350-401 VPN Technologies — All Questions With Answers

Question 1

A network engineer is configuring a site-to-site IPsec VPN between two Cisco routers. The engineer wants to ensure that the VPN tunnel uses the strongest possible encryption and authentication algorithms. The engineer configures the following: crypto isakmp policy 10, authentication pre-share, encryption aes-256, group 14, lifetime 86400. On the remote router, the engineer configures: crypto isakmp policy 10, authentication pre-share, encryption aes-256, group 14, lifetime 86400. The tunnel fails to establish. What is the most likely cause?

Accepted Answer

The hash algorithm is not specified and defaults may differ between routers.. The IKE policy parameters must match exactly on both peers. In this scenario, the policies appear identical, but a common oversight is that the hash algorithm (e.g., SHA-256) is not specified in the policy; the default is MD5 or SHA-1 depending on IOS version. If one router uses default SHA-1 and the other uses MD5, the mismatch will prevent Phase 1 from completing. Option B is correct because the hash algorithm mismatch is a frequent cause of failure. Option A is incorrect because the lifetimes match. Option C is incorrect because group 14 is valid. Option D is incorrect because pre-shared keys can be used with strong encryption.

Answer

The lifetimes are set too high; they should be 3600 seconds.

Answer

The Diffie-Hellman group 14 is not supported on these routers.

Answer

Pre-shared keys cannot be used with AES-256 encryption.

Question 2

A network engineer is tasked with deploying a DMVPN Phase 2 network for a company with multiple branch offices. The hub router is a Cisco 4451-X and the spoke routers are Cisco 4331s. After configuration, the spokes can ping the hub's tunnel IP, but cannot reach each other's tunnel IPs. The engineer checks the routing tables and sees that the hub has routes for both spoke subnets, but the spokes do not have routes to each other. What is the most likely cause?

Accepted Answer

The hub is not configured to propagate spoke routes to other spokes.. In DMVPN Phase 2, spokes learn about other spoke networks via the hub using dynamic routing (e.g., EIGRP or OSPF). The hub must be configured to propagate spoke routes to other spokes. If the hub is not configured to redistribute or advertise the spoke subnets, the spokes will not have routes to each other. Option C is correct because the hub must have a routing configuration that allows spoke-to-spoke route propagation. Option A is incorrect because NHRP is used for mapping, not routing. Option B is incorrect because spoke-to-spoke tunnels are established dynamically via NHRP. Option D is incorrect because mGRE is the correct interface type for DMVPN.

Answer

The NHRP network ID is mismatched between the hub and spokes.

Answer

The spokes are not configured with a crypto map for IPsec.

Answer

The tunnel mode is set to GRE instead of mGRE on the spokes.

Question 3

An engineer is configuring a FlexVPN hub-and-spoke network. The hub router has a loopback0 with IP 10.0.0.1/32. The spokes are configured to use IKEv2 with certificates. The engineer notices that the spokes can establish the IKEv2 tunnel and can ping the hub's tunnel IP, but cannot reach the loopback0 address. The hub has a static route for the spoke subnets. What is the most likely issue?

Accepted Answer

The loopback0 is not advertised in the routing protocol.. In FlexVPN, the tunnel IP addresses are typically used for routing, and the loopback may not be advertised into the routing protocol or may not be reachable via the tunnel interface. If the hub's loopback is not included in the routing updates (e.g., via a network statement in EIGRP or OSPF), the spokes will not have a route to it. Option D is correct because the loopback is not being advertised. Option A is incorrect because IKEv2 is working. Option B is incorrect because certificates are not the issue. Option C is incorrect because the tunnel itself is up.

Answer

The IKEv2 proposal does not match between hub and spoke.

Answer

The certificate authority is not trusted by the hub.

Answer

The tunnel interface is not in an up/up state.

