300-410 VPN Technologies Practice Test 7 — 15 Questions

Question 1

A network engineer is configuring a VRF-aware IPsec tunnel on a Cisco IOS router so that traffic from two different VRFs, CUSTOMER_A and CUSTOMER_B, is encrypted to two different remote peers. The engineer needs the front-door VRF to carry the encrypted packets out the shared WAN interface. Which two configuration elements are required to accomplish this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

set isakmp-profile on each crypto map entry referencing the appropriate IKEv2 profile. VRF-aware IPsec on IOS requires the IKEv2 profile to be scoped to the front-door VRF through match fvrf, and each crypto map entry must reference that profile with set isakmp-profile. Together these elements let the router receive encrypted packets in the front-door VRF while negotiating and applying policy for traffic originating in the customer VRFs. The crypto map also needs set vrf to place the tunnel in the correct VRF context.

Answer

crypto isakmp key with the vrf keyword on the remote peer's keyring entry

Answer

crypto map with the local-address command pointing to the front-door VRF interface

Answer

ip vrf forwarding on the crypto map's interface to bind the map to the front-door VRF

Question 2

A network administrator is implementing a VRF-aware IPsec VPN on a Cisco IOS router. The router has two VRFs: VRF-A and VRF-B. The administrator wants to encrypt traffic from VRF-A to a remote site using a tunnel interface. The tunnel interface is assigned to VRF-A. The administrator configures the crypto map on the physical interface and applies it to the tunnel interface. However, traffic is not being encrypted. What is the most likely cause?

Accepted Answer

The crypto map must include the 'vrf' keyword to specify the inside and outside VRFs, and an ISAKMP profile must be configured for VRF-A.. VRF-aware IPsec requires that the crypto map specify the inside and outside VRFs using the 'vrf' keyword, and that an ISAKMP profile be associated with the VRF for IKE negotiations. Without these, the router cannot correctly associate the encrypted traffic with the correct VRF, and encryption will fail. The tunnel interface being in VRF-A is necessary but not sufficient; the crypto map and ISAKMP profile must also be VRF-aware.

Answer

The tunnel interface must be configured with the 'tunnel vrf' command to map to the physical interface's VRF.

Answer

The crypto map must be applied to the physical interface, not the tunnel interface, for VRF-aware IPsec.

Answer

The crypto ACL must be configured with the 'vrf' keyword to match traffic from VRF-A.

Question 3

A network engineer is deploying DMVPN Phase 2 with EIGRP as the routing protocol. The hub is configured with a multipoint GRE (mGRE) interface and EIGRP. Spokes are configured with mGRE and EIGRP. The engineer wants to ensure that spoke-to-spoke communication works directly without traversing the hub. Which two EIGRP configuration changes are required on the spoke routers to support this? (Choose two.)

Accepted Answer

Ensure that the EIGRP network command includes the mGRE subnet.. For DMVPN Phase 2 with EIGRP to support spoke-to-spoke communication, split horizon must be disabled on the mGRE interface to allow routes to be advertised between spokes. Additionally, the EIGRP network command must include the mGRE subnet so that EIGRP forms adjacencies and exchanges routes over the tunnel. These two changes ensure that spokes learn each other's routes and can build direct tunnels.

Answer

Configure the mGRE interface as a passive interface for EIGRP.

Answer

Enable EIGRP stub routing on the spokes to reduce query scope.

Answer

Set the EIGRP next-hop-self on the hub for the mGRE interface.

Question 4

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE and NHRP. Spokes are behind dynamic NAT and register with the hub using their public IP addresses. The engineer wants to ensure that spoke-to-spoke traffic can be established directly without traversing the hub. Which NHRP configuration is required on the hub to support this?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub uses NHRP redirect to inform spokes that a more optimal path exists directly to another spoke. The hub sends an NHRP redirect message to the source spoke, which then triggers an NHRP resolution for the destination spoke's NBMA address. The spoke then establishes a direct tunnel. The hub must have ip nhrp redirect enabled, while spokes typically have ip nhrp shortcut to act on the redirect.

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut

Answer

ip nhrp map multicast dynamic

Question 5

A network administrator is troubleshooting an IPsec site-to-site VPN between two Cisco routers. The VPN tunnel is up, but traffic from the local LAN to the remote LAN is not passing. The administrator verifies that the crypto ACLs match on both peers and that routing is correct. Which of the following is the most likely cause?

