350-401 VPN Technologies Practice Test 1 — 15 Questions

Question 1

A network engineer is configuring a site-to-site IPsec VPN between two Cisco routers. The engineer wants to ensure that the VPN tunnel uses the strongest possible encryption and authentication algorithms. The engineer configures the following: crypto isakmp policy 10, authentication pre-share, encryption aes-256, group 14, lifetime 86400. On the remote router, the engineer configures: crypto isakmp policy 10, authentication pre-share, encryption aes-256, group 14, lifetime 86400. The tunnel fails to establish. What is the most likely cause?

Accepted Answer

The hash algorithm is not specified and defaults may differ between routers.. The IKE policy parameters must match exactly on both peers. In this scenario, the policies appear identical, but a common oversight is that the hash algorithm (e.g., SHA-256) is not specified in the policy; the default is MD5 or SHA-1 depending on IOS version. If one router uses default SHA-1 and the other uses MD5, the mismatch will prevent Phase 1 from completing. Option B is correct because the hash algorithm mismatch is a frequent cause of failure. Option A is incorrect because the lifetimes match. Option C is incorrect because group 14 is valid. Option D is incorrect because pre-shared keys can be used with strong encryption.

Answer

The lifetimes are set too high; they should be 3600 seconds.

Answer

The Diffie-Hellman group 14 is not supported on these routers.

Answer

Pre-shared keys cannot be used with AES-256 encryption.

Question 2

A network engineer is tasked with deploying a DMVPN Phase 2 network for a company with multiple branch offices. The hub router is a Cisco 4451-X and the spoke routers are Cisco 4331s. After configuration, the spokes can ping the hub's tunnel IP, but cannot reach each other's tunnel IPs. The engineer checks the routing tables and sees that the hub has routes for both spoke subnets, but the spokes do not have routes to each other. What is the most likely cause?

Accepted Answer

The hub is not configured to propagate spoke routes to other spokes.. In DMVPN Phase 2, spokes learn about other spoke networks via the hub using dynamic routing (e.g., EIGRP or OSPF). The hub must be configured to propagate spoke routes to other spokes. If the hub is not configured to redistribute or advertise the spoke subnets, the spokes will not have routes to each other. Option C is correct because the hub must have a routing configuration that allows spoke-to-spoke route propagation. Option A is incorrect because NHRP is used for mapping, not routing. Option B is incorrect because spoke-to-spoke tunnels are established dynamically via NHRP. Option D is incorrect because mGRE is the correct interface type for DMVPN.

Answer

The NHRP network ID is mismatched between the hub and spokes.

Answer

The spokes are not configured with a crypto map for IPsec.

Answer

The tunnel mode is set to GRE instead of mGRE on the spokes.

Question 3

An engineer is configuring a FlexVPN hub-and-spoke network. The hub router has a loopback0 with IP 10.0.0.1/32. The spokes are configured to use IKEv2 with certificates. The engineer notices that the spokes can establish the IKEv2 tunnel and can ping the hub's tunnel IP, but cannot reach the loopback0 address. The hub has a static route for the spoke subnets. What is the most likely issue?

Accepted Answer

The loopback0 is not advertised in the routing protocol.. In FlexVPN, the tunnel IP addresses are typically used for routing, and the loopback may not be advertised into the routing protocol or may not be reachable via the tunnel interface. If the hub's loopback is not included in the routing updates (e.g., via a network statement in EIGRP or OSPF), the spokes will not have a route to it. Option D is correct because the loopback is not being advertised. Option A is incorrect because IKEv2 is working. Option B is incorrect because certificates are not the issue. Option C is incorrect because the tunnel itself is up.

Answer

The IKEv2 proposal does not match between hub and spoke.

Answer

The certificate authority is not trusted by the hub.

Answer

The tunnel interface is not in an up/up state.