Question 4

A network engineer is configuring a GETVPN solution for a large enterprise with many remote sites. The engineer wants to ensure that all traffic between sites is encrypted using a common group key. The key server (KS) is a Cisco ASR 1000. After configuration, the group members (GMs) can register with the KS, but traffic between GMs is not encrypted. The engineer checks the KS configuration and sees that the crypto gdoi group has been defined with a transform set and a security association. What is the most likely missing configuration?

Accepted Answer

The KS is missing an access list to define the traffic to encrypt.. In GETVPN, the KS must define a traffic selector (access list) that specifies which traffic to encrypt. Without a proper access list, the KS will not send the policy to the GMs, and traffic will pass in the clear. Option A is correct because the access list is missing. Option B is incorrect because the group name is not the issue. Option C is incorrect because the KS does not need an IPsec profile. Option D is incorrect because GMs can be in different subnets.

Answer

The group name on the GMs does not match the KS.

Answer

The KS is not configured with an IPsec profile.

Answer

The GMs are in different IP subnets than the KS.

Question 5

An engineer is troubleshooting a site-to-site VPN between a Cisco ASA and a Cisco IOS router. The VPN is configured using IKEv1 with pre-shared keys. The tunnel establishes and traffic flows, but after a few hours, the tunnel drops and re-establishes. The engineer checks the logs and sees that the Phase 1 SA is being rekeyed. What is the most likely reason for the tunnel dropping?

Accepted Answer

The IKE Phase 1 lifetime is set too low.. IKE Phase 1 SAs have a lifetime; when the lifetime expires, the SA is rekeyed. If the rekey fails or is delayed, the tunnel may drop temporarily. Option B is correct because the lifetime expiration is the most common cause. Option A is incorrect because DPD is used to detect dead peers, not cause drops. Option C is incorrect because rekeying is normal. Option D is incorrect because the Phase 2 lifetime is separate.

Answer

The Dead Peer Detection (DPD) interval is too short.

Answer

The IPsec transform set is misconfigured.

Answer

The Phase 2 lifetime is longer than Phase 1.

Question 6

A network engineer is configuring a remote access VPN using Cisco AnyConnect on an ASA. The engineer wants to use certificate-based authentication. The ASA is configured with a CA server. After configuration, users can connect, but they are prompted for a username and password instead of using certificates. The engineer checks the ASA configuration and sees that the tunnel group has authentication method set to AAA. What should the engineer do to fix this?

Accepted Answer

Change the tunnel group authentication method to certificate.. For certificate-based authentication, the tunnel group must be configured to use certificate authentication. If it is set to AAA, the ASA will prompt for credentials. Option D is correct because the authentication method must be changed. Option A is incorrect because the CA is already configured. Option B is incorrect because the connection profile is not the issue. Option C is incorrect because the group policy does not control authentication method.

Answer

Re-enroll the CA certificate on the ASA.

Answer

Change the connection profile to use the correct group.

Answer

Configure the group policy to require certificates.

Question 7

An engineer is configuring a site-to-site VPN between two Cisco routers using IPsec with IKEv2. The engineer wants to use a pre-shared key. The configuration on both routers includes: crypto ikev2 proposal default, encryption aes-cbc-256, integrity sha256, group 14. The engineer also configures crypto ikev2 keyring and crypto ikev2 profile. The tunnel does not establish. The engineer sees that the IKEv2 SA is not created. What is the most likely missing configuration?

Accepted Answer

The IKEv2 profile is not attached to the crypto map or interface.. In IKEv2, the crypto ikev2 profile must be applied to the interface or the crypto map. Without applying the profile, the router will not use the configured keyring and proposal. Option B is correct because the profile must be attached. Option A is incorrect because the proposal is configured. Option C is incorrect because the transform set is for IPsec, not IKE. Option D is incorrect because the keyring is configured.

Answer

The IKEv2 proposal is not configured correctly.

Answer

The IPsec transform set is missing.

Answer

The pre-shared key is not defined in the keyring.

