300-410 VPN Technologies Practice Test 6 — 15 Questions

Question 1

A network administrator is configuring a GRE over IPsec tunnel between two Cisco IOS routers to support multicast traffic. The administrator notices that multicast packets are not being forwarded through the tunnel. Which configuration is required to allow multicast traffic over the GRE tunnel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable `ip multicast-routing` globally and configure `ip pim sparse-mode` on the tunnel interface.. For multicast over GRE, multicast routing must be enabled globally, and PIM must be configured on the tunnel interface. The tunnel interface acts as the logical interface for multicast traffic, so it must participate in PIM. Configuring PIM only on the physical interface is insufficient because the GRE tunnel encapsulates the multicast packets. Sparse mode is commonly used for efficiency.

Answer

Configure `ip pim sparse-dense-mode` on the physical interface only.

Answer

Enable `ip multicast-routing` and configure `ip pim dense-mode` on the tunnel interface.

Answer

Configure `ip pim sparse-mode` on the physical interface and enable `ip multicast-routing`.

Question 2

A network engineer is deploying a DMVPN Phase 2 hub-and-spoke topology with mGRE on the hub and spokes, using NHRP for address resolution. The design requires that spoke-to-spoke traffic be switched directly between spokes after NHRP resolution and that each spoke's tunnel source be a physical interface that may change address. Which two NHRP or tunnel configurations are required on the spokes to support this design? (Choose two.)

Accepted Answer

Configure the hub's tunnel address as the next hop server with ip nhrp nhs. Spoke-to-spoke direct switching in DMVPN Phase 2 depends on NHRP resolution that the spokes perform through the hub. Each spoke must register with the hub by configuring the hub's tunnel address as its next hop server, and all routers in the cloud must share the same NHRP network ID so they belong to one logical domain. Together these enable dynamic resolution and direct spoke-to-spoke tunnels.

Answer

Configure tunnel protection ipsec profile on each spoke tunnel interface

Answer

Configure a static NHRP mapping for every remote spoke on each spoke tunnel interface

Answer

Configure ip nhrp map multicast dynamic on each spoke tunnel interface

Question 3

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router to provide connectivity between overlapping customer subnets. The engineer has created VRFs for each customer and assigned interfaces. To ensure that IPsec tunnel traffic is forwarded within the correct VRF, which configuration step must be performed?

Accepted Answer

Configure the crypto map with the 'vrf' keyword in the 'set peer' command, or use a VRF-specific crypto map applied to the VRF interface.. VRF-aware IPsec requires that the crypto map be tied to the VRF so that the IPsec SA and the protected traffic use the correct routing table. This is typically done with the 'set peer' command including the VRF name or by applying a VRF-specific crypto map on the VRF interface. This binding ensures encrypted packets are forwarded within the intended VRF, enabling overlapping subnets to remain isolated.

Answer

Apply the crypto map to the VRF interface and specify 'vrf forwarding' under the ISAKMP profile.

Answer

Create a static route in the global routing table pointing to the remote peer's tunnel endpoint.

Answer

Enable 'ip vrf forwarding' under the global crypto isakmp policy.

Question 4

A network administrator is configuring a GRE over IPsec tunnel between two Cisco IOS routers to support multicast traffic. The administrator notices that multicast packets are not being forwarded through the tunnel. Which configuration is required to allow multicast traffic over the GRE tunnel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'ip pim sparse-mode' on the GRE tunnel interface and ensure multicast is permitted in the IPsec ACL.. To pass multicast traffic such as OSPF hellos over a GRE over IPsec tunnel, the GRE tunnel interface must have multicast routing enabled (for example, PIM sparse-mode), and the IPsec ACL must permit the GRE protocol between the tunnel endpoints. The tunnel being up and IPsec established only means unicast GRE is working; multicast requires explicit configuration on the tunnel and permission in the crypto ACL.

