300-410 VPN Technologies Practice Question
A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology. The hub router is a Cisco IOS XE device running a recent release. The engineer notices that spoke-to-spoke traffic is still traversing the hub even though the spokes have established direct tunnels. Which technology must be enabled on the hub to allow spoke routers to dynamically discover a direct path to other spokes?
⚠ Common exam trap
Many candidates confuse NHRP redirect (hub) with NHRP shortcut (spoke), assuming either alone enables direct spoke-to-spoke tunnels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable NHRP redirect on the hub.
In DMVPN Phase 3, the hub uses NHRP redirect to notify a source spoke that a more optimal path exists to a destination spoke. The spoke must have NHRP shortcut enabled to act on the redirect and initiate direct tunnel creation. Together, they allow dynamic spoke-to-spoke tunnels without preconfiguration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable OSPF point-to-multipoint on the hub.
Why it's wrong here
OSPF network type affects adjacency formation and route propagation, but it does not trigger direct spoke-to-spoke tunnels. In DMVPN Phase 3, the hub must use NHRP redirect to signal better paths. OSPF point-to-multipoint might be used for other reasons, but it is not the mechanism for dynamic spoke-to-spoke tunnels.
- ✓
Enable NHRP redirect on the hub.
Why this is correct
NHRP redirect on the hub informs the originating spoke that a better path exists to the destination spoke. The hub sends an NHRP redirect message to the source spoke, which then initiates an NHRP resolution for the destination spoke's NBMA address. This enables the spoke to build a direct tunnel, bypassing the hub for subsequent packets.
- ✗
Enable NHRP shortcut on the hub.
Why it's wrong here
NHRP shortcut is configured on the spoke routers, not the hub. It allows the spoke to accept and act on NHRP redirect messages from the hub. Without shortcut on the spokes, they cannot dynamically create direct tunnels even if the hub sends redirects. The hub does not use shortcut for this purpose.
- ✗
Enable IPsec tunnel protection on the hub.
Why it's wrong here
IPsec tunnel protection secures the GRE tunnel traffic but does not influence path selection or spoke-to-spoke direct tunnel creation. It is unrelated to NHRP redirect or shortcut functionality. While IPsec is common in DMVPN, it does not enable dynamic spoke-to-spoke communication by itself.
Go deeper
Related to this question
Learn chapter
Device Management and Network Monitoring (SNMP, Syslog, NetFlow)
Key term
DMVPN Phase 3
DMVPN Phase 3 is a Cisco networking technology that allows branch offices to connect directly to each other without always going through a central hub, but with smarter routing that lets the hub control the traffic paths more efficiently.
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.