300-410 VPN Technologies Practice Question
A network engineer is implementing GET VPN using GDOI on Cisco IOS routers. The key server must distribute the group policy, and the group members must register and receive rekey messages. The engineer needs to verify which components are required for the group members to successfully join the group and decrypt traffic. (Choose two.)
⚠ Common exam trap
The trap here is assuming GET VPN requires IKEv2 with certificates and manual ACLs, when GDOI actually uses IKEv1 for registration and distributes the policy from the key server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Group members must be configured with the group identity and a matching GDOI group configuration referencing the key server.
GET VPN GDOI group members must be configured with the correct group identity and key server reference, and they must successfully register to receive the KEK and TEK from the key server. These two elements are fundamental: the local group configuration identifies which key server to contact, and successful registration provides the keys needed to decrypt the group's encrypted traffic. Authentication uses IKEv1 rather than IKEv2 with a CA, and the encryption ACL comes from the downloaded policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Group members must be configured with the group identity and a matching GDOI group configuration referencing the key server.
Why this is correct
Each group member needs a 'crypto gdoi group' configuration that includes the group identity number and the key server address, plus a 'crypto map' or 'crypto gdoi' reference. Without this, the member cannot initiate registration with the key server or match the group policy, so it never receives the group keys and cannot decrypt GET VPN traffic.
- ✗
Group members must have a static VRF configured to isolate the GET VPN traffic from the global routing table.
Why it's wrong here
VRF isolation is not a requirement for GET VPN group membership. GET VPN typically runs over the global routing table, and while VRFs can be used for other design reasons, they are not part of the GDOI registration or key distribution process. Adding a VRF does not help a member join the group or decrypt traffic.
- ✗
Group members must be configured with the same ACL as the key server to define interesting traffic for the encryption policy.
Why it's wrong here
Interesting traffic ACLs in GET VPN are defined within the group policy that the key server distributes, not manually on each member. The member receives the encryption policy and TEK parameters from the key server. Manually configuring a matching ACL is unnecessary and can conflict with the downloaded policy.
- ✗
Group members must have IKEv2 configured with a certificate authority to authenticate to the key server.
Why it's wrong here
GET VPN GDOI uses IKE Phase 1 (ISAKMP) to establish the registration and rekey channel with the key server, not IKEv2 with a CA. While certificates can be used for IKE authentication, IKEv2 with a CA is not a requirement; preshared keys or IKEv1 with RSA signatures commonly suffice in GDOI deployments.
- ✓
Group members must successfully complete GDOI registration with the key server to obtain the group's rekey and data encryption keys.
Why this is correct
During GDOI registration, the group member authenticates to the key server, which then pushes the group policy including the rekey key (KEK) and the current data encryption key (TEK). Without successful registration, the member has no keys to decrypt traffic and cannot participate in the group, which is the core requirement for GET VPN operation.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Introduction to ENARSI Exam and Network Fundamentals
Key term
FlexVPN
FlexVPN is a Cisco VPN solution that combines multiple VPN technologies (site-to-site, remote access, and hub-and-spoke) under a single, modular framework based on IKEv2.
Key term
GET VPN
Group Encrypted Transport VPN is a Cisco technology that secures IP multicast and unicast traffic across a wide area network using a shared security association rather than point-to-point tunnels.
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.