350-401 · topic practice
Practise ENCOR 350-401 Vpn Technologies practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.
Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.
What the exam tests
Vpn Technologies questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Watch out for
Practice set
20 questions · select your answer, then reveal the explanation
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
Applied to data traffic for SLA-based path selection
Applied to enable NetFlow-like traffic monitoring
Applied to modify forwarding, NAT, or QoS on data packets
Applied to OMP routes and TLOCs for route manipulation
Applied to define which VPNs are provisioned on a device
Trap 1: The vEdge routers have not been rebooted after the policy change.
Incorrect because policy changes take effect immediately without reboot.
Trap 2: The OMP graceful restart timer has expired, causing the vEdge to…
Incorrect because OMP graceful restart affects route convergence, not policy application.
Trap 3: The BFD sessions between vEdge and vSmart are flapping.
Incorrect because BFD is for data plane failure detection, not for policy distribution.
The vEdge routers have not been rebooted after the policy change.
Why wrong: Incorrect because policy changes take effect immediately without reboot.
The control policy is not attached to the appropriate site list or VPN list.
Correct because a control policy must be associated with a list to be applied; otherwise, it is not enforced.
The OMP graceful restart timer has expired, causing the vEdge to ignore the policy.
Why wrong: Incorrect because OMP graceful restart affects route convergence, not policy application.
The BFD sessions between vEdge and vSmart are flapping.
Why wrong: Incorrect because BFD is for data plane failure detection, not for policy distribution.
Drag a concept onto its matching description — or click a concept then click the description.
Hub-and-spoke with NHRP registration
Spoke-to-spoke dynamic tunnel via NHRP resolution request/reply
NHRP with prefix-based spoke-to-spoke shortcut
Trap 1: Phase 4: NHRP with BGP for routing
Incorrect. There is no standard DMVPN Phase 4; DMVPN only has three phases.
Trap 2: Phase 5: NHRP with OSPF for routing
Incorrect. There is no standard DMVPN Phase 5; DMVPN only has three phases.
Phase 1: Hub-and-spoke with NHRP registration
Correct. Phase 1 uses NHRP for hub registration.
Phase 2: Spoke-to-spoke dynamic tunnel via NHRP resolution request/reply
Correct. Phase 2 uses NHRP for spoke-to-spoke dynamic tunnel via resolution request/reply.
Phase 3: NHRP with prefix-based spoke-to-spoke shortcut
Correct. Phase 3 uses NHRP with prefix-based spoke-to-spoke shortcut.
Phase 4: NHRP with BGP for routing
Why wrong: Incorrect. There is no standard DMVPN Phase 4; DMVPN only has three phases.
Phase 5: NHRP with OSPF for routing
Why wrong: Incorrect. There is no standard DMVPN Phase 5; DMVPN only has three phases.
Trap 1: The IKEv2 proposal is not configured correctly.
The proposal is configured with valid parameters.
Trap 2: The IPsec transform set is missing.
The transform set is for Phase 2, not Phase 1.
Trap 3: The pre-shared key is not defined in the keyring.
The keyring is configured, but not applied.
The IKEv2 proposal is not configured correctly.
Why wrong: The proposal is configured with valid parameters.
The IKEv2 profile is not attached to the crypto map or interface.
Correct because the profile must be applied to activate the configuration.
The IPsec transform set is missing.
Why wrong: The transform set is for Phase 2, not Phase 1.
The pre-shared key is not defined in the keyring.
Why wrong: The keyring is configured, but not applied.
Trap 1: The hub router must be configured with a static crypto map for each…
Incorrect because DMVPN uses dynamic crypto maps (or IPsec profiles) on the hub to accept connections from any spoke.
Trap 2: Data traffic between spokes is forwarded through the hub by default.
Incorrect because in phase 2, once the direct spoke-to-spoke tunnel is established, traffic bypasses the hub.
Spokes can dynamically establish direct tunnels with each other after learning the destination spoke's public address via NHRP.
Correct because in phase 2, NHRP allows spokes to resolve the public IP of other spokes and build direct mGRE tunnels.
The hub router must be configured with a static crypto map for each spoke.
Why wrong: Incorrect because DMVPN uses dynamic crypto maps (or IPsec profiles) on the hub to accept connections from any spoke.
Data traffic between spokes is forwarded through the hub by default.
Why wrong: Incorrect because in phase 2, once the direct spoke-to-spoke tunnel is established, traffic bypasses the hub.
Routing protocols such as EIGRP or OSPF can be run over the DMVPN tunnel interfaces.
Correct because DMVPN supports dynamic routing protocols over the mGRE tunnel interfaces for route exchange.
NHRP redirect and shortcut features are used to enable spoke-to-spoke communication.
Correct because NHRP redirect (on hub) and shortcut (on spoke) are key mechanisms in phase 2 to trigger direct tunnel setup.
Drag a concept onto its matching description — or click a concept then click the description.
Carries IPv4 VPN routes with MPLS labels across the provider core
Carries IPv6 VPN routes with MPLS labels across the provider core
Carries global IPv4 unicast routes (non-VPN)
Carries global IPv6 unicast routes (non-VPN)
Carries Layer 2 VPN information such as pseudowires and VPLS
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
Forwards MPLS packets by performing label lookup and swapping
Pushes labels on ingress and pops labels on egress
Core router that swaps labels without pushing or popping
Edge router that connects customer sites and runs MPLS VPNs
Customer edge router that connects to the PE
Trap 1: P routers in the MPLS core must maintain a full routing table for…
Incorrect because P routers only need IGP routes to forward MPLS packets; they do not participate in VPN routing.
Trap 2: CE routers must run MPLS and participate in the label distribution…
Incorrect because CE routers are standard IP routers; they do not run MPLS and exchange only IP routes with the PE.
Trap 3: The MPLS label stack in a Layer 3 VPN always contains exactly one…
Incorrect because the label stack typically has two labels: an IGP label (for transport) and a VPN label (for the egress PE).
PE routers use MP-BGP to exchange VPNv4 routes that include the route distinguisher and the VPN label.
Correct because MP-BGP carries VPNv4 routes (with route distinguisher) and the VPN label in the NLRI, enabling MPLS Layer 3 VPN operation.
P routers in the MPLS core must maintain a full routing table for each customer VRF.
Why wrong: Incorrect because P routers only need IGP routes to forward MPLS packets; they do not participate in VPN routing.
CE routers must run MPLS and participate in the label distribution with the PE router.
Why wrong: Incorrect because CE routers are standard IP routers; they do not run MPLS and exchange only IP routes with the PE.
Each VRF on a PE router maintains a separate routing table and forwarding table per customer.
Correct because a VRF creates an isolated routing and forwarding instance for each customer on the PE.
The MPLS label stack in a Layer 3 VPN always contains exactly one label.
Why wrong: Incorrect because the label stack typically has two labels: an IGP label (for transport) and a VPN label (for the egress PE).
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Trap 1: The MPLS core routers (P routers) maintain full VPN routing tables…
Incorrect because P routers only swap MPLS labels and do not maintain VPN routing tables; they are label-switching routers.
Trap 2: Route targets (RT) are used to uniquely identify each customer VPN…
Incorrect because route distinguishers (RD) ensure uniqueness of VPN prefixes, while RTs control route import/export policies.
Customer edge (CE) routers exchange routing information with provider edge (PE) routers using static routing, RIP, OSPF, EIGRP, or BGP.
Correct because PE-CE routing can use any of these protocols, as supported by the provider's configuration.
VRF (Virtual Routing and Forwarding) instances are used on PE routers to maintain separate routing tables for each VPN customer.
Correct because VRFs isolate customer routes on the PE, ensuring traffic separation.
MP-BGP (Multiprotocol BGP) is used between PE routers to exchange VPNv4 routes, which include an RD and RT.
Correct because MP-BGP carries VPN-IPv4 prefixes with route distinguishers (RD) and route targets (RT) for VPN membership.
The MPLS core routers (P routers) maintain full VPN routing tables to forward traffic based on customer IP prefixes.
Why wrong: Incorrect because P routers only swap MPLS labels and do not maintain VPN routing tables; they are label-switching routers.
Route targets (RT) are used to uniquely identify each customer VPN across the provider network.
Why wrong: Incorrect because route distinguishers (RD) ensure uniqueness of VPN prefixes, while RTs control route import/export policies.
Trap 1: All traffic must pass through the hub router at all times.
Incorrect because Phase 2 allows direct spoke-to-spoke traffic after the initial setup.
Trap 2: Phase 2 uses only point-to-point GRE tunnels on the hub.
Incorrect because DMVPN uses multipoint GRE (mGRE) on the hub.
Trap 3: Phase 2 does not support dynamic routing protocols between spokes.
Incorrect because Phase 2 supports dynamic routing (e.g., EIGRP, OSPF) between spokes.
Spokes can establish direct tunnels to each other without traversing the hub.
Correct because Phase 2 enables spoke-to-spoke dynamic tunnels.
All traffic must pass through the hub router at all times.
Why wrong: Incorrect because Phase 2 allows direct spoke-to-spoke traffic after the initial setup.
NHRP is used to resolve the public IP addresses of spokes.
Correct because NHRP maps tunnel IP addresses to physical addresses.
Phase 2 uses only point-to-point GRE tunnels on the hub.
Why wrong: Incorrect because DMVPN uses multipoint GRE (mGRE) on the hub.
Phase 2 does not support dynamic routing protocols between spokes.
Why wrong: Incorrect because Phase 2 supports dynamic routing (e.g., EIGRP, OSPF) between spokes.
Trap 1: DMVPN phase 2 requires mGRE on the hub only; spokes use…
Incorrect because both hub and spokes must use mGRE to support multiple tunnel endpoints; point-to-point GRE would limit connectivity.
Trap 2: DMVPN phase 2 supports only IPsec protection and cannot operate…
Incorrect because DMVPN can operate without IPsec, though encryption is recommended for security; it is not mandatory.
Trap 3: In DMVPN phase 2, spoke routers must be configured with static…
Incorrect because DMVPN uses IPsec profiles and dynamic crypto maps, not static crypto maps, to allow dynamic peer negotiation.
In DMVPN phase 2, spoke routers can establish direct tunnels to each other without traffic passing through the hub.
Correct because phase 2 enables spoke-to-spoke dynamic tunnels after the hub provides the peer's NBMA address via NHRP.
DMVPN phase 2 requires mGRE on the hub only; spokes use point-to-point GRE tunnels.
Why wrong: Incorrect because both hub and spokes must use mGRE to support multiple tunnel endpoints; point-to-point GRE would limit connectivity.
NHRP redirect messages are used in phase 2 to inform spokes of better paths to remote destinations.
Correct because the hub sends NHRP redirects to trigger spokes to initiate direct NHRP resolution and establish spoke-to-spoke tunnels.
DMVPN phase 2 supports only IPsec protection and cannot operate without encryption.
Why wrong: Incorrect because DMVPN can operate without IPsec, though encryption is recommended for security; it is not mandatory.
In DMVPN phase 2, spoke routers must be configured with static crypto maps for IPsec.
Why wrong: Incorrect because DMVPN uses IPsec profiles and dynamic crypto maps, not static crypto maps, to allow dynamic peer negotiation.
Trap 1: IKEv2 uses TCP port 500 for control plane messages.
Incorrect because IKEv2 uses UDP, not TCP.
Trap 2: IKEv2 requires a separate IPsec SA for each direction of traffic.
Incorrect because IKEv2 creates a pair of SAs (one per direction) as part of the same exchange, but this is not a separate requirement.
Trap 3: IKEv2 is not compatible with certificate-based authentication.
Incorrect because IKEv2 fully supports certificate-based authentication.
IKEv2 uses UDP port 500 for initial negotiation and can switch to UDP 4500 for NAT traversal.
Correct because IKEv2 uses UDP 500 and 4500 for NAT-T.
IKEv2 supports EAP authentication for remote access VPNs.
Correct because IKEv2 natively supports EAP for client authentication.
IKEv2 uses TCP port 500 for control plane messages.
Why wrong: Incorrect because IKEv2 uses UDP, not TCP.
IKEv2 requires a separate IPsec SA for each direction of traffic.
Why wrong: Incorrect because IKEv2 creates a pair of SAs (one per direction) as part of the same exchange, but this is not a separate requirement.
IKEv2 is not compatible with certificate-based authentication.
Why wrong: Incorrect because IKEv2 fully supports certificate-based authentication.
Trap 1: SD-WAN edge devices can only use MPLS or Internet as transport; LTE…
Incorrect because LTE is supported as a transport type in addition to MPLS and Internet.
Trap 2: OMP is responsible for dynamically establishing IPsec tunnels…
Incorrect because OMP distributes routes and policies; IPsec tunnels are built based on TLOC reachability, not directly by OMP.
Control plane communication between vSmart and edge devices uses DTLS or TLS encryption.
Correct because the control plane (vSmart to edge) uses DTLS by default, with TLS as an option.
Data plane tunnels between edge devices are encrypted using IPsec with IKEv2 key exchange.
Correct because IPsec is used for secure data plane tunnels between vEdge/cEdge routers.
A TLOC (Transport Location) is defined by the combination of system IP, color, and encapsulation type.
Correct because TLOC is uniquely identified by the system IP, color, and encapsulation (IPsec/GRE).
SD-WAN edge devices can only use MPLS or Internet as transport; LTE is not supported.
Why wrong: Incorrect because LTE is supported as a transport type in addition to MPLS and Internet.
OMP is responsible for dynamically establishing IPsec tunnels between edge devices based on policy.
Why wrong: Incorrect because OMP distributes routes and policies; IPsec tunnels are built based on TLOC reachability, not directly by OMP.
Drag a concept onto its matching description — or click a concept then click the description.
OMP route exchange and BGP/OSPF peering
IPsec tunnel encapsulation and packet forwarding
CLI, REST API, and web-based administration
vBond-based device authentication and onboarding
Telemetry collection and application visibility
Trap 1: VRF-lite supports MPLS VPN inter-AS option B.
Incorrect because VRF-lite does not include MPLS functionality.
Trap 2: VRF-lite requires BGP as the routing protocol between VRFs.
Incorrect because VRF-lite can use any routing protocol or static routes.
VRF-lite allows multiple routing instances on a single router using static or dynamic routing protocols.
Correct because VRF-lite supports RIP, EIGRP, OSPF, and static routes per VRF.
VRF-lite does not require MPLS to operate.
Correct because VRF-lite is a pure Layer 3 VPN without label switching.
VRF-lite provides path isolation by maintaining separate forwarding tables.
Correct because each VRF has independent routing and forwarding tables.
VRF-lite supports MPLS VPN inter-AS option B.
Why wrong: Incorrect because VRF-lite does not include MPLS functionality.
VRF-lite requires BGP as the routing protocol between VRFs.
Why wrong: Incorrect because VRF-lite can use any routing protocol or static routes.
Trap 1: The VRF is not configured with a route distinguisher.
Incorrect because a route distinguisher is required for VPNv4 routes, but the question states the routes are not being advertised; the RD might be missing, but that would cause a different error. However, the most common missing step is the BGP VRF configuration.
Trap 2: The route-target import/export values are incorrect.
Incorrect because route-targets affect route import/export on other PEs, not the advertisement from this PE.
Trap 3: The interface in the VRF is not configured with the ipv4 address.
Incorrect because the interface has an IP address, otherwise the VRF would not have any routes to advertise.
The VRF is not configured with a route distinguisher.
Why wrong: Incorrect because a route distinguisher is required for VPNv4 routes, but the question states the routes are not being advertised; the RD might be missing, but that would cause a different error. However, the most common missing step is the BGP VRF configuration.
The engineer did not configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and redistribute the routes.
Correct because without this, the VRF routes are not injected into BGP VPNv4.
The route-target import/export values are incorrect.
Why wrong: Incorrect because route-targets affect route import/export on other PEs, not the advertisement from this PE.
The interface in the VRF is not configured with the ipv4 address.
Why wrong: Incorrect because the interface has an IP address, otherwise the VRF would not have any routes to advertise.
Free account
Create a free account to save your results and see which topics improve across sessions.
Focused Vpn Technologies sessions
Every question in these sessions is drawn from the Vpn Technologies domain — nothing else.
Related practice questions
Move into related areas when this topic feels solid.
Sharpen your 350-401 knowledge of Architecture.
Work through 350-401 questions on Virtualization.
Practise 350-401 questions linked to Infrastructure.
Sharpen your 350-401 knowledge of Network Assurance.
Security practice questions for 350-401.
Work through 350-401 questions on Automation.
Practise eBGP/iBGP peering, path attributes, route selection and BGP troubleshooting.
Practise OSPF area types, LSA types, neighbour states and multi-area design.
Practise EIGRP DUAL, metrics, stub routing and route redistribution.
Practise VLAN configuration, trunk negotiation and inter-VLAN routing.
Practise RSTP, MSTP, port roles and STP protection features.
Practise extended ACLs, CoPP rate-limiting and control-plane protection.
A free account saves results across sessions and highlights which topics need work.
Sign up free