Question 4

A network engineer is configuring a GETVPN solution for a large enterprise with many remote sites. The engineer wants to ensure that all traffic between sites is encrypted using a common group key. The key server (KS) is a Cisco ASR 1000. After configuration, the group members (GMs) can register with the KS, but traffic between GMs is not encrypted. The engineer checks the KS configuration and sees that the crypto gdoi group has been defined with a transform set and a security association. What is the most likely missing configuration?

Accepted Answer

The KS is missing an access list to define the traffic to encrypt.. In GETVPN, the KS must define a traffic selector (access list) that specifies which traffic to encrypt. Without a proper access list, the KS will not send the policy to the GMs, and traffic will pass in the clear. Option A is correct because the access list is missing. Option B is incorrect because the group name is not the issue. Option C is incorrect because the KS does not need an IPsec profile. Option D is incorrect because GMs can be in different subnets.

Answer

The group name on the GMs does not match the KS.

Answer

The KS is not configured with an IPsec profile.

Answer

The GMs are in different IP subnets than the KS.

Question 5

An engineer is troubleshooting a site-to-site VPN between a Cisco ASA and a Cisco IOS router. The VPN is configured using IKEv1 with pre-shared keys. The tunnel establishes and traffic flows, but after a few hours, the tunnel drops and re-establishes. The engineer checks the logs and sees that the Phase 1 SA is being rekeyed. What is the most likely reason for the tunnel dropping?

Accepted Answer

The IKE Phase 1 lifetime is set too low.. IKE Phase 1 SAs have a lifetime; when the lifetime expires, the SA is rekeyed. If the rekey fails or is delayed, the tunnel may drop temporarily. Option B is correct because the lifetime expiration is the most common cause. Option A is incorrect because DPD is used to detect dead peers, not cause drops. Option C is incorrect because rekeying is normal. Option D is incorrect because the Phase 2 lifetime is separate.

Answer

The Dead Peer Detection (DPD) interval is too short.

Answer

The IPsec transform set is misconfigured.

Answer

The Phase 2 lifetime is longer than Phase 1.

Question 6

A network engineer is configuring a remote access VPN using Cisco AnyConnect on an ASA. The engineer wants to use certificate-based authentication. The ASA is configured with a CA server. After configuration, users can connect, but they are prompted for a username and password instead of using certificates. The engineer checks the ASA configuration and sees that the tunnel group has authentication method set to AAA. What should the engineer do to fix this?

Accepted Answer

Change the tunnel group authentication method to certificate.. For certificate-based authentication, the tunnel group must be configured to use certificate authentication. If it is set to AAA, the ASA will prompt for credentials. Option D is correct because the authentication method must be changed. Option A is incorrect because the CA is already configured. Option B is incorrect because the connection profile is not the issue. Option C is incorrect because the group policy does not control authentication method.

Answer

Re-enroll the CA certificate on the ASA.

Answer

Change the connection profile to use the correct group.

Answer

Configure the group policy to require certificates.

Question 7

An engineer is configuring a site-to-site VPN between two Cisco routers using IPsec with IKEv2. The engineer wants to use a pre-shared key. The configuration on both routers includes: crypto ikev2 proposal default, encryption aes-cbc-256, integrity sha256, group 14. The engineer also configures crypto ikev2 keyring and crypto ikev2 profile. The tunnel does not establish. The engineer sees that the IKEv2 SA is not created. What is the most likely missing configuration?

Accepted Answer

The IKEv2 profile is not attached to the crypto map or interface.. In IKEv2, the crypto ikev2 profile must be applied to the interface or the crypto map. Without applying the profile, the router will not use the configured keyring and proposal. Option B is correct because the profile must be attached. Option A is incorrect because the proposal is configured. Option C is incorrect because the transform set is for IPsec, not IKE. Option D is incorrect because the keyring is configured.

Answer

The IKEv2 proposal is not configured correctly.

Answer

The IPsec transform set is missing.

Answer

The pre-shared key is not defined in the keyring.

