hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Configures CoPP on a router that is a DMVPN hub
A network engineer configures CoPP on a router that is a DMVPN hub. The policy includes a class-map to match NHRP traffic and police it. After deployment, spoke-to-spoke tunnels fail to establish, although spoke-to-hub tunnels work. Which is the most likely explanation?
⚠ Common exam trap
Cisco often tests the distinction between control-plane and data-plane traffic in DMVPN; the trap here is that candidates assume spoke-to-spoke failures are caused by IPsec or tunnel interface issues, when the root cause is actually the policing of NHRP control-plane messages that enable dynamic tunnel establishment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CoPP policy polices NHRP traffic, causing NHRP redirect packets from the hub to be dropped, so spokes cannot learn each other's addresses.
In a DMVPN hub-and-spoke topology, spoke-to-spoke tunnels rely on NHRP redirect messages from the hub to learn each other's public addresses. If CoPP polices NHRP traffic too aggressively, the hub may drop NHRP redirect packets before they reach the spokes. Without these redirects, spokes cannot initiate direct tunnels, even though spoke-to-hub communication (which uses the hub as a relay) remains functional.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CoPP policy drops IPsec packets, which are used for spoke-to-spoke encryption.
Why it's wrong here
Spoke-to-spoke tunnels use mGRE, not IPsec directly; NHRP is the control protocol.
- ✓
The CoPP policy polices NHRP traffic, causing NHRP redirect packets from the hub to be dropped, so spokes cannot learn each other's addresses.
Why this is correct
NHRP redirects are essential for spoke-to-spoke communication; policing them breaks the dynamic tunnel setup.
- ✗
The CoPP policy is applied to the tunnel interface, not the control plane.
Why it's wrong here
CoPP is applied to the control plane, not interfaces.
- ✗
The CoPP policy uses the default class class-default, which blocks NHRP.
Why it's wrong here
The class-default permits traffic by default.
Go deeper
Related to this question
Learn chapter
Introduction to ENARSI Exam and Network Fundamentals
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.