Question 8

A network engineer is configuring a DMVPN Phase 3 network. The hub router is a Cisco 4500X and the spokes are Cisco 4321s. The engineer wants to enable spoke-to-spoke direct communication. After configuration, the spokes can communicate via the hub, but not directly. The engineer checks the NHRP cache on a spoke and sees that it has a mapping for the other spoke's tunnel IP to the hub's physical IP. What is the most likely cause?

Accepted Answer

The hub is not configured with NHRP redirect.. In DMVPN Phase 3, spokes must use NHRP redirect and shortcut routes to enable direct spoke-to-spoke communication. If the hub is not configured with the NHRP redirect feature, the spokes will not receive the redirect messages, and traffic will continue to go through the hub. Option C is correct because the hub must have NHRP redirect enabled. Option A is incorrect because the spokes are registered. Option B is incorrect because the routing protocol is working. Option D is incorrect because the tunnel mode is correct.

Answer

The NHRP network ID is mismatched between the spokes.

Answer

The routing protocol is not redistributing spoke routes.

Answer

The spokes are using GRE instead of mGRE.

Question 9

An engineer is configuring a site-to-site VPN between two Cisco routers using IPsec with IKEv1. The engineer configures a crypto map on the outside interface. The tunnel establishes, but only traffic from one direction is encrypted. For example, traffic from Router A to Router B is encrypted, but traffic from Router B to Router A is not. The engineer checks the crypto map on Router B and finds that it is not applied to the correct interface. What is the most likely issue?

Accepted Answer

The crypto map is not applied to the outside interface on Router B.. For IPsec to work bidirectionally, the crypto map must be applied to the outside interface on both routers. If it is missing on one side, that router will not encrypt outgoing traffic. Option A is correct because the crypto map is not applied on Router B. Option B is incorrect because the access list is not the issue. Option C is incorrect because the transform set is used for encryption. Option D is incorrect because the peer is configured.

Answer

The access list on Router B is missing the permit statement for the traffic.

Answer

The transform set on Router B is different from Router A.

Answer

The peer address on Router B is configured incorrectly.

Question 10

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa
dst             src             state          conn-id slot
10.1.1.2        10.1.1.1        MM_NO_STATE       1       0

Based on this output, what can be concluded?

Accepted Answer

IKE Phase 1 is in progress but not yet complete.. The MM_NO_STATE indicates that the IKE Phase 1 negotiation has not progressed past the initial state. This typically means that the remote peer is not responding or the ISAKMP policy does not match.

Answer

The IPsec VPN tunnel is fully established and passing traffic.

Answer

The ISAKMP SA has been deleted due to a timeout.

Answer

The remote peer has rejected the IKE proposal.

Question 11

A network engineer runs the following command on Router R2:

R2# show crypto ipsec sa peer 10.2.2.2
interface: Tunnel0
    Crypto map tag: CMAP, local addr 10.1.1.2
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
   current_peer 10.2.2.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 1500, #pkts encrypt: 1500, #pkts digest: 1500
    #pkts decaps: 1200, #pkts decrypt: 1200, #pkts verify: 1200
    #pkts compressed: 0, #pkts decompress: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

Based on this output, what can be concluded?

Accepted Answer

There is a routing problem causing packets to be dropped in one direction.. The packet counters show 1500 packets encapsulated (sent) but only 1200 decapsulated (received). This asymmetry indicates possible packet loss or a routing issue in one direction.

Answer

The IPsec tunnel is functioning correctly with no issues.

Answer

The tunnel is using compression, as shown by the compress counters.

Answer

The remote peer is not responding to IKE requests.

