300-410 VPN Technologies Practice Test 8 — 15 Questions

Question 1

A network engineer is configuring a site-to-site DMVPN Phase 3 hub-and-spoke topology. Spokes must be able to communicate directly without traffic traversing the hub. Which command must be configured on the hub to enable spoke-to-spoke direct tunnels?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub must be configured with ip nhrp redirect to send NHRP redirect messages to spokes when it receives traffic destined for another spoke. The spokes must also have ip nhrp shortcut to act on those redirects and establish direct tunnels. The redirect on the hub is essential for signaling the availability of a better path.

Answer

ip nhrp network-id 1

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp shortcut

Question 2

A network engineer is configuring a GRE tunnel between two Cisco routers. The tunnel source is GigabitEthernet0/0 on Router A with IP 192.168.1.1, and the tunnel destination is 192.168.2.1 on Router B. After configuration, the tunnel interface is up, but no traffic passes through. What is the most likely cause?

Accepted Answer

The tunnel destination is not reachable via the underlay network.. A GRE tunnel requires the tunnel destination to be reachable via the underlay network. If the destination is not reachable, the tunnel interface may appear up, but encapsulated packets cannot be delivered, resulting in no traffic flow. Other options are either incorrect or would cause different symptoms. Ensuring underlay reachability and proper routing is essential for GRE tunnel operation.

Answer

The tunnel source and destination are in different subnets.

Answer

The tunnel mode is set to GRE/IPv4, which is not supported.

Answer

The tunnel interface is missing an IP address.

Question 3

A network engineer is configuring a site-to-site DMVPN Phase 3 hub-and-spoke topology. Spokes must be able to communicate directly without traffic traversing the hub. Which command must be configured on the hub to enable spoke-to-spoke direct tunnels?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An extended ACL that permits IP traffic from 10.1.1.0/24 to 10.2.2.0/24.. In Cisco IPsec configuration, the crypto map references an extended ACL to identify interesting traffic. The ACL must permit IP traffic from the local subnet to the remote subnet. This ensures that only packets matching those criteria are encrypted and sent through the VPN tunnel. Standard ACLs or overly broad ACLs are incorrect.

Answer

A standard ACL that permits the 10.1.1.0/24 network.

Answer

An extended ACL that denies IP traffic from 10.1.1.0/24 to 10.2.2.0/24.

Answer

A named ACL that permits all IP traffic.

Question 4

A network administrator is implementing GET VPN on Cisco IOS routers. The key server is configured with a policy that includes the `rekey` command. Which statement accurately describes the behavior of the rekey mechanism in GET VPN?

Accepted Answer

The key server sends rekey messages to group members to refresh the Group Domain of Interpretation (GDOI) keys.. GET VPN uses GDOI for group key management. The key server sends rekey messages to group members to update encryption keys and policies. This allows scalable key distribution without re-registration. The rekey command configures the key server's rekey behavior, including algorithms and lifetimes. It directly impacts data plane keys, ensuring secure and efficient key rollover.

Answer

The rekey mechanism only applies to the control plane and does not affect data plane encryption keys.

Answer

The rekey command is used to manually trigger a key rollover on the key server.

Answer

The rekey mechanism requires each group member to initiate a new registration with the key server.

Question 5

A network engineer is configuring a site-to-site DMVPN Phase 3 hub-and-spoke topology. Spokes must be able to communicate directly without traffic traversing the hub. Which command must be configured on the hub to enable spoke-to-spoke direct tunnels?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An extended ACL that permits IP traffic from 10.1.1.0/24 to 10.2.2.0/24 and denies all other traffic.. The crypto ACL must permit the specific traffic that should be encrypted and implicitly deny all other traffic. An extended ACL that permits IP traffic from 10.1.1.0/24 to 10.2.2.0/24 and denies all other traffic achieves this. Standard ACLs cannot match destination addresses, and denying the desired traffic or permitting all traffic would be incorrect.

Answer

A standard ACL that permits the 10.1.1.0/24 subnet.

Answer

A named ACL that permits all IP traffic.

Answer

An extended ACL that denies IP traffic from 10.1.1.0/24 to 10.2.2.0/24 and permits all other traffic.

Question 6

A network engineer is configuring DMVPN Phase 3 on a hub router. The hub has a public IP address and is reachable. Spokes are behind NAT devices and have dynamic public IP addresses. Which technology allows spokes to communicate directly without routing traffic through the hub?

Accepted Answer

NHRP shortcut. In DMVPN Phase 3, NHRP shortcut enables direct spoke-to-spoke tunnels. When a spoke sends traffic to another spoke via the hub, the hub sends an NHRP redirect, and the spoke then uses NHRP shortcut to establish a direct tunnel.

Answer

NHRP redirect

Answer

NHRP resolution

Answer

NHRP registration

Question 7

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that the VPN tunnel only comes up when there is interesting traffic matching an extended ACL. The ACL is defined as: access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255. The crypto map is applied to interface GigabitEthernet0/0. Which command is required to complete the configuration so that the router considers traffic matching the ACL as interesting?

Accepted Answer

match address 100. The match address command within the crypto map entry binds the extended ACL to the crypto map, designating the traffic that should be protected by IPsec. In this scenario, the ACL 100 defines the interesting traffic between the two subnets. Without this command, the router would not know which packets to encrypt and tunnel, and the VPN would not initiate as intended.

Answer

crypto map mymap 10 ipsec-isakmp

Answer

crypto isakmp policy 10

Answer

set peer 203.0.113.2

Question 8

A network engineer is configuring DMVPN Phase 3 with IKEv2. The hub router is a Cisco IOS XE device, and the goal is to allow spoke-to-spoke traffic to bypass the hub after initial registration. Which command must be configured on the hub to enable NHRP redirects?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub uses NHRP redirects to inform spokes about a better path to reach another spoke. The 'ip nhrp redirect' command on the hub enables this behavior. Combined with 'ip nhrp shortcut' on the spokes, it allows dynamic direct tunnels. Without the redirect on the hub, spokes continue to route traffic through the hub even if a direct path exists.