Accepted Answer

NAT is translating the traffic before it is encrypted, causing the IPsec peer to drop the packets.. When NAT and IPsec are configured on the same router, outbound traffic may be translated by NAT before it is encrypted. If the translated source address does not match the crypto ACL, the remote peer will drop the packets because they do not match the interesting traffic. The tunnel remains up because Phase 1 and Phase 2 SAs are established, but data traffic fails. The fix is to configure a NAT exemption (deny statement) for the VPN traffic in the NAT ACL.

Answer

The transform set is misconfigured with mismatched encryption algorithms.

Answer

The crypto map is applied to the wrong interface.

Answer

The IPsec SA lifetime is set to a lower value than the ISAKMP SA lifetime.

Question 6

A network engineer is configuring a site-to-site DMVPN Phase 3 hub-and-spoke topology. The hub router is configured with tunnel mode gre multipoint. Spokes are unable to dynamically form tunnels with each other when the hub is reachable. Which additional configuration on the hub enables spoke-to-spoke direct tunnels in Phase 3?

Accepted Answer

Enable NHRP redirect on the hub tunnel interface.. In DMVPN Phase 3, the hub uses NHRP redirect to notify a spoke that a more optimal path exists to another spoke. The spoke then uses NHRP shortcut to resolve the destination and establish a direct tunnel. Configuring NHRP redirect on the hub is essential to enable spoke-to-spoke communication without traversing the hub for every packet.

Answer

Enable NHRP shortcut on the hub tunnel interface.

Answer

Set the tunnel interface to multipoint GRE on all spokes.

Answer

Configure a unique NHRP network ID on each spoke.

Question 7

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE and NHRP. Spoke routers are behind dynamic NAT and cannot be reached directly. The engineer wants spoke-to-spoke traffic to bypass the hub after initial resolution. Which NHRP command on the spoke routers enables this behavior?

Accepted Answer

ip nhrp shortcut. In DMVPN Phase 3, the hub uses ip nhrp redirect to inform a spoke that a better path exists directly to another spoke. The spoke must have ip nhrp shortcut enabled to act on that redirect and install a direct tunnel. Together, these commands allow spoke-to-spoke traffic to bypass the hub after the initial packet flow, reducing latency and hub load.

Answer

ip nhrp redirect

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp network-id 1

Question 8

A network administrator is deploying DMVPN Phase 3 with IKEv2 between a hub and two spokes. The hub is configured with a dynamic multipoint VPN tunnel and uses NHRP. Spoke1 can reach Spoke2 via the hub, but direct spoke-to-spoke communication fails. The administrator verifies that NHRP registrations are successful and that the hub has routes to both spokes. Which action is most likely to enable direct spoke-to-spoke communication?

Accepted Answer

Enable NHRP redirect on the hub and NHRP shortcut on the spokes.. In DMVPN Phase 3, direct spoke-to-spoke tunnels are established through NHRP. The hub must be configured with 'ip nhrp redirect' to send redirect messages to spokes, and each spoke must have 'ip nhrp shortcut' to intercept traffic and initiate NHRP resolution for the destination spoke. Without these, spokes will continue to forward traffic through the hub even though NHRP registrations succeed.

Answer

Configure the hub as a route reflector for BGP.

Answer

Disable split horizon on the hub's tunnel interface.

Answer

Configure the spokes to use the hub as the next-hop for all routes.

Question 9

A network engineer is configuring a GRE tunnel between two Cisco routers. The tunnel source is a physical interface, and the tunnel destination is a loopback interface on the remote router. The engineer notices that the tunnel interface is up, but line protocol is down. What is the most likely cause?

Accepted Answer

The tunnel destination is not reachable.. A GRE tunnel interface will show up/up only if the tunnel source is valid and the tunnel destination is reachable. If the destination is unreachable, the interface remains up but the line protocol goes down. The fix is to ensure that the underlay network has a route to the tunnel destination, often by advertising the loopback interface into the routing protocol or configuring a static route.

Answer

The tunnel key is mismatched.

Answer

The tunnel mode is set to GRE multipoint.

Answer

The tunnel source and destination are reversed.

Question 10

A network architect is designing a FlexVPN solution using IKEv2 between a hub and multiple spokes. The hub must authenticate spokes using certificates, and spokes must authenticate the hub. The architect wants to ensure that the hub can verify the revocation status of spoke certificates in real time. Which mechanism should be implemented?

Accepted Answer

Configure OCSP on the hub.. OCSP provides real-time certificate revocation status by allowing the hub to query an OCSP responder during IKEv2 authentication. CRL checking is periodic and may not reflect recent revocations. SCEP is for enrollment, and pre-shared keys are a different authentication method. Therefore, OCSP is the correct choice for real-time revocation checking.