Question 8

A network engineer is configuring a DMVPN Phase 3 network. The hub router is a Cisco 4500X and the spokes are Cisco 4321s. The engineer wants to enable spoke-to-spoke direct communication. After configuration, the spokes can communicate via the hub, but not directly. The engineer checks the NHRP cache on a spoke and sees that it has a mapping for the other spoke's tunnel IP to the hub's physical IP. What is the most likely cause?

Accepted Answer

The hub is not configured with NHRP redirect.. In DMVPN Phase 3, spokes must use NHRP redirect and shortcut routes to enable direct spoke-to-spoke communication. If the hub is not configured with the NHRP redirect feature, the spokes will not receive the redirect messages, and traffic will continue to go through the hub. Option C is correct because the hub must have NHRP redirect enabled. Option A is incorrect because the spokes are registered. Option B is incorrect because the routing protocol is working. Option D is incorrect because the tunnel mode is correct.

Answer

The NHRP network ID is mismatched between the spokes.

Answer

The routing protocol is not redistributing spoke routes.

Answer

The spokes are using GRE instead of mGRE.

Question 9

An engineer is configuring a site-to-site VPN between two Cisco routers using IPsec with IKEv1. The engineer configures a crypto map on the outside interface. The tunnel establishes, but only traffic from one direction is encrypted. For example, traffic from Router A to Router B is encrypted, but traffic from Router B to Router A is not. The engineer checks the crypto map on Router B and finds that it is not applied to the correct interface. What is the most likely issue?

Accepted Answer

The crypto map is not applied to the outside interface on Router B.. For IPsec to work bidirectionally, the crypto map must be applied to the outside interface on both routers. If it is missing on one side, that router will not encrypt outgoing traffic. Option A is correct because the crypto map is not applied on Router B. Option B is incorrect because the access list is not the issue. Option C is incorrect because the transform set is used for encryption. Option D is incorrect because the peer is configured.

Answer

The access list on Router B is missing the permit statement for the traffic.

Answer

The transform set on Router B is different from Router A.

Answer

The peer address on Router B is configured incorrectly.

Question 10

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa
dst             src             state          conn-id slot
10.1.1.2        10.1.1.1        MM_NO_STATE       1       0

Based on this output, what can be concluded?

Accepted Answer

IKE Phase 1 is in progress but not yet complete.. The MM_NO_STATE indicates that the IKE Phase 1 negotiation has not progressed past the initial state. This typically means that the remote peer is not responding or the ISAKMP policy does not match.

Answer

The IPsec VPN tunnel is fully established and passing traffic.

Answer

The ISAKMP SA has been deleted due to a timeout.

Answer

The remote peer has rejected the IKE proposal.

Question 11

A network engineer runs the following command on Router R2:

R2# show crypto ipsec sa peer 10.2.2.2
interface: Tunnel0
    Crypto map tag: CMAP, local addr 10.1.1.2
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
   current_peer 10.2.2.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 1500, #pkts encrypt: 1500, #pkts digest: 1500
    #pkts decaps: 1200, #pkts decrypt: 1200, #pkts verify: 1200
    #pkts compressed: 0, #pkts decompress: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

Based on this output, what can be concluded?

Accepted Answer

There is a routing problem causing packets to be dropped in one direction.. The packet counters show 1500 packets encapsulated (sent) but only 1200 decapsulated (received). This asymmetry indicates possible packet loss or a routing issue in one direction.

Answer

The IPsec tunnel is functioning correctly with no issues.

Answer

The tunnel is using compression, as shown by the compress counters.

Answer

The remote peer is not responding to IKE requests.

