300-410 VPN Technologies Practice Question
A network engineer is deploying DMVPN Phase 3 with NHRP and wants spoke-to-spoke traffic to be built directly between spokes without traversing the hub after initial resolution. On the hub router, the engineer issues the command 'ip nhrp redirect' on the tunnel interface and 'ip nhrp shortcut' on each spoke tunnel interface. After configuration, spokes can reach the hub but spoke-to-spoke traffic still hairpins through the hub. Which additional configuration is required on the spoke routers for the shortcut path to be installed?
⚠ Common exam trap
The trap here is assuming that enabling 'ip nhrp shortcut' and 'ip nhrp redirect' alone is sufficient, when the spoke still needs a route covering the destination spoke prefix to trigger resolution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure the routing protocol on the spokes has a route to the destination spoke's tunnel network, typically via a summary or default from the hub, so traffic triggers NHRP resolution.
DMVPN Phase 3 shortcut switching requires the spoke to have a route covering the remote spoke prefix so that forwarded traffic triggers an NHRP resolution. The hub uses 'ip nhrp redirect' to notify spokes of a better path, and the spoke uses 'ip nhrp shortcut' to act on that notification. Without a route toward the destination spoke network, the spoke never originates the resolution and the shortcut never installs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable 'ip nhrp map multicast dynamic' on the spoke tunnel interfaces.
Why it's wrong here
This command is used on the hub tunnel interface to allow dynamic multicast NHRP mappings from spokes; it has no role in installing a spoke shortcut path. Applying it on the spoke does not create the NHRP resolution shortcut and therefore does not change the hairpin behavior observed in this scenario.
- ✗
Enable 'ip nhrp network-id' with the same value on all spoke tunnel interfaces.
Why it's wrong here
Matching network IDs are required for NHRP registration and resolution to work at all, but the scenario already shows registration succeeding since spokes reach the hub. The network-id alone does not install a shortcut route; the spoke still lacks the triggered resolution mechanism that shortcut relies on.
- ✓
Ensure the routing protocol on the spokes has a route to the destination spoke's tunnel network, typically via a summary or default from the hub, so traffic triggers NHRP resolution.
Why this is correct
For NHRP shortcut to install a direct path, the spoke must have a route pointing to the destination prefix through the tunnel, causing the packet to trigger an NHRP resolution request. Without reachability to the destination spoke subnet (often via a hub summary or default route), no resolution is triggered and traffic continues to hairpin through the hub.
- ✗
Configure the tunnel interface with 'ip nhrp nhs <hub-NBMA>' so the spoke registers to the hub.
Why it's wrong here
Configuring the NHS address is a prerequisite for basic NHRP registration and is already implied by the spokes reaching the hub. It does not by itself trigger the shortcut installation; the spoke still needs the resolution request originated by traffic to the destination spoke's NBMA address.
Go deeper
Related to this question
Learn chapter
Device Management and Network Monitoring (SNMP, Syslog, NetFlow)
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
Key term
DMVPN Phase 3
DMVPN Phase 3 is a Cisco networking technology that allows branch offices to connect directly to each other without always going through a central hub, but with smarter routing that lets the hub control the traffic paths more efficiently.
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.