Answer

Configure CRL checking on the hub.

Answer

Enable certificate enrollment using SCEP.

Answer

Use pre-shared keys with certificate mapping.

Question 11

A network engineer is troubleshooting an IPsec site-to-site VPN between two Cisco routers. The VPN tunnel is up, but traffic is not passing through it. The engineer suspects a routing issue. Which command should be used to verify that the remote subnet is being routed through the tunnel interface?

Accepted Answer

show ip route. To verify that the remote subnet is routed through the tunnel, the engineer should inspect the routing table with 'show ip route'. This command reveals whether a route to the remote subnet exists and whether it points to the tunnel interface or the next-hop router. If the route is missing, traffic will not be encrypted and sent through the VPN.

Answer

show crypto ipsec sa

Answer

show crypto map

Answer

show crypto isakmp sa

Question 12

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that traffic from the 10.1.1.0/24 subnet is encrypted when going to the 10.2.2.0/24 subnet, but all other traffic should be sent unencrypted. Which configuration element is required to match this traffic?

Accepted Answer

An extended ACL with source 10.1.1.0 0.0.0.255 and destination 10.2.2.0 0.0.0.255, referenced in the crypto map.. IPsec site-to-site VPNs use extended ACLs to define which traffic is encrypted. The ACL must match source and destination addresses of the traffic that should be protected. The ACL is referenced in the crypto map with the match address command. Other traffic not matched by the ACL is sent in clear text. Standard ACLs, route maps, and prefix lists are not used for this purpose.

Answer

A standard ACL with source 10.1.1.0 0.0.0.255, applied to the crypto map.

Answer

A prefix list that permits the 10.1.1.0/24 and 10.2.2.0/24 prefixes, referenced in the crypto map.

Answer

A route map that matches the source and destination subnets, applied to the crypto map.

Question 13

A network engineer is troubleshooting an IPsec site-to-site VPN between two Cisco IOS routers. Phase 1 is up, but Phase 2 fails to establish. The engineer suspects a mismatch in the IPsec proposal. Which command would show the configured IPsec transform set and the algorithms being used?

Accepted Answer

show crypto ipsec transform-set. When Phase 2 fails, the most likely cause is a mismatch in the IPsec transform set. The show crypto ipsec transform-set command reveals the configured algorithms for each transform set, enabling comparison between peers. While other commands show SA status or map references, only this command directly displays the transform set details needed to identify the mismatch.

Answer

show crypto map

Answer

show crypto isakmp sa

Answer

show crypto ipsec sa

Question 14

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology. The hub router is a Cisco IOS XE device running a recent release. The engineer notices that spoke-to-spoke traffic is still traversing the hub even though the spokes have established direct tunnels. Which technology must be enabled on the hub to allow spoke routers to dynamically discover a direct path to other spokes?

Accepted Answer

Enable NHRP redirect on the hub.. In DMVPN Phase 3, the hub uses NHRP redirect to notify a source spoke that a more optimal path exists to a destination spoke. The spoke must have NHRP shortcut enabled to act on the redirect and initiate direct tunnel creation. Together, they allow dynamic spoke-to-spoke tunnels without preconfiguration.

Answer

Enable OSPF point-to-multipoint on the hub.

Answer

Enable NHRP shortcut on the hub.

Answer

Enable IPsec tunnel protection on the hub.

Question 15

A network engineer is configuring a site-to-site VPN between two Cisco IOS routers. The customer requires that traffic for the 10.1.1.0/24 subnet be encrypted, but all other traffic must be sent unencrypted. The engineer applies a crypto map to the outside interface. Which additional configuration is required to meet this requirement?

Accepted Answer

Configure an extended ACL that permits IP traffic from 10.1.1.0/24 to the remote subnet and apply it to the crypto map as the match address.. The match address in a crypto map must reference an extended ACL that permits the traffic to be encrypted. Only traffic permitted by this ACL will be protected; all other traffic is sent unencrypted. Therefore, an extended ACL permitting the desired subnet is required.

Answer

Configure a standard ACL that permits the 10.1.1.0/24 subnet and apply it to the crypto map as the match address.

Answer

Configure a route map that matches the 10.1.1.0/24 subnet and apply it to the crypto map as the match address.

Answer

Configure an extended ACL that denies IP traffic from 10.1.1.0/24 to the remote subnet and apply it as the match address.