300-410 VPN Technologies Practice Question
A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology. Spokes should be able to communicate directly with each other without traffic traversing the hub. The hub router interface is already configured with 'ip nhrp network-id 1' and 'ip nhrp map multicast dynamic'. Which additional command must be configured on the hub to allow spoke-to-spoke direct tunnels?
⚠ Common exam trap
Test-takers frequently confuse the hub-side command 'ip nhrp redirect' with the spoke-side command 'ip nhrp shortcut', or assuming that multicast mapping alone enables spoke-to-spoke tunnels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ip nhrp redirect
In DMVPN Phase 3, the hub uses 'ip nhrp redirect' to notify spokes of a better path to another spoke. The spoke then uses 'ip nhrp shortcut' to create a direct tunnel. The hub must have 'ip nhrp redirect' configured to enable this behavior. The other options are either already configured or belong on the spoke.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ip nhrp shortcut
Why it's wrong here
'ip nhrp shortcut' is configured on the spokes, not the hub. It allows the spoke to intercept traffic and use a shortcut path when an NHRP redirect is received. Configuring it on the hub does not enable spoke-to-spoke tunnels and is not the required command for the hub.
- ✗
ip nhrp network-id 1
Why it's wrong here
This command is also already configured on the hub. It defines the NHRP network ID, which must match on all routers in the DMVPN cloud. It does not trigger spoke-to-spoke shortcut tunnels; it is a basic NHRP parameter required for any DMVPN phase.
- ✗
ip nhrp map multicast dynamic
Why it's wrong here
This command is already present on the hub per the scenario. It enables the hub to dynamically learn multicast mappings for spokes, which is necessary for routing protocols but does not itself enable spoke-to-spoke direct tunnels. It is a prerequisite, not the additional command needed.
- ✓
ip nhrp redirect
Why this is correct
The 'ip nhrp redirect' command on the hub enables NHRP redirect messages, which inform the originating spoke that a shorter path exists to the destination spoke. This allows the spoke to initiate a direct tunnel, achieving Phase 3 behavior. Without it, spokes continue to route through the hub.
Go deeper
Related to this question
Learn chapter
DMVPN and FlexVPN Technologies
Key term
DMVPN Phase 3
DMVPN Phase 3 is a Cisco networking technology that allows branch offices to connect directly to each other without always going through a central hub, but with smarter routing that lets the hub control the traffic paths more efficiently.
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.