Question 12

A network engineer runs the following command on Router R3:

R3# show dmvpn
Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete
        N: NATed, L: Local, X: No Socket
# Ent -> Number of NHRP entries with same NBMA peer
NHS Status: E => Expecting Replies, R => Responding, W => Waiting
UpDn Time -> Up or Down Time for a Tunnel
==========================================================================
Interface: Tunnel0, IPv4 NHRP Details
Type:Hub, NHRP Peers:2,

# Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
 ----- --------------- --------------- ----- -------- -----
     1 192.168.1.1     10.0.0.1        UP    00:12:34  D
     1 192.168.1.2     10.0.0.2        UP    00:10:20  D

Based on this output, what can be concluded?

Accepted Answer

There are two active spoke routers connected to this hub.. The output shows a DMVPN hub with two spoke peers (10.0.0.1 and 10.0.0.2) both in UP state. The 'D' attribute indicates they are dynamically learned, which is normal for spokes. The hub has two active NHRP peers.

Answer

This router is a spoke in the DMVPN network.

Answer

The tunnel interface is down because no peers are listed.

Answer

The router is using static NHRP mappings for all peers.

Question 13

A network engineer runs the following command on Router R4:

R4# show mpls ldp neighbor
    Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0
        TCP connection: 10.0.0.2.646 - 10.0.0.1.54567
        State: Oper; Msgs sent/rcvd: 100/95; Downstream
        Up time: 00:15:30
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 10.0.0.2
        Addresses bound to peer LDP Ident:
          10.0.0.2        192.168.1.1

Based on this output, what can be concluded?

Accepted Answer

The LDP session is established over the GigabitEthernet0/0 interface.. The LDP session is operational (State: Oper) with a peer at 10.0.0.2. The discovery source is GigabitEthernet0/0, indicating the session is established over that interface. The peer has two addresses bound.

Answer

The LDP session is down due to a TCP connection issue.

Answer

The peer is not sending any LDP messages.

Answer

The local router has only one label binding for the peer.

Question 14

A network engineer runs the following command on Router R5:

R5# show ip route vrf CUSTOMER-A

Routing Table: CUSTOMER-A
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.1.1.1 to network 0.0.0.0

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C       10.1.1.0/24 is directly connected, GigabitEthernet0/0
B       10.2.2.0/24 [20/0] via 10.1.1.1, 00:10:20

Based on this output, what can be concluded?

Accepted Answer

The VRF has a default route pointing to 10.1.1.1.. The VRF CUSTOMER-A has a BGP route (10.2.2.0/24) learned from 10.1.1.1 with administrative distance 20 (EBGP). The gateway of last resort is set to 10.1.1.1, indicating a default route via that next hop.

Answer

The VRF has no routes and is not functional.

Answer

The route 10.2.2.0/24 is learned via OSPF.

Answer

The BGP route is sourced from an internal BGP peer.

Question 15

A network engineer runs the following command on Router R6:

R6# show ip bgp vpnv4 all summary

BGP router identifier 10.0.0.6, local AS number 65000
BGP table version is 10, main routing table version 10
10 network entries using 1440 bytes of memory
10 path entries using 800 bytes of memory
4/3 BGP path/bestpath attribute entries using 576 bytes of memory
2 BGP AS-PATH entries using 48 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
Bitfield cache entries: current 1 (at peak 2) using 32 bytes of memory
BGP using 2896 total bytes of memory
BGP activity 20/10 prefixes, 20/10 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.0.7        4        65001    1000    1000       10    0    0 00:20:00        5
10.0.0.8        4        65002     500     500       10    0    0 00:10:00        3

Based on this output, what can be concluded?

Accepted Answer

The router is receiving VPNv4 prefixes from both neighbors.. The BGP summary shows two VPNv4 neighbors: 10.0.0.7 (AS 65001) and 10.0.0.8 (AS 65002). The State/PfxRcd column shows 5 and 3 prefixes received respectively, meaning both peers are exchanging VPN routes. The local AS is 65000, making these EBGP sessions.

Answer

Both BGP sessions are in the Idle state.

Answer

The BGP table has no entries because the table version is 10.

Answer

The neighbor 10.0.0.8 is not configured for VPNv4.