Answer

Apply 'ip nhrp map multicast' on the tunnel interface to forward multicast.

Answer

Change the IPsec transform set to include 'ah-sha-hmac' to support multicast.

Answer

Configure 'tunnel mode gre multipoint' on both ends to enable multicast.

Question 5

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router so that two different customers can each run an IPsec tunnel to a shared headend while keeping their routing and forwarding separate. The engineer has defined the VRFs and the front-door VRF for the encrypted traffic. Which additional configuration is required so that IPsec tunnel traffic for each customer is mapped to the correct VRF after decryption?

Accepted Answer

Attach the crypto map to the VRF interfaces and reference the VRF in the ISAKMP profile with the match identity command.. VRF-aware IPsec requires that the IKE negotiation and the resulting IPsec SAs be bound to the correct VRF. This is done by associating the ISAKMP profile with the VRF and matching the peer identity, while the crypto map is applied on the appropriate interfaces. With this binding, decrypted packets are forwarded using the customer's VRF routing table rather than the global table.

Answer

Configure the transform set with the vrf-aware keyword to tag the SA with the customer identifier.

Answer

Configure the crypto map with the set peer command pointing to the loopback address in each VRF.

Answer

Enable policy-based routing on the inside interfaces to steer decrypted traffic into each VRF.

Question 6

A network engineer is configuring a DMVPN Phase 2 hub-and-spoke topology using mGRE and NHRP. The engineer wants to ensure that spoke-to-spoke communication works correctly. Which two statements describe the required configuration or behavior for this deployment? (Choose two.)

Accepted Answer

Spokes must use the same tunnel key and NHRP network ID as the hub.. In DMVPN Phase 2, spokes must be configured with a static NHRP map for the hub and ip nhrp map multicast dynamic for multicast support. Additionally, all routers in the DMVPN cloud must share the same NHRP network ID and tunnel key to ensure proper NHRP communication. Spoke-to-spoke tunnels are built dynamically when a spoke sends an NHRP resolution request for another spoke's tunnel IP, and the hub forwards it. The hub does not need ip nhrp redirect or static mappings for each spoke in Phase 2.

Answer

The hub must have ip nhrp shortcut configured to allow direct spoke-to-spoke tunnels.

Answer

The hub must be configured with a static NHRP mapping for each spoke to enable spoke-to-spoke communication.

Answer

The hub must be configured with ip nhrp redirect to enable spoke-to-spoke tunnels.

Question 7

A network engineer is troubleshooting an IPsec VPN between two Cisco IOS routers using IKEv2. Phase 1 completes successfully, but Phase 2 fails. The engineer sees the log message 'QM FSM error' and notices that the transform sets on both peers do not match. Which action should the engineer take to resolve the issue?

Accepted Answer

Ensure that the IPsec transform sets on both peers specify identical encryption and integrity algorithms.. Phase 2 of IKEv2 negotiates IPsec security associations using transform sets. A mismatch in encryption or integrity algorithms causes a QM FSM error and Phase 2 failure. The engineer must ensure both peers have identical transform sets. Phase 1 issues like pre-shared key or IKEv2 proposal mismatches would prevent Phase 1 from completing, which is not the case here.

Answer

Confirm that the pre-shared key is identical on both peers.

Answer

Check that the crypto ACLs are mirrored on both peers.

Answer

Verify that the IKEv2 proposal includes matching encryption, integrity, and PRF algorithms on both peers.

Question 8

A network administrator is configuring a GRE over IPsec tunnel between two Cisco IOS routers to support multicast traffic. The administrator notices that multicast packets are not being forwarded through the tunnel. Which configuration is required to allow multicast traffic over the GRE tunnel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

crypto map ipsec-isakmp set vrf . To configure VRF-aware IPsec, the 'set vrf' command is applied under the crypto map entry. This binds the IPsec tunnel to a specific VRF, ensuring that traffic is routed and forwarded within that VRF. The IKEv2 profile can also have a VRF for IKE negotiations, but the data tunnel VRF is set on the crypto map.

