hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Is troubleshooting suboptimal routing in a DMVPN…
A network engineer is troubleshooting suboptimal routing in a DMVPN Phase 2 deployment. Hub router R1 has the following configuration: route-map SET-NEXT-HOP permit 10 match ip address prefix-list SPOKE-NET set ip next-hop 10.0.0.1. Spoke R2 shows: 'show ip route 192.168.1.0' points to the hub (R1) instead of directly to another spoke (R3). R2's NHRP shows 'show dmvpn' with no spoke-to-spoke tunnels established. What is the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route-map SET-NEXT-HOP incorrectly sets the next-hop to the hub, preventing NHRP from establishing direct spoke-to-spoke tunnels.
In DMVPN Phase 2, spoke-to-spoke tunnels require that the next-hop in the routing table not be changed to the hub. The route-map SET-NEXT-HOP on R1 is setting the next-hop to the hub's tunnel IP (10.0.0.1) for routes matching SPOKE-NET. This causes spokes to see the hub as the next-hop for other spoke networks, preventing NHRP from triggering a spoke-to-spoke tunnel. The correct behavior is to not set the next-hop (or set it to itself) so that spokes use the original next-hop (the other spoke's tunnel IP) and NHRP can resolve it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The route-map SET-NEXT-HOP incorrectly sets the next-hop to the hub, preventing NHRP from establishing direct spoke-to-spoke tunnels.
Why this is correct
By setting the next-hop to the hub, R2 sees R1 as the next-hop for 192.168.1.0, so it does not attempt to build a direct tunnel to R3. NHRP requires the next-hop to be the remote spoke's tunnel IP.
- ✗
The prefix-list SPOKE-NET does not include the network 192.168.1.0.
Why it's wrong here
The route is present in the routing table, so the prefix-list must be matching it.
- ✗
The NHRP authentication is mismatched between R2 and R3.
Why it's wrong here
NHRP authentication mismatch would prevent registration, but the DMVPN show output would indicate a failure, not just lack of tunnels.
- ✗
The tunnel interface on R2 is not configured with ip nhrp redirect.
Why it's wrong here
In Phase 2, ip nhrp redirect is used on the hub to signal spokes to build direct tunnels, but the root cause here is the next-hop manipulation.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to ENARSI Exam and Network Fundamentals
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
Key term
BGP Prefix Filtering
BGP Prefix Filtering is the practice of controlling which network routes (prefixes) a router accepts or advertises to its BGP neighbors, preventing unwanted or harmful routes from spreading across the internet.
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.