300-410 VPN Technologies Practice Question
A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology on Cisco IOS routers. The hub router must dynamically learn spoke-to-spoke routes and allow direct spoke-to-spoke tunnels. Which command must be configured on the hub's tunnel interface to enable Phase 3 behavior?
⚠ Common exam trap
Many exam-takers confuse the hub-side redirect command with the spoke-side shortcut command, which are complementary but configured on different routers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ip nhrp redirect
In DMVPN Phase 3, the hub uses NHRP redirect to inform spokes about a more optimal path to another spoke, and spokes use NHRP shortcut to install a direct route. The hub must have ip nhrp redirect configured on its tunnel interface. The other options are either spoke-side commands or general NHRP parameters that do not enable Phase 3 behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ip nhrp map multicast dynamic
Why it's wrong here
The ip nhrp map multicast dynamic command enables the hub to replicate multicast packets to dynamically learned spokes, which is used for routing protocol multicast over DMVPN. It is not specific to Phase 3 and does not enable spoke-to-spoke shortcut tunnels. This command is typically used in Phase 1 and Phase 2 as well.
- ✗
ip nhrp network-id 1
Why it's wrong here
The ip nhrp network-id command assigns a network ID to the NHRP domain and must match on all routers in the same DMVPN cloud. It is a basic NHRP configuration requirement but does not enable Phase 3 functionality. Without network-id, NHRP would not form correctly, but it does not provide redirect or shortcut capabilities.
- ✗
ip nhrp shortcut
Why it's wrong here
The ip nhrp shortcut command is configured on spoke routers, not on the hub. It allows a spoke to use a shortcut path when it receives an NHRP redirect from the hub. Configuring it on the hub would not enable Phase 3 behavior and could cause unexpected NHRP processing. The hub requires ip nhrp redirect to signal better paths.
- ✓
ip nhrp redirect
Why this is correct
The ip nhrp redirect command on the hub enables NHRP redirect messages, which notify spokes of a better path to another spoke, allowing direct spoke-to-spoke tunnels. This is a key requirement for DMVPN Phase 3. Without it, spokes continue to route through the hub. It works with ip nhrp shortcut on spokes to achieve dynamic spoke-to-spoke connectivity.
Go deeper
Related to this question
Learn chapter
Introduction to ENARSI Exam and Network Fundamentals
Key term
DMVPN Phase 3
DMVPN Phase 3 is a Cisco networking technology that allows branch offices to connect directly to each other without always going through a central hub, but with smarter routing that lets the hub control the traffic paths more efficiently.
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.