300-410 VPN Technologies Practice Test 9 — 15 Questions

Question 1

A network engineer is troubleshooting an IPsec VPN between two Cisco IOS routers. The tunnel is up, but traffic is not passing. The engineer runs `show crypto ipsec sa` and notices that the encaps/decaps counters are incrementing, but the inbound and outbound packets are being dropped. The ACL used for the VPN is `permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255`. What is the most likely cause of the dropped packets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

There is a routing issue or reverse path forwarding (RPF) check failure for the decapsulated packets.. When IPsec encaps/decaps counters increment but packets are dropped, the router is encrypting and decrypting successfully. The drop likely occurs after decryption due to a routing or RPF check failure. The decrypted packet's source address must be reachable via the interface it arrived on; if not, Unicast RPF drops it. This is a common troubleshooting scenario in IPsec VPNs.

Answer

The IPsec SA is using the wrong transform set.

Answer

The crypto map is applied to the wrong interface.

Answer

The ACL is too restrictive and does not match the actual traffic.

Question 2

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE and NHRP. The hub router is a Cisco IOS XE device with the tunnel source as a physical interface and tunnel mode gre multipoint. Spoke routers are configured with dynamic NHRP mappings. The engineer notices that spoke-to-spoke traffic initially goes through the hub, but after the first packet, the spokes establish a direct tunnel. Which NHRP feature is responsible for this behavior?

Accepted Answer

NHRP redirect and shortcut switching. In DMVPN Phase 3, the hub uses NHRP redirect to notify a spoke that a more optimal path exists to the destination. The spoke then sends an NHRP resolution request for the destination spoke's NBMA address and, upon receiving a reply, builds a direct mGRE tunnel. This reduces latency and hub load by allowing direct spoke-to-spoke traffic.

Answer

NHRP holdtime and registration

Answer

NHRP server-only and client-only configuration

Answer

NHRP authentication and mapping

Question 3

A network engineer is configuring a GRE tunnel over an IPsec VPN to support multicast traffic between two sites. The engineer notices that multicast traffic is not passing through the tunnel, although unicast traffic works. Which of the following is the most likely reason?

Accepted Answer

Multicast routing is not enabled on the tunnel interfaces or the physical interfaces.. Multicast traffic over a GRE tunnel requires multicast routing to be enabled on both the tunnel interface and the physical interface. Additionally, a multicast routing protocol like PIM must be configured. Without these, the router will not forward multicast packets, even though unicast traffic works. The IPsec ACL typically permits GRE, so it does not need to match multicast directly.

Answer

The IPsec transform set does not support multicast traffic.

Answer

The IPsec ACL is not permitting multicast traffic.

Answer

The GRE tunnel interface is not configured with a tunnel source and destination.

Question 4

A network administrator is deploying a site-to-site VPN using Cisco IOS GET VPN (Group Encrypted Transport VPN) on a service provider MPLS network. The administrator must ensure that the group members can communicate securely while maintaining any-to-any connectivity and minimizing tunnel overhead. Which two statements about GET VPN are true? (Choose two.)

Accepted Answer

GET VPN requires a key server to distribute encryption keys and policies to group members.. GET VPN uses a group security association managed by a key server, allowing any-to-any secure communication without per-peer tunnels. The key server distributes policies and keys via GDOI. This design preserves the original IP header for routing and supports both unicast and multicast, making it ideal for MPLS networks.

Answer

GET VPN encapsulates packets in a new IP header, adding significant overhead.

Answer

GET VPN uses IKEv2 to establish point-to-point tunnels between all group members.

Answer

GET VPN provides encryption only for unicast traffic, not multicast.

Question 5

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that only specific traffic from the local subnet to the remote subnet is encrypted, while other traffic is sent in clear text. Which IPsec component is used to define the interesting traffic?

Accepted Answer

Crypto ACL. The crypto ACL is the component that specifies the traffic to be encrypted by IPsec. It acts as a filter, and only packets permitted by the ACL are protected. The crypto map then references this ACL to apply the IPsec policy. Other components like transform set and ISAKMP policy handle encryption algorithms and key negotiation, not traffic selection.

Answer

ISAKMP policy

Answer

Transform set

Answer

Crypto map

Question 6

A network engineer is configuring a site-to-site IPsec VPN between two Cisco routers. The engineer wants to use a pre-shared key for authentication. Which command is used to configure the pre-shared key on the router?

Accepted Answer

crypto isakmp key MYKEY address 192.168.1.1. Pre-shared key authentication in IKE is configured using the 'crypto isakmp key' command, which specifies the key and the peer address. This command is separate from the ISAKMP policy that defines the authentication method. Both peers must have the same pre-shared key for Phase 1 to succeed. The key is used during the IKE authentication exchange.

Answer

crypto ipsec key MYKEY

Answer

crypto isakmp policy 10 authentication pre-share

Answer

crypto map MYMAP 10 set peer 192.168.1.1

Question 7

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology. Spokes should be able to communicate directly with each other without traffic traversing the hub. The hub router interface is already configured with 'ip nhrp network-id 1' and 'ip nhrp map multicast dynamic'. Which additional command must be configured on the hub to allow spoke-to-spoke direct tunnels?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub uses 'ip nhrp redirect' to notify spokes of a better path to another spoke. The spoke then uses 'ip nhrp shortcut' to create a direct tunnel. The hub must have 'ip nhrp redirect' configured to enable this behavior. The other options are either already configured or belong on the spoke.

