300-410 VPN Technologies Practice Question
A network administrator is troubleshooting a DMVPN Phase 3 hub-and-spoke network using mGRE and NHRP. Spoke-to-spoke communication is failing, but spoke-to-hub communication works. The administrator verifies that NHRP registrations are successful and that the hub is configured with 'ip nhrp redirect'. What is the most likely cause of the spoke-to-spoke failure?
⚠ Common exam trap
The trap here is assuming that 'ip nhrp redirect' on the hub is sufficient; the spokes must also have 'ip nhrp shortcut'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The spokes are not configured with 'ip nhrp shortcut'.
In DMVPN Phase 3, spoke-to-spoke communication requires the hub to send NHRP redirect messages and the spokes to have 'ip nhrp shortcut' configured. The shortcut allows spokes to dynamically create direct tunnels upon receiving a redirect. Without it, spokes continue to route through the hub, and direct spoke-to-spoke communication does not occur.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The hub is missing 'ip nhrp map multicast dynamic'.
Why it's wrong here
'ip nhrp map multicast dynamic' is used on the hub to allow multicast traffic to be replicated to spokes, which is important for routing protocols. However, it is not required for unicast spoke-to-spoke communication. The failure is specifically about unicast traffic, so this is not the cause.
- ✗
The hub is not configured with 'ip nhrp redirect'.
Why it's wrong here
The scenario explicitly states that the hub is configured with 'ip nhrp redirect'. Therefore, this cannot be the cause. The missing piece is likely on the spokes, which need 'ip nhrp shortcut' to act on the redirect messages and establish direct tunnels.
- ✓
The spokes are not configured with 'ip nhrp shortcut'.
Why this is correct
In DMVPN Phase 3, the hub uses 'ip nhrp redirect' to inform spokes of a better path, but the spokes must have 'ip nhrp shortcut' to dynamically create a direct tunnel to the destination spoke. Without it, spokes continue to send traffic through the hub, and spoke-to-spoke communication fails to optimize.
- ✗
The spokes are not configured with 'ip nhrp network-id'.
Why it's wrong here
'ip nhrp network-id' must match on all DMVPN routers to form the NHRP network. If it were mismatched, NHRP registration would fail, but the scenario states registrations are successful. Therefore, this is not the cause of the spoke-to-spoke failure.
Go deeper
Related to this question
Learn chapter
Device Management and Network Monitoring (SNMP, Syslog, NetFlow)
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
Key term
DMVPN Phase 3
DMVPN Phase 3 is a Cisco networking technology that allows branch offices to connect directly to each other without always going through a central hub, but with smarter routing that lets the hub control the traffic paths more efficiently.
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.