply IPsec to the GRE tunnels.

Answer

Use the 'set vrf' command under the crypto map to specify the front-door VRF (FVR) and enable VRF-aware IPsec.

Question 6

A network engineer is deploying GET VPN across a private MPLS WAN using Cisco IOS routers. The key server must be able to rekey all group members simultaneously when a group member is removed from the group, and the design requires that rekey messages reach every group member without relying on any group member to relay them to other members. Which GET VPN rekey transport mechanism should the engineer configure on the key server?

Accepted Answer

Multicast rekey transport with the group members joined to the rekey multicast group address. A GET VPN key server distributes rekeys using either multicast or unicast transport. Multicast rekey sends a single rekey to a multicast group that all group members join, so every member is updated simultaneously and the key server is not burdened with per-member transmissions. This matches the stated requirement that rekeys reach all members without relying on any member to relay them.

Answer

Anycast rekey transport where the nearest key server forwards the rekey on behalf of the group

Answer

Unicast rekey transport with the key server sending individual rekeys to each group member

Answer

Multicast rekey transport using the group member registration address as the rekey destination

Question 7

A network administrator is troubleshooting an IPsec VPN tunnel between two Cisco IOS routers using IKEv2. Phase 1 is up, but Phase 2 fails. The administrator sees the log message `%IPSEC-3-REPLAY_ERR: IPsec pkt from 203.0.113.2 has no SA`. Which action is most likely to resolve the Phase 2 failure?

Accepted Answer

Check the crypto ACL configuration for asymmetric entries.. The `REPLAY_ERR` message indicates that the router received an IPsec packet for which no inbound SA exists. This commonly happens when the crypto ACLs on the two peers are not symmetric, meaning traffic that one side encrypts is not matched by the other side's ACL. Aligning the ACLs so they mirror each other allows the router to create the correct inbound SA and resolves the Phase 2 failure.

Answer

Confirm that the IPsec SA lifetime is identical on both peers.

Answer

Ensure the ISAKMP policy priority matches on both peers.

Answer

Verify that the IPsec transform set matches on both peers.

Question 8

A network administrator is troubleshooting an IPsec VPN tunnel between two Cisco IOS routers that uses IKEv2. Phase 1 is up, but Phase 2 fails to establish. The administrator runs 'show crypto ikev2 sa' and sees the IKEv2 SA is in READY state. Which command should the administrator use to view the proposed and matched transforms for the IPsec SA?

Accepted Answer

debug crypto ipsec. When Phase 2 fails, the administrator needs to see the proposed and matched transforms during IPsec SA negotiation. The 'debug crypto ipsec' command provides this level of detail, showing the transform sets proposed by each peer and whether they are accepted. This helps identify mismatched proposals, such as different encryption or hash algorithms. The other commands show configuration or established SAs, not the negotiation process.

Answer

show crypto ikev2 sa detailed

Answer

show crypto ipsec sa

Answer

show crypto ipsec transform-set

Question 9

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers using IKEv2. The engineer wants to ensure that the tunnel remains operational even if the peer's IP address changes, and also wants to authenticate using certificates. Which IKEv2 configuration element is required to achieve these goals?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the tunnel protection keepalive or the static VTI configuration so the tunnel is driven by the crypto ACL and idles out when no interesting traffic matches.. On-demand IPsec behavior depends on the tunnel being triggered by interesting traffic rather than held up by a keepalive or static VTI. When a static VTI or tunnel protection keepalive is present, the SA stays up continuously. Removing that keepalive and relying on the crypto ACL lets the SA be built when matching traffic arrives and expire after the idle timeout, satisfying both the on-demand and teardown requirements.

Answer

Configure the IKEv2 profile with a shorter lifetime so the IKE SA expires and forces the tunnel down after inactivity.

Answer

Set the crypto map to use the keyword that makes the tunnel on-demand, such as configuring the crypto map entry without the ipsec-isakmp static keyword and relying on the ACL to trigger it.

Answer

Apply an ACL to the crypto map that denies all traffic, so the tunnel never comes up until the ACL is changed.

Question 10

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology with IKEv2 IPsec protection. The hub uses a single mGRE interface and a single IPsec profile. Spokes are configured with dynamic IP addresses and register with the hub using NHRP. The engineer wants to ensure that spoke-to-spoke traffic is encrypted and that spoke-to-spoke tunnels are established dynamically. Which configuration is required on the hub to support this?

Accepted Answer

Configure `ip nhrp redirect` on the hub and `ip nhrp shortcut` on the spokes.. DMVPN Phase 3 requires `ip nhrp redirect` on the hub to signal spokes about optimal paths, and `ip nhrp shortcut` on the spokes to allow them to establish direct spoke-to-spoke tunnels. The hub's mGRE interface and IPsec profile handle encryption, while NHRP manages dynamic tunnel creation. Together, these features enable efficient spoke-to-spoke communication.

