300-410 VPN Technologies Practice Question
A network engineer is deploying GET VPN with Cisco IOS routers to provide any-to-any encrypted communication over a private MPLS WAN. The design requires that a router joining the group automatically receives the current group security policy from the group controller without any manual pre-shared key configuration on the member. Which protocol should the engineer configure to dynamically distribute the group encryption keys from the key server to the group members?
⚠ Common exam trap
It's easy for candidates to confuse the IKE phase 1 protocol used for registration with the group key management protocol that actually distributes the group encryption keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GDOI
GET VPN relies on GDOI for group key management. The key server (group controller/key server) distributes the group security policy and encryption keys to registered group members via rekey messages, enabling scalable any-to-any encryption over a private WAN without point-to-point tunnels. GDOI is the protocol that dynamically distributes the group encryption keys, satisfying the requirement for automatic key delivery without manual pre-shared key configuration on each member.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
GDOI
Why this is correct
GDOI is the group key management protocol used by GET VPN. The key server acts as the group controller/key server, and group members register with it using a group identity and IKE phase 1, then receive the rekey messages containing the IPsec SA policy and TEK/KEK keys. This allows automatic, scalable key distribution without per-member manual pre-shared key configuration, matching the scenario requirement exactly.
- ✗
IKEv2
Why it's wrong here
IKEv2 is a point-to-point key exchange protocol used for standard IPsec and FlexVPN. It does not provide group key distribution or rekey messages to multiple members from a single controller. While GET VPN uses IKE phase 1 for registration, IKEv2 alone cannot dynamically distribute group encryption keys to all members, so it fails to meet the automatic group policy delivery requirement.
- ✗
ISAKMP
Why it's wrong here
ISAKMP is the framework for authentication and key exchange used by IKE, but it is not a group key distribution protocol. GET VPN uses GDOI, which runs over ISAKMP, to deliver group keys. Simply configuring ISAKMP does not provide the group controller function or rekey mechanism needed to automatically distribute encryption keys to multiple group members, so it is not the correct choice.
- ✗
NHRP
Why it's wrong here
NHRP is the Next Hop Resolution Protocol used in DMVPN to map tunnel IP addresses to NBMA addresses and enable spoke-to-spoke tunnels. It has no role in group key management or distributing IPsec encryption keys. Configuring NHRP in a GET VPN deployment would not deliver group security policy or keys to members, making it incorrect for this scenario.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
AAA and Device Access Security
Key term
GET VPN
Group Encrypted Transport VPN is a Cisco technology that secures IP multicast and unicast traffic across a wide area network using a shared security association rather than point-to-point tunnels.
Key term
LDP Protocol
LDP, or Label Distribution Protocol, is a protocol that routers use to automatically exchange labels that enable MPLS (Multiprotocol Label Switching) to create fast, efficient paths for data packets across a network.
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.