300-410 VPN Technologies Practice Question
A network engineer is configuring a DMVPN Phase 3 network with mGRE and NHRP. The hub router must be able to dynamically learn spoke routes and advertise them to other spokes. Which two statements are true regarding the configuration of the hub to support spoke-to-spoke communication in DMVPN Phase 3? (Choose two.)
⚠ Common exam trap
It's easy for candidates to confuse where 'ip nhrp shortcut' is configured; it belongs on the spokes, not the hub, and is essential for them to use the redirect messages.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The hub must have a route to all spoke networks, either through a routing protocol or summary route.
In DMVPN Phase 3, the hub must be configured with 'ip nhrp redirect' to inform spokes of a better direct path, and it must have a route to all spoke networks to provide initial connectivity and forwarding. The spokes require 'ip nhrp shortcut' to act on redirects. The other options are either not specific to Phase 3 or are configured on spokes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The hub must have 'ip nhrp shortcut' configured on its tunnel interface.
Why it's wrong here
'ip nhrp shortcut' is configured on the spokes, not the hub. It allows the spoke to intercept packets that are being sent to the hub for a destination that is reachable directly, and instead send an NHRP resolution request for the destination. On the hub, this command is not used. Therefore, configuring it on the hub would not achieve the desired Phase 3 behavior.
- ✓
The hub must have a route to all spoke networks, either through a routing protocol or summary route.
Why this is correct
In DMVPN Phase 3, the hub still needs to know how to reach all spoke networks to provide initial connectivity and to forward traffic when a direct tunnel is not yet established. This is typically achieved by running a routing protocol on the hub and spokes, or by configuring a summary route on the hub. Without this, the hub cannot route traffic to the correct spoke, and spoke-to-spoke communication may fail.
- ✓
The hub must have 'ip nhrp redirect' configured on its tunnel interface.
Why this is correct
'ip nhrp redirect' is a key command on the hub in DMVPN Phase 3. It enables the hub to send NHRP redirect messages to spokes when it receives a packet from one spoke destined to another spoke's network. This informs the source spoke that a direct path exists, prompting it to resolve the destination spoke's NBMA address and establish a direct tunnel. Without this, spoke-to-spoke communication would continue to go through the hub.
- ✗
The hub must have 'ip nhrp network-id' configured with the same value as the spokes.
Why it's wrong here
The 'ip nhrp network-id' is a mandatory configuration on all DMVPN routers, including the hub and spokes, to identify the NHRP network. While it is required for NHRP to function, it is not specific to enabling spoke-to-spoke communication in Phase 3. The question asks for two statements that are true regarding the hub configuration to support spoke-to-spoke communication, and this is a general requirement, not a specific Phase 3 feature.
- ✗
The hub must have 'ip nhrp map multicast dynamic' configured to support multicast traffic.
Why it's wrong here
'ip nhrp map multicast dynamic' is typically configured on the hub in DMVPN to allow it to replicate multicast and broadcast traffic to all registered spokes. While it is a common command for multicast support, it is not specifically required for spoke-to-spoke unicast communication in Phase 3. The question focuses on spoke-to-spoke communication, which relies on NHRP redirect and shortcut. Thus, this command is not one of the two required statements.
Go deeper
Related to this question
Learn chapter
Device Management and Network Monitoring (SNMP, Syslog, NetFlow)
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
Key term
DMVPN Phase 3
DMVPN Phase 3 is a Cisco networking technology that allows branch offices to connect directly to each other without always going through a central hub, but with smarter routing that lets the hub control the traffic paths more efficiently.
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.