Answer

Configure `ip nhrp shortcut` on the hub's mGRE interface.

Answer

Configure `ip nhrp map multicast dynamic` on the hub's mGRE interface.

Answer

Configure `ip nhrp redirect` on the hub's mGRE interface.

Question 11

A network administrator is configuring an IPsec VTI tunnel between two Cisco IOS routers to carry OSPF adjacency traffic. The tunnel interface is up and the crypto session is established, but the OSPF adjacency remains in EXSTART. Which action should the administrator take to allow the OSPF adjacency to form over the IPsec VTI?

Accepted Answer

Adjust the IP MTU on both tunnel interfaces so the OSPF packet size fits within the IPsec overhead. OSPF forms adjacencies by exchanging database description packets that can be up to the interface MTU. IPsec encapsulation adds overhead, so a tunnel interface inheriting a large MTU can generate OSPF packets that exceed what the encapsulated path can carry. The adjacency stalls in EXSTART because the master-slave exchange never completes. Lowering the IP MTU on both tunnel interfaces, or tuning TCP MSS, aligns packet size with the encapsulated MTU and allows the adjacency to reach FULL.

Answer

Enable OSPF authentication using MD5 on both tunnel interfaces

Answer

Configure the OSPF network type as point-to-multipoint on both tunnel interfaces

Answer

Configure the OSPF router ID manually on both routers to ensure it is unique

Question 12

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router. The engineer must ensure that IPsec tunnel traffic is forwarded within the correct VRF. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Configure the crypto map with the `vrf` keyword.. To configure VRF-aware IPsec, the crypto map must specify the VRF using the `vrf` keyword, and a VRF-aware ISAKMP profile must be configured to bind IKE negotiation to that VRF. These two elements ensure that both IKE and IPsec traffic use the correct VRF routing table, allowing the tunnel to be established and forwarded within the VRF.

Answer

Apply the crypto map to the VRF interface.

Answer

Configure `ip route vrf` for the remote peer.

Answer

Enable `ip vrf forwarding` on the tunnel interface.

Question 13

A network engineer is configuring a GRE tunnel over an IPsec VPN to support multicast traffic between two sites. The engineer notices that multicast traffic is not passing through the tunnel. The GRE tunnel is up, and IPsec is established. Which command should the engineer verify on the GRE tunnel interface to ensure multicast is enabled?

Accepted Answer

ip pim sparse-mode. To support multicast over a GRE tunnel, PIM must be enabled on the tunnel interface. The 'ip pim sparse-mode' command enables PIM on the interface, allowing multicast traffic to be routed. While global multicast routing must also be enabled, the specific interface configuration is crucial. The other options are either global commands or incorrect tunnel modes. The engineer should ensure PIM is configured on all relevant interfaces, including the tunnel and physical interfaces.

Answer

ip multicast-routing

Answer

show ip interface tunnel0

Answer

tunnel mode gre multipoint

Question 14

A network engineer is implementing a FlexVPN hub-and-spoke topology using IKEv2. The hub uses a single IKEv2 profile and a single IPsec profile. The engineer wants to ensure that spoke-to-spoke traffic is encrypted and that spokes can communicate directly without traversing the hub. Which two configuration elements are required on the hub to enable spoke-to-spoke communication? (Choose two.)

Accepted Answer

Configure the hub to use a single IPsec profile for all spokes, and enable `spoke-to-spoke` in the IKEv2 profile.. FlexVPN uses IKEv2 for both hub-to-spoke and spoke-to-spoke tunnels. The `spoke-to-spoke` command in the IKEv2 profile is essential for enabling the hub to act as a registration authority and allow spokes to establish direct tunnels. A single IPsec profile ensures uniform encryption policies. Without these, spokes cannot communicate directly and must route through the hub.

Answer

Configure `ip nhrp redirect` on the hub's tunnel interface.

Answer

Configure `match identity remote any` in the IKEv2 profile.

Answer

Configure an IPsec profile with `set security-association` parameters to allow dynamic tunnels.

Question 15

A network engineer is troubleshooting a DMVPN Phase 3 network where a spoke registers successfully with the hub and can ping the hub's tunnel address, but the spoke cannot reach the tunnel address of another spoke. NHRP resolution requests are being sent, and the hub is configured for redirect. Which command on the hub is most useful to confirm whether NHRP redirect messages are being generated for spoke-to-spoke resolution?

Accepted Answer

debug nhrp packet. NHRP redirect is the mechanism that tells a spoke to resolve a destination directly instead of continuing to send traffic through the hub. To confirm the hub is generating those redirect messages, the engineer needs visibility into NHRP packet activity. The debug nhrp packet command shows NHRP messages sent and received, including redirects, making it the most direct way to verify redirect generation on the hub.

Answer

show ip nhrp nhs

Answer

show dmvpn

Answer

show crypto session