300-410 VPN Technologies Practice Question
A network engineer is configuring a site-to-site DMVPN Phase 3 hub router. The hub uses a single mGRE tunnel interface with the IP address 10.0.0.1/24. Spoke routers are configured with NHS 10.0.0.1 and are in the same subnet. The engineer wants spoke-to-spoke traffic to bypass the hub after the initial resolution. Which command must be configured on the hub to enable Phase 3 shortcut switching?
⚠ Common exam trap
It's easy for candidates to confuse the hub-side and spoke-side commands, thinking that ip nhrp shortcut is configured on the hub when it is actually a spoke command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ip nhrp redirect
In DMVPN Phase 3, the hub must be configured with ip nhrp redirect to send redirect messages to spokes when it forwards traffic to another spoke. The spokes must have ip nhrp shortcut to act on those redirects. Together, they allow spoke-to-spoke direct tunnels after initial hub-based resolution. The hub's role is to redirect, so ip nhrp redirect is the correct command on the hub.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ip nhrp shortcut
Why it's wrong here
The ip nhrp shortcut command is configured on the spoke routers, not the hub. It allows the spoke to accept NHRP redirect messages and install a shortcut entry in its routing table. Without this command on the spokes, the redirect from the hub would be ignored, but this command alone on the hub does not enable Phase 3 functionality.
- ✗
ip nhrp network-id 100
Why it's wrong here
The ip nhrp network-id command assigns a network identifier to the NHRP domain. It must match on all routers in the same DMVPN cloud, but it does not enable Phase 3 shortcut switching. It is a basic NHRP parameter required for any DMVPN phase, not specific to Phase 3.
- ✗
ip nhrp map multicast dynamic
Why it's wrong here
This command enables dynamic multicast mapping on the hub, allowing the hub to replicate multicast packets to spokes that register via NHRP. It is commonly used for routing protocols over DMVPN but does not enable Phase 3 shortcut switching. It is a multicast feature, not a unicast shortcut mechanism.
- ✓
ip nhrp redirect
Why this is correct
The ip nhrp redirect command on the hub enables NHRP redirect messages, which inform the originating spoke that a better path exists directly to the destination spoke. This triggers the spoke to send an NHRP resolution request for the destination's NBMA address, allowing the spoke to build a direct tunnel, which is the defining behavior of DMVPN Phase 3.
Visual reference
Go deeper
Related to this question
Learn chapter
Site-to-Site VPN and IPSec
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
Key term
DMVPN Phase 3
DMVPN Phase 3 is a Cisco networking technology that allows branch offices to connect directly to each other without always going through a central hub, but with smarter routing that lets the hub control the traffic paths more efficiently.
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.