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut

Question 9

A network administrator is troubleshooting a DMVPN Phase 3 hub-and-spoke network using mGRE and NHRP. Spoke-to-spoke communication is failing, but spoke-to-hub communication works. The administrator verifies that NHRP registrations are successful and that the hub is configured with 'ip nhrp redirect'. What is the most likely cause of the spoke-to-spoke failure?

Accepted Answer

The spokes are not configured with 'ip nhrp shortcut'.. In DMVPN Phase 3, spoke-to-spoke communication requires the hub to send NHRP redirect messages and the spokes to have 'ip nhrp shortcut' configured. The shortcut allows spokes to dynamically create direct tunnels upon receiving a redirect. Without it, spokes continue to route through the hub, and direct spoke-to-spoke communication does not occur.

Answer

The hub is missing 'ip nhrp map multicast dynamic'.

Answer

The hub is not configured with 'ip nhrp redirect'.

Answer

The spokes are not configured with 'ip nhrp network-id'.

Question 10

A network administrator is deploying a GET VPN using Cisco IOS routers. The key server is configured with a cooperative key server (COOP) for redundancy. The administrator notices that some group members are not registering with the primary key server. Which protocol and port must be allowed through the firewall for the group members to register with the key server?

Accepted Answer

GDOI on UDP port 848. GET VPN group members use GDOI on UDP port 848 to register with the key server. This port must be permitted through firewalls to allow registration and key retrieval.

Answer

ISAKMP on UDP port 500

Answer

IPsec ESP on IP protocol 50

Answer

NAT-T on UDP port 4500

Question 11

A router running Cisco IOS XE has a VRF-aware DMVPN phase 3 tunnel interface. The network administrator wants to ensure that spoke-to-spoke traffic is switched directly between spokes when a route to the destination is present in the NHRP database. Which configuration on the hub is required to enable this behavior?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, spoke-to-spoke traffic optimization relies on the hub sending NHRP redirect messages to the ingress spoke. The hub must be configured with ip nhrp redirect to generate these messages when it receives traffic destined for a network reachable via another spoke. The spoke then uses ip nhrp shortcut to install a direct route, but the hub-side command is ip nhrp redirect.

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut

Answer

ip nhrp map multicast dynamic

Question 12

A network administrator is troubleshooting a DMVPN Phase 3 configuration on a Cisco IOS router. The hub router is configured with a multipoint GRE tunnel interface and NHRP. Spoke routers are unable to establish direct spoke-to-spoke tunnels; all traffic between spokes is going through the hub. The administrator verifies that NHRP registration is successful and that the hub has a mapping for each spoke. Which configuration change on the hub is required to enable spoke-to-spoke direct communication?

Accepted Answer

Configure the tunnel interface with ip nhrp redirect.. In DMVPN Phase 3, spoke-to-spoke direct tunnels are facilitated by NHRP redirects from the hub and NHRP shortcuts on spokes. The hub must be configured with ip nhrp redirect to send redirect messages when it detects traffic between spokes that could be direct. This triggers the originating spoke to request the destination spoke's NBMA address and build a direct tunnel, offloading traffic from the hub.

Answer

Configure the tunnel interface with ip nhrp shortcut.

Answer

Configure the tunnel interface with ip nhrp map multicast dynamic.

Answer

Configure the tunnel interface with ip nhrp network-id 100.

Question 13

A network engineer is troubleshooting an IPsec site-to-site VPN between two Cisco routers. Phase 1 is up, but Phase 2 fails to establish. The engineer suspects a mismatch in the transform set. Which command should be used to verify the transform set configured for the crypto map on the local router?

Accepted Answer

show crypto map. To verify the transform set configured in a crypto map, the show crypto map command is used. It displays the crypto map entries, including the transform set name, peer, and ACL. This allows the engineer to confirm the local configuration and compare it with the remote peer to identify mismatches.

Answer

show crypto ipsec transform-set

Answer

show crypto isakmp sa

Answer

show crypto ipsec sa

Question 14

A network administrator is troubleshooting an IPsec site-to-site VPN between two Cisco IOS routers. The tunnel is up, but traffic is not passing. The administrator suspects a routing issue. Which command should be used to verify that the crypto ACL matches the traffic being sent?

Accepted Answer

show access-lists. When an IPsec tunnel is up but traffic is not passing, a common cause is a mismatch between the crypto ACL and the actual traffic. The crypto ACL defines interesting traffic that should be encrypted. By using 'show access-lists', you can see if the ACL's permit entries are being hit by the traffic. If counters are not incrementing, the traffic is not matching the ACL, and you need to adjust it.

Answer

show crypto ipsec sa

Answer

show crypto isakmp sa

Answer

show crypto map

Question 15

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology. The hub router must dynamically learn spoke-to-spoke routes without requiring a full mesh of tunnels. Which technology should be implemented on the hub to allow spoke routers to resolve next-hop addresses directly?

Accepted Answer

Enable NHRP redirect on the hub and NHRP shortcut on the spokes.. NHRP redirect on the hub and NHRP shortcut on the spokes are the defining features of DMVPN Phase 3. The hub uses redirect messages to inform spokes of a better path, and spokes use shortcut to create direct tunnels. This enables dynamic spoke-to-spoke communication without a full mesh, reducing latency and hub resource consumption.

Answer

Configure OSPF network type as point-to-multipoint on all routers.

Answer

Implement IPsec tunnel protection on the hub only.

Answer

Use BGP route reflectors to distribute spoke routes.