Question 16

A network engineer runs the following command on Router R7:

R7# show crypto ikev2 sa detail

IKEv2 SAs:

Session-id:1, Status:UP-ACTIVE, IKE count:1, Child count:1

Tunnel-id Local              Remote               Status         Role
   1         10.1.1.1/4500      10.2.2.2/4500        READY          INITIATOR
      Encr: AES-CBC 256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/3600 sec

Child SA: Local selector  10.1.1.0/0 - 10.1.1.255/65535
             Remote selector 10.2.2.0/0 - 10.2.2.255/65535
             ESP spi in/out: 0x12345678/0x87654321

Based on this output, what can be concluded?

Accepted Answer

The tunnel is using pre-shared keys for authentication.. The IKEv2 SA is UP-ACTIVE with status READY. The encryption is AES-CBC 256, hash SHA256, DH Group 14, and authentication is PSK. The tunnel is working correctly.

Answer

The IKEv2 SA is in a failed state because it is READY.

Answer

The tunnel is using RSA signatures for authentication.

Answer

The IKEv2 SA has expired because the life time is 86400 seconds.

Question 17

A network engineer runs the following command on Router R8:

R8# show ip nhrp

10.0.0.1/32 via 10.0.0.1
   Tunnel0 created 00:10:00, expire 01:50:00
   Type: dynamic, Flags: unique registered
   NBMA address: 192.168.1.1
10.0.0.2/32 via 10.0.0.2
   Tunnel0 created 00:05:00, expire 01:55:00
   Type: dynamic, Flags: unique registered
   NBMA address: 192.168.1.2

Based on this output, what can be concluded?

Accepted Answer

The router is a DMVPN hub with two registered spokes.. The NHRP cache shows two dynamic entries for 10.0.0.1 and 10.0.0.2 with NBMA addresses 192.168.1.1 and 192.168.1.2. Both are registered and unique, indicating a DMVPN spoke registration.

Answer

The router has static NHRP mappings configured.

Answer

The NHRP entries are about to expire because the expire time is less than 2 hours.

Answer

The router is a spoke because it has only two entries.

Question 18

A network engineer runs the following command on Router R9:

R9# show ip interface tunnel 0
Tunnel0 is up, line protocol is up
  Internet address is 10.0.0.9/24
  Broadcast address is 255.255.255.255
  Address determined by non-volatile memory
  MTU is 1400 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is disabled
  Local Proxy ARP is disabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP CEF switching is enabled
  IP CEF switching turbo vector
  IP Null turbo vector
  IP multicast fast switching is enabled
  IP multicast distributed fast switching is disabled
  IP route-cache flags are Fast, CEF
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Probe proxy name replies are disabled
  Policy routing is disabled
  Network address translation is disabled
  WCCP Redirect outbound is disabled
  WCCP Redirect inbound is disabled
  WCCP Redirect exclude is disabled
  BGP Policy Mapping is disabled

Based on this output, what can be concluded?

Accepted Answer

The MTU of 1400 bytes suggests this is a GRE or IPsec tunnel.. The tunnel interface is up/up with an MTU of 1400 bytes. The MTU is reduced from the default 1500, which is typical for GRE/IPsec tunnels to accommodate encapsulation overhead. This indicates the tunnel is likely a GRE or IPsec tunnel.

Answer

The tunnel is down because the line protocol is up.

Answer

The tunnel is using IP compression because TCP/IP header compression is disabled.

Answer

The tunnel has a helper address configured for DHCP.

Question 19

Given the following configuration on a Cisco IOS-XE router:

interface Tunnel100
 ip address 10.0.0.1 255.255.255.252
 tunnel source GigabitEthernet0/0/0
 tunnel destination 192.168.1.1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile MYPROFILE

What is the effect of this configuration?

