hardMultiple Choice
300-410 Practice Question: An engineer configures a DMVPN Phase 2 network
An engineer configures a DMVPN Phase 2 network. Spoke-to-spoke tunnels are established, but traffic between spokes is not using the direct tunnel. What is the most likely explanation?
⚠ Common exam trap
The trap is blaming NHRP commands (redirect, shortcut) when the real cause is a routing table default route that pre-empts NHRP resolution — candidates who focus only on NHRP configuration miss the routing interaction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The spoke routers have a default route via the hub, so they send traffic to the hub instead of initiating NHRP resolution for a direct tunnel.
In DMVPN Phase 2, spoke-to-spoke direct tunnels require the spoke to resolve the remote spoke's NBMA address via NHRP. If a spoke has a default route pointing to the hub, its routing table sends all non-local traffic to the hub instead of triggering NHRP resolution for the destination spoke, so traffic traverses hub-and-spoke paths even though direct tunnels could form. Removing the default route (or using specific routes plus NHRP shortcut) restores direct spoke-to-spoke forwarding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The spoke routers have a default route via the hub, so they send traffic to the hub instead of initiating NHRP resolution for a direct tunnel.
Why this is correct
With a default route pointing at the hub, spoke traffic is forwarded to the hub rather than triggering NHRP resolution for a direct spoke-to-spoke tunnel. This routing behaviour explains why the direct tunnel is bypassed.
- ✗
The hub has 'no ip nhrp redirect' configured, which disables spoke-to-spoke tunnel setup.
Why it's wrong here
'no ip nhrp redirect' on the hub prevents the hub from sending redirect messages that tell spokes to build direct tunnels, so traffic keeps traversing the hub. NHRP redirect is tempting because it sounds like a routing policy, but it is precisely the mechanism that enables spoke-to-spoke shortcut switching in Phase 2.
- ✗
The spokes have 'ip nhrp shortcut' enabled, which forces all traffic through the hub.
Why it's wrong here
'ip nhrp shortcut' on spokes enables them to install shortcut routes and bypass the hub, so enabling it would not force traffic through the hub. The command is tempting because its name suggests a shortcut, but it is the spoke-side counterpart to hub redirect that makes direct tunnels usable.
- ✗
The tunnel mode is set to 'tunnel mode gre multipoint' on the spokes, which is incorrect.
Why it's wrong here
GRE multipoint is the required tunnel mode for DMVPN and is correct on the spokes; the fault lies elsewhere, typically missing NHRP redirect or shortcut configuration. Multipoint GRE would be the right answer if the question asked how to enable a single tunnel interface per spoke.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.