Question 12

A network engineer runs the following command on Router R3:

R3# show dmvpn
Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete
        N: NATed, L: Local, X: No Socket
# Ent -> Number of NHRP entries with same NBMA peer
NHS Status: E => Expecting Replies, R => Responding, W => Waiting
UpDn Time -> Up or Down Time for a Tunnel
==========================================================================
Interface: Tunnel0, IPv4 NHRP Details
Type:Hub, NHRP Peers:2,

# Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
 ----- --------------- --------------- ----- -------- -----
     1 192.168.1.1     10.0.0.1        UP    00:12:34  D
     1 192.168.1.2     10.0.0.2        UP    00:10:20  D

Based on this output, what can be concluded?

Accepted Answer

There are two active spoke routers connected to this hub.. The output shows a DMVPN hub with two spoke peers (10.0.0.1 and 10.0.0.2) both in UP state. The 'D' attribute indicates they are dynamically learned, which is normal for spokes. The hub has two active NHRP peers.

Answer

This router is a spoke in the DMVPN network.

Answer

The tunnel interface is down because no peers are listed.

Answer

The router is using static NHRP mappings for all peers.

Question 13

A network engineer runs the following command on Router R4:

R4# show mpls ldp neighbor
    Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0
        TCP connection: 10.0.0.2.646 - 10.0.0.1.54567
        State: Oper; Msgs sent/rcvd: 100/95; Downstream
        Up time: 00:15:30
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 10.0.0.2
        Addresses bound to peer LDP Ident:
          10.0.0.2        192.168.1.1

Based on this output, what can be concluded?

Accepted Answer

The LDP session is established over the GigabitEthernet0/0 interface.. The LDP session is operational (State: Oper) with a peer at 10.0.0.2. The discovery source is GigabitEthernet0/0, indicating the session is established over that interface. The peer has two addresses bound.

Answer

The LDP session is down due to a TCP connection issue.

Answer

The peer is not sending any LDP messages.

Answer

The local router has only one label binding for the peer.

Question 14

A network engineer runs the following command on Router R5:

R5# show ip route vrf CUSTOMER-A

Routing Table: CUSTOMER-A
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.1.1.1 to network 0.0.0.0

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C       10.1.1.0/24 is directly connected, GigabitEthernet0/0
B       10.2.2.0/24 [20/0] via 10.1.1.1, 00:10:20

Based on this output, what can be concluded?

Accepted Answer

The VRF has a default route pointing to 10.1.1.1.. The VRF CUSTOMER-A has a BGP route (10.2.2.0/24) learned from 10.1.1.1 with administrative distance 20 (EBGP). The gateway of last resort is set to 10.1.1.1, indicating a default route via that next hop.

Answer

The VRF has no routes and is not functional.

Answer

The route 10.2.2.0/24 is learned via OSPF.

Answer

The BGP route is sourced from an internal BGP peer.

Question 15

A network engineer runs the following command on Router R6:

R6# show ip bgp vpnv4 all summary

BGP router identifier 10.0.0.6, local AS number 65000
BGP table version is 10, main routing table version 10
10 network entries using 1440 bytes of memory
10 path entries using 800 bytes of memory
4/3 BGP path/bestpath attribute entries using 576 bytes of memory
2 BGP AS-PATH entries using 48 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
Bitfield cache entries: current 1 (at peak 2) using 32 bytes of memory
BGP using 2896 total bytes of memory
BGP activity 20/10 prefixes, 20/10 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.0.7        4        65001    1000    1000       10    0    0 00:20:00        5
10.0.0.8        4        65002     500     500       10    0    0 00:10:00        3

Based on this output, what can be concluded?

Accepted Answer

The router is receiving VPNv4 prefixes from both neighbors.. The BGP summary shows two VPNv4 neighbors: 10.0.0.7 (AS 65001) and 10.0.0.8 (AS 65002). The State/PfxRcd column shows 5 and 3 prefixes received respectively, meaning both peers are exchanging VPN routes. The local AS is 65000, making these EBGP sessions.

Answer

Both BGP sessions are in the Idle state.

Answer

The BGP table has no entries because the table version is 10.

Answer

The neighbor 10.0.0.8 is not configured for VPNv4.