300-410 VPN Technologies Practice Question
A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE and NHRP. Spoke routers are behind dynamic NAT and cannot be reached directly. The engineer wants spoke-to-spoke traffic to bypass the hub after initial resolution. Which NHRP command on the spoke routers enables this behavior?
⚠ Common exam trap
Many candidates confuse the hub-side command ip nhrp redirect with the spoke-side command ip nhrp shortcut; both are required, but they are applied on different routers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ip nhrp shortcut
In DMVPN Phase 3, the hub uses ip nhrp redirect to inform a spoke that a better path exists directly to another spoke. The spoke must have ip nhrp shortcut enabled to act on that redirect and install a direct tunnel. Together, these commands allow spoke-to-spoke traffic to bypass the hub after the initial packet flow, reducing latency and hub load.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ip nhrp redirect
Why it's wrong here
The ip nhrp redirect command is configured on the hub router, not on spokes. It enables the hub to send an NHRP redirect message to the source spoke when it detects traffic flowing through the hub to another spoke, prompting the source to initiate a direct tunnel. Placing it on spokes has no effect because spokes do not forward transit traffic between other spokes in a Phase 3 DMVPN.
- ✗
ip nhrp map multicast dynamic
Why it's wrong here
The ip nhrp map multicast dynamic command is used on the hub router to enable dynamic multicast mapping for routing protocols over DMVPN. It allows the hub to replicate multicast packets to spokes that register via NHRP. This command does not enable spoke-to-spoke direct tunnels and is not configured on spokes for that purpose; it is specific to multicast traffic handling on the hub.
- ✗
ip nhrp network-id 1
Why it's wrong here
The ip nhrp network-id command assigns a network identifier to the mGRE interface and must match on all routers in the same DMVPN cloud. While required for NHRP operation, it does not enable spoke-to-spoke shortcut tunnels. It simply ensures that NHRP packets are associated with the correct DMVPN network; it has no role in triggering or permitting dynamic direct tunnels between spokes.
- ✓
ip nhrp shortcut
Why this is correct
The ip nhrp shortcut command is configured on spoke routers in a DMVPN Phase 3 topology. When a spoke receives an NHRP redirect from the hub, the shortcut command allows it to dynamically create a direct mGRE tunnel to the destination spoke, bypassing the hub for subsequent packets. Without this command, the spoke would continue sending traffic through the hub even after receiving the redirect.
Visual reference
Go deeper
Related to this question
Learn chapter
DMVPN and FlexVPN Technologies
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
Key term
DMVPN Phase 3
DMVPN Phase 3 is a Cisco networking technology that allows branch offices to connect directly to each other without always going through a central hub, but with smarter routing that lets the hub control the traffic paths more efficiently.
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.