Answer

ip nhrp shortcut

Answer

ip nhrp network-id 1

Answer

ip nhrp map multicast dynamic

Question 8

A network technician is configuring a GRE tunnel between two Cisco routers. The tunnel interface is up, but no traffic is passing. Which command should be used to verify that the tunnel source and destination are reachable?

Accepted Answer

ping <tunnel destination IP>. Pinging the tunnel destination IP is the most direct way to verify that the remote endpoint is reachable. If the ping succeeds, the underlying transport is working, and further troubleshooting can focus on the tunnel configuration. If it fails, the issue is in the transport network, not the tunnel itself.

Answer

show ip route

Answer

traceroute <tunnel destination IP>

Answer

show interface tunnel 0

Question 9

A network engineer is configuring a VRF-aware IPsec VPN. The engineer needs to ensure that the IPsec tunnel traffic is forwarded within the correct VRF on the router. Which command must be configured under the crypto map to bind the IPsec tunnel to a specific VRF?

Accepted Answer

set vrf VPN-CORP. To bind an IPsec tunnel to a VRF in a VRF-aware IPsec configuration, the set vrf command is used under the crypto map entry. This ensures that the tunnel's traffic is forwarded using the specified VRF's routing table, allowing overlapping address spaces and segmentation.

Answer

set ip vrf VPN-CORP

Answer

ip vrf forwarding VPN-CORP

Answer

vrf forwarding VPN-CORP

Question 10

A network engineer is implementing DMVPN Phase 3 with IPsec tunnel protection. The hub router must be configured to support NHRP redirect. Which command is required on the hub's tunnel interface?

Accepted Answer

ip nhrp redirect. The ip nhrp redirect command on the hub's tunnel interface is required for DMVPN Phase 3. It allows the hub to inform spokes about a better path when traffic is received on the same interface, prompting the spoke to initiate a direct tunnel. Without this command, the hub cannot send redirect messages, and spoke-to-spoke tunnels will not form dynamically.

Answer

ip nhrp shortcut

Answer

ip nhrp network-id 1

Answer

ip nhrp map multicast dynamic

Question 11

A network engineer is configuring a GRE tunnel between two Cisco routers. The tunnel interface is up, but the engineer cannot ping the remote tunnel endpoint. The physical interfaces are up, and there is a route to the remote physical address. Which command should be used to verify that the tunnel source and destination are correctly configured?

Accepted Answer

show interfaces tunnel 0. The 'show interfaces tunnel 0' command displays detailed information about the tunnel interface, including the configured source and destination addresses, and the tunnel status. It is the most direct way to verify that the tunnel endpoints are correctly configured. Other commands do not show the tunnel source and destination.

Answer

show ip route

Answer

show ip interface brief

Answer

show crypto session

Question 12

A network administrator is setting up a site-to-site VPN between two Cisco routers using IPsec. The administrator wants to ensure that the VPN tunnel uses strong encryption and hashing algorithms. Which of the following should be configured to define the encryption and hashing algorithms used for the IPsec SA?

Accepted Answer

Transform set. The transform set is used to define the encryption and hashing algorithms for the IPsec SA. It is referenced by the crypto map or IPsec profile. The ISAKMP policy defines Phase 1 parameters, while the crypto map and IKEv2 profile are used for other purposes. Therefore, the transform set is the correct answer.

Answer

ISAKMP policy

Answer

IKEv2 profile

Answer

Crypto map

Question 13

A network administrator is configuring a site-to-site IPsec VPN between two Cisco IOS XE routers. The administrator wants to ensure that the VPN tunnel only encrypts traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet. Which configuration element defines the traffic to be encrypted?

Accepted Answer

crypto ACL. In a site-to-site IPsec VPN, the crypto ACL (an extended access list) is used to define interesting traffic that should be encrypted and sent through the tunnel. The crypto map references this ACL to match packets. The transform set and ISAKMP policy define how to protect the traffic and negotiate the tunnel, but they do not select the traffic.

Answer

transform set

Answer

ISAKMP policy

Answer

crypto map

Question 14

A network engineer is configuring a GRE over IPsec tunnel between two Cisco routers. The engineer wants to ensure that multicast traffic, such as OSPF hello packets, is encrypted and sent over the tunnel. Which statement about the configuration is true?

Accepted Answer

The crypto ACL must permit GRE (protocol 47) traffic.. In a GRE over IPsec configuration, GRE encapsulates the multicast traffic, and then IPsec encrypts the GRE packets. The crypto ACL must match the GRE protocol (IP protocol 47) between the tunnel source and destination. This allows multicast and broadcast traffic to be carried over the tunnel because GRE handles the multicast encapsulation, and IPsec provides encryption.

Answer

IPsec must be configured in transport mode to preserve the original IP header.

Answer

The tunnel interface must be configured with the tunnel mode gre multipoint command.

Answer

The crypto ACL must permit OSPF (protocol 89) traffic.

Question 15

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology on Cisco IOS routers. The hub router must dynamically learn spoke-to-spoke routes and allow direct spoke-to-spoke tunnels. Which command must be configured on the hub's tunnel interface to enable Phase 3 behavior?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub uses NHRP redirect to inform spokes about a more optimal path to another spoke, and spokes use NHRP shortcut to install a direct route. The hub must have ip nhrp redirect configured on its tunnel interface. The other options are either spoke-side commands or general NHRP parameters that do not enable Phase 3 behavior.

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut