Quick Answer

The answer is Phase 3, because it is the only DMVPN phase that dynamically establishes spoke-to-spoke tunnels using NHRP redirect and shortcut mechanisms. In Phase 1, all traffic must traverse the hub, offering no direct spoke-to-spoke capability. Phase 2 does allow direct tunnels, but it relies on static NHRP mappings, meaning the spoke must know the destination spoke’s address in advance, which limits scalability and flexibility. Phase 3 solves this by having the hub send an NHRP redirect to the source spoke, which then dynamically learns the destination spoke’s real address via an NHRP resolution request, creating a direct tunnel only when needed. On the ENCOR 350-401 exam, this distinction often appears in drag-and-drop or scenario-based questions testing your understanding of NHRP behavior. A common trap is confusing Phase 2’s direct tunnels with Phase 3’s dynamic capability—remember that Phase 2 requires pre-configured static mappings, while Phase 3 is fully dynamic. Memory tip: “Phase 3 is the shortcut king—it redirects and resolves on the fly.”