Accepted Answer

It creates a VTI (Virtual Tunnel Interface) that encrypts all traffic routed into the tunnel using IPsec.. This configuration creates a point-to-point tunnel interface that uses IPsec to encrypt traffic between the local router and the remote peer at 192.168.1.1. The tunnel mode ipsec ipv4 enables IPsec encapsulation of IPv4 packets, and the tunnel protection command applies an IPsec profile for encryption.

Answer

It creates a GRE tunnel with IPsec encryption.

Answer

It creates a DMVPN phase 1 tunnel with mGRE.

Answer

It creates a L2TPv3 tunnel for layer 2 transport.

Question 20

Examine the following IPsec configuration snippet:

crypto ikev2 proposal IKEV2_PROP
 encryption aes-cbc-256
 integrity sha256
 group 14
!
crypto ikev2 policy IKEV2_POL
 proposal IKEV2_PROP
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac
 mode tunnel
!
crypto ipsec profile IPSEC_PROF
 set transform-set TSET
 set ikev2-profile IKEV2_POL

Which statement about this configuration is true?

Accepted Answer

The transform set uses ESP with AES-256 encryption and SHA-256 HMAC for authentication.. The configuration defines an IKEv2 proposal with AES-256 encryption, SHA-256 integrity, and Diffie-Hellman group 14. The IPsec transform set uses AES-256 and SHA-256. The IPsec profile references both the transform set and the IKEv2 profile. However, the IKEv2 policy is not directly used in the profile; the profile uses the IKEv2 profile, not the policy. The correct statement is that the transform set uses ESP with AES-256 encryption and SHA-256 HMAC.

Answer

The IKEv2 proposal uses AES-256, SHA-256, and DH group 14, but the IPsec profile will not apply because the ikev2-profile command is missing the 'set' keyword.

Answer

The transform set is configured in transport mode, which is incorrect for site-to-site VPN.

Answer

The IPsec profile is incomplete because it does not include a PFS (Perfect Forward Secrecy) setting.

350-401 VPN Technologies — All Questions With Answers

What is the default IKEv1 (ISAKMP) lifetime in seconds on Cisco IOS routers?

Which IPsec protocol provides both encryption and authentication within a single ESP header?

In a DMVPN phase 2 network, what is the primary advantage of using phase 2 over phase 1?

Drag and drop the steps of IKEv2 IPsec tunnel establishment into the correct order, from first to last.

Drag and drop the steps of configuring a site-to-site IPsec VPN on Cisco IOS into the correct order, from first to last.

Drag and drop the steps of DMVPN Phase 3 NHRP registration and spoke-to-spoke tunnel establishment into the correct order, from first to last.

Drag and drop the steps of DMVPN Phase 2 NHRP resolution process into the correct order, from first to last.

Drag and drop the steps of GET VPN key server registration and rekey into the correct order, from first to last.

Drag and drop the steps of SSL VPN (AnyConnect) session establishment into the correct order, from first to last.

Drag and drop the steps of FlexVPN spoke-to-spoke dynamic tunnel creation into the correct order, from first to last.

Drag and drop the steps of IKEv2 fragmentation and DPD keepalive process into the correct order, from first to last.

Drag and drop the steps of DMVPN Phase 2 NHRP resolution process into the correct order, from first to last.

Drag and drop the steps of GET VPN key server registration and rekey into the correct order, from first to last.

Drag and drop the steps of SSL VPN (AnyConnect) session establishment into the correct order, from first to last.

Drag and drop the steps of FlexVPN spoke-to-spoke dynamic tunnel creation into the correct order, from first to last.

Drag and drop the steps of IKEv2 fragmentation and DPD keepalive process into the correct order, from first to last.

Drag and drop each VPN type on the left to its matching tunnel technology on the right.

Drag and drop each IKEv2 exchange on the left to its matching phase on the right.

Drag and drop each IPsec mode on the left to its matching header usage on the right.

Drag and drop each security protocol on the left to its matching provided security service on the right.

Drag and drop each DMVPN phase on the left to its matching NHRP operation type on the right.