Answer

crypto map ipsec-isakmp vrf

Answer

crypto ipsec profile set vrf

Answer

crypto ikev2 profile set vrf

Question 9

A network administrator is configuring a GRE over IPsec tunnel between two Cisco IOS routers to support multicast traffic. The administrator notices that multicast packets are not being forwarded through the tunnel. Which configuration is required to allow multicast traffic over the GRE tunnel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply the crypto map to the physical interface and ensure the ACL for the crypto map matches the GRE traffic.. In a GRE over IPsec configuration using crypto maps, the crypto map must be applied to the physical interface that sends the GRE packets. The ACL referenced by the crypto map must permit GRE (protocol 47) between the tunnel source and destination. This ensures that the GRE-encapsulated multicast traffic is matched and encrypted by IPsec. If the ACL is incorrect or the crypto map is applied to the wrong interface, multicast packets can bypass encryption.

Answer

Configure the crypto map to use the esp-null transform set to allow multicast traffic.

Answer

Configure the IPsec tunnel to use transport mode instead of tunnel mode.

Answer

Enable IPsec on the tunnel interface using the tunnel protection ipsec profile command.

Question 10

An engineer is troubleshooting a GET VPN group member that registers with the key server but never receives the group policy for the data plane. The key server shows the member in the registration list, and IKE phase 1 and the registration exchange both complete. Which condition most likely explains why the group member cannot decrypt the group SA?

Accepted Answer

The group member lacks the matching group key material because its ACL or group name does not match the key server's group. GET VPN group members must share an identical group definition with the key server, including the group name and the ACL that identifies protected traffic. A mismatch lets the registration exchange complete and the member appear in the key server's list, but the downloaded policy does not match local traffic selection, so the member cannot properly decrypt or encrypt using the group SA. Verifying the group name, identity, and ACL consistency on both sides resolves the issue.

Answer

The key server is configured with a rekey transport method that the group member cannot accept

Answer

The group member has not been added to the group's ACL that defines the interesting traffic, so the KS withholds the policy

Answer

The group member's GDOI configuration is missing the crypto map that references the group policy

Question 11

A network engineer is implementing DMVPN Phase 3 with OSPF. The hub router must advertise a default route to all spokes, but spokes should not advertise routes to each other. Which configuration on the hub router accomplishes this?

Accepted Answer

Configure 'default-information originate' under the OSPF process on the hub.. In OSPF, the 'default-information originate' command on the hub injects a default route into the OSPF domain, which is then propagated to all spokes. This satisfies the requirement to advertise a default route to spokes. Preventing spoke-to-spoke route advertisement typically requires additional filtering or summarization, but the default route advertisement is the primary action here.

Answer

Configure 'ip summary-address eigrp' or 'area range' with a default route on the hub.

Answer

Configure 'ip ospf database-filter all out' on the hub tunnel interface.

Answer

Configure 'ip nhrp redirect' on the hub tunnel interface and 'ip nhrp shortcut' on spoke tunnel interfaces.

Question 12

A network administrator is troubleshooting an IPsec VPN between two Cisco IOS routers using IKEv1. Phase 1 is up, but Phase 2 fails to establish. The administrator reviews the configuration and sees that the crypto ACL on both peers is configured as permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255. The transform set is esp-aes 256 esp-sha256-hmac. Which action is most likely to resolve the Phase 2 failure?

Accepted Answer

Modify the crypto ACL to match the exact traffic selectors expected by the peer, ensuring mirror symmetry.. In IKEv1, Phase 2 negotiation uses proxy identities derived from the crypto ACLs. The ACLs must be mirror images of each other. If the local ACL is permit ip 10.1.1.0/24 10.2.2.0/24, the peer's ACL must be permit ip 10.2.2.0/24 10.1.1.0/24. If the peer's ACL is not the exact reverse, Phase 2 fails. The administrator should verify and correct the peer's ACL to ensure symmetry, which is the most likely cause of the failure given the scenario.

