300-410 VPN Technologies Practice Question
A network engineer is implementing DMVPN Phase 3 with IPsec tunnel protection. The hub router must be configured to support NHRP redirect. Which command is required on the hub's tunnel interface?
⚠ Common exam trap
It's easy for candidates to confuse the commands used on the hub versus the spokes; ip nhrp shortcut is for spokes, while ip nhrp redirect is for the hub.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ip nhrp redirect
The ip nhrp redirect command on the hub's tunnel interface is required for DMVPN Phase 3. It allows the hub to inform spokes about a better path when traffic is received on the same interface, prompting the spoke to initiate a direct tunnel. Without this command, the hub cannot send redirect messages, and spoke-to-spoke tunnels will not form dynamically.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ip nhrp shortcut
Why it's wrong here
The ip nhrp shortcut command is configured on spoke routers to allow them to use NHRP resolution to create shortcut routes. It is not used on the hub. On the hub, the required command is ip nhrp redirect. Configuring shortcut on the hub would not enable redirect functionality.
- ✗
ip nhrp network-id 1
Why it's wrong here
The ip nhrp network-id command assigns a network ID for the NHRP domain, which must match on all routers. While necessary for NHRP operation, it does not specifically enable redirect. The redirect feature is enabled separately with ip nhrp redirect.
- ✓
ip nhrp redirect
Why this is correct
The ip nhrp redirect command enables the hub to send NHRP redirect messages to spokes when it receives traffic on the same tunnel interface. This is essential for Phase 3 DMVPN, allowing spokes to learn a better path and build direct tunnels. Without it, spokes continue to route through the hub.
- ✗
ip nhrp map multicast dynamic
Why it's wrong here
The ip nhrp map multicast dynamic command enables the hub to dynamically learn multicast mappings for spokes, which is useful for multicast traffic but does not enable NHRP redirect. It is not the command that triggers redirect messages for Phase 3 spoke-to-spoke tunnels.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
DMVPN and FlexVPN Technologies
Key term
DMVPN Phase 3
DMVPN Phase 3 is a Cisco networking technology that allows branch offices to connect directly to each other without always going through a central hub, but with smarter routing that lets the hub control the traffic paths more efficiently.
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.