Drag and drop each VPN type on the left to its matching tunnel technology on the right.

Drag and drop each IKEv2 exchange on the left to its matching phase on the right.

Drag and drop each IPsec mode on the left to its matching header usage on the right.

Drag and drop each security protocol on the left to its matching service on the right.

Drag and drop each DMVPN phase on the left to its matching NHRP operation type on the right.

Which two statements about IPsec IKEv2 are true? (Choose two.)

Which two statements about DMVPN phase 2 are true? (Choose two.)

Which three statements about MPLS Layer 3 VPNs are true? (Choose three.)

Which three statements about FlexVPN are true? (Choose three.)

Which two statements about IPsec IKEv2 are true? (Choose two.)

Which three statements about MPLS Layer 3 VPNs are true? (Choose three.)

Which two statements about DMVPN Phase 2 are true? (Choose two.)

Which three statements about SSL VPNs are true? (Choose three.)

350-401 VPN Technologies — All Questions With Answers

What is the default IKEv1 (ISAKMP) lifetime in seconds on Cisco IOS routers?

Which IPsec protocol provides both encryption and authentication within a single ESP header?

In a DMVPN phase 2 network, what is the primary advantage of using phase 2 over phase 1?

Drag and drop the steps of IKEv2 IPsec tunnel establishment into the correct order, from first to last.

Drag and drop the steps of configuring a site-to-site IPsec VPN on Cisco IOS into the correct order, from first to last.

Drag and drop the steps of DMVPN Phase 3 NHRP registration and spoke-to-spoke tunnel establishment into the correct order, from first to last.

Drag and drop the steps of DMVPN Phase 2 NHRP resolution process into the correct order, from first to last.

Drag and drop the steps of GET VPN key server registration and rekey into the correct order, from first to last.

Drag and drop the steps of SSL VPN (AnyConnect) session establishment into the correct order, from first to last.

Drag and drop the steps of FlexVPN spoke-to-spoke dynamic tunnel creation into the correct order, from first to last.

Drag and drop the steps of IKEv2 fragmentation and DPD keepalive process into the correct order, from first to last.

Drag and drop the steps of DMVPN Phase 2 NHRP resolution process into the correct order, from first to last.

Drag and drop the steps of GET VPN key server registration and rekey into the correct order, from first to last.

Drag and drop the steps of SSL VPN (AnyConnect) session establishment into the correct order, from first to last.

Drag and drop the steps of FlexVPN spoke-to-spoke dynamic tunnel creation into the correct order, from first to last.

Drag and drop the steps of IKEv2 fragmentation and DPD keepalive process into the correct order, from first to last.

Drag and drop each VPN type on the left to its matching tunnel technology on the right.

Drag and drop each IKEv2 exchange on the left to its matching phase on the right.

Drag and drop each IPsec mode on the left to its matching header usage on the right.

Drag and drop each security protocol on the left to its matching provided security service on the right.

Drag and drop each DMVPN phase on the left to its matching NHRP operation type on the right.

Drag and drop each VPN type on the left to its matching tunnel technology on the right.

Drag and drop each IKEv2 exchange on the left to its matching phase on the right.

Drag and drop each IPsec mode on the left to its matching header usage on the right.

Drag and drop each security protocol on the left to its matching service on the right.

Drag and drop each DMVPN phase on the left to its matching NHRP operation type on the right.

Which two statements about IPsec IKEv2 are true? (Choose two.)

Which two statements about DMVPN phase 2 are true? (Choose two.)

Which three statements about MPLS Layer 3 VPNs are true? (Choose three.)

Which three statements about FlexVPN are true? (Choose three.)

Which two statements about IPsec IKEv2 are true? (Choose two.)

Which three statements about MPLS Layer 3 VPNs are true? (Choose three.)

Which two statements about DMVPN Phase 2 are true? (Choose two.)

Which three statements about SSL VPNs are true? (Choose three.)