Answer

Enable Perfect Forward Secrecy (PFS) on both peers to ensure Phase 2 keys are unique.

Answer

Increase the lifetime of the Phase 2 SA to match the peer's configuration.

Answer

Change the transform set to use esp-aes 128 esp-sha-hmac to match the peer's proposal.

Question 13

A network engineer is configuring a DMVPN Phase 2 network with EIGRP as the routing protocol. The engineer wants to ensure that spoke-to-spoke communication works properly and that the hub does not become a transit path for spoke-to-spoke traffic. Which two configurations are required on the spoke routers? (Choose two.)

Accepted Answer

Configure 'no ip split-horizon eigrp <AS>' on the hub tunnel interface.. In DMVPN Phase 2 with EIGRP, the hub must disable split horizon and set next-hop-self on its tunnel interface. Disabling split horizon allows routes from one spoke to be advertised to other spokes, and next-hop-self ensures that spokes use the hub as the next hop for those routes, enabling spoke-to-spoke communication via the hub. These two commands are required on the hub, but they are essential for the spokes to communicate.

Answer

Configure 'ip nhrp redirect' on the hub tunnel interface.

Answer

Configure 'ip nhrp shortcut' on the spoke tunnel interfaces.

Answer

Configure 'ip nhrp map multicast dynamic' on the hub tunnel interface.

Question 14

A network engineer is configuring DMVPN Phase 3 with IKEv2 IPsec protection. The hub is a Cisco IOS router with a single mGRE interface and an IKEv2 profile. Spokes are configured with dynamic VTI (virtual-template) and register with the hub using NHRP. The engineer notices that spoke-to-spoke traffic is being routed through the hub instead of directly between spokes, even though NHRP shortcuts are enabled. Which configuration change is required to enable direct spoke-to-spoke tunnels?

Accepted Answer

Ensure that the spoke routers have a route to the remote spoke networks via the mGRE interface (not via the hub's tunnel IP).. In DMVPN Phase 3, spoke-to-spoke shortcuts require that the spokes have a route to the remote spoke networks via the mGRE interface. This allows the spoke to attempt NHRP resolution for the destination. If the route points to the hub's tunnel IP, traffic goes through the hub, and the hub must send an NHRP redirect. However, for the shortcut to be built, the spoke must then reroute traffic via the mGRE interface. Ensuring the route is via the mGRE interface is essential for direct spoke-to-spoke tunnels.

Answer

Enable NHRP redirect on the spokes to allow the hub to send redirect messages.

Answer

Configure the spokes to use the hub's tunnel IP as the NHRP next-hop server (NHS) and enable NHRP shortcut on the hub.

Answer

Configure the hub to advertise a summary route to the spokes to allow recursion.

Question 15

A network engineer is implementing DMVPN Phase 2 with a hub and several spokes using NHRP. Spokes register successfully with the hub, and the hub can reach every spoke tunnel address. However, spoke-to-spoke traffic is being forwarded through the hub instead of directly between spokes. Which configuration on the spoke tunnel interfaces is most likely causing this behavior?

Accepted Answer

ip nhrp network-id mismatch between the hub and spokes. NHRP network IDs must match on every tunnel interface in the same DMVPN cloud. When a spoke's network ID differs, NHRP resolution requests for other spokes do not produce usable mappings, so the spoke continues to forward packets to the hub, which then forwards them to the destination spoke. Correcting the network ID on the spoke tunnel interfaces allows NHRP to resolve peer NBMA addresses and enables direct spoke-to-spoke tunnels.

Answer

ip nhrp redirect on the spoke tunnel interface

Answer

ip nhrp map multicast dynamic on the spoke tunnel interface

Answer

ip nhrp shortcut on the spoke tunnel interface