DMVPN practice questions

A network engineer is troubleshooting a DMVPN phase 2 hub-and-spoke deployment. The hub router has mGRE and NHRP configured, and spokes register successfully. However, spoke-to-spoke traffic is not being encrypted, even though IPsec profiles are applied to the mGRE tunnel interface on both the hub and spokes. The engineer verifies that the crypto map is not applied to the tunnel interface. What is the most likely cause of this issue?

Trap 1: The NHRP authentication string does not match between the hub and…

Incorrect because NHRP authentication mismatch would prevent registration, but the spokes are registered.

Trap 2: The tunnel key is not configured on the spokes.

Incorrect because the tunnel key is used for mGRE, not IPsec; missing tunnel key would prevent tunnel establishment.

Trap 3: The spokes have a static crypto map applied to their physical…

Incorrect because static crypto maps on physical interfaces are not used in DMVPN; the IPsec profile is applied to the tunnel interface.

A
The NHRP authentication string does not match between the hub and spokes.
Why wrong: Incorrect because NHRP authentication mismatch would prevent registration, but the spokes are registered.
B
The IPsec profile is not applied to the mGRE tunnel interface on the hub and spokes.
Correct because DMVPN phase 2 requires the IPsec profile to be applied to the tunnel interface to protect spoke-to-spoke traffic.
C
The tunnel key is not configured on the spokes.
Why wrong: Incorrect because the tunnel key is used for mGRE, not IPsec; missing tunnel key would prevent tunnel establishment.
D
The spokes have a static crypto map applied to their physical interface.
Why wrong: Incorrect because static crypto maps on physical interfaces are not used in DMVPN; the IPsec profile is applied to the tunnel interface.

Question 2hardmultiple choice

An engineer is troubleshooting a DMVPN phase 3 network where spoke-to-spoke tunnels are not being established dynamically. The hub router has NHRP redirect enabled, and spokes have NHRP shortcut enabled. The engineer notices that when a spoke sends traffic to another spoke, the hub forwards the traffic but does not send an NHRP redirect. The hub's NHRP configuration includes the command 'ip nhrp redirect'. What is the most likely cause?

Trap 1: The spoke does not have 'ip nhrp shortcut' enabled.

Incorrect because the symptom is that the hub does not send the redirect; the spoke's shortcut setting does not affect the hub's redirect behavior.

Trap 2: The tunnel interface on the hub has 'no ip nhrp redirect'…

Incorrect because the engineer verified that 'ip nhrp redirect' is configured.

Trap 3: The spoke's NHRP registration does not include the LAN subnet.

Incorrect because NHRP registration includes the tunnel IP, not the LAN subnet; the hub learns the LAN subnet via routing protocols.

A
The spoke does not have 'ip nhrp shortcut' enabled.
Why wrong: Incorrect because the symptom is that the hub does not send the redirect; the spoke's shortcut setting does not affect the hub's redirect behavior.
B
The hub router does not have a route to the spoke's LAN subnet.
Correct because the hub must have a route to the spoke's subnet to generate an NHRP redirect; without it, the hub forwards traffic without sending a redirect.
C
The tunnel interface on the hub has 'no ip nhrp redirect' configured.
Why wrong: Incorrect because the engineer verified that 'ip nhrp redirect' is configured.
D
The spoke's NHRP registration does not include the LAN subnet.
Why wrong: Incorrect because NHRP registration includes the tunnel IP, not the LAN subnet; the hub learns the LAN subnet via routing protocols.

Question 3hardmultiple choice

A network engineer is troubleshooting a DMVPN phase 2 network where spoke-to-spoke tunnels are established, but traffic between spokes is intermittently dropped. The engineer captures packets and sees that IPsec packets are being fragmented. The tunnel interface MTU is set to 1400 bytes, and the physical interface MTU is 1500 bytes. The engineer also notices that the IPsec transform set uses ESP with AES-256 and SHA-256. What is the most likely cause of the intermittent drops?

Trap 1: The IPsec transform set uses AES-256, which requires more CPU and…

Incorrect because CPU load does not cause intermittent drops; fragmentation is the issue.

Trap 2: The physical interface MTU is set to 1500, which is too high for…

Incorrect because the physical interface MTU is standard; the tunnel MTU should be lower to accommodate IPsec overhead.

Trap 3: The spokes have different IPsec transform sets configured.

Incorrect because mismatched transform sets would prevent IPsec negotiation, not cause intermittent drops.

A
The IPsec transform set uses AES-256, which requires more CPU and causes performance drops.
Why wrong: Incorrect because CPU load does not cause intermittent drops; fragmentation is the issue.
B
The tunnel MTU is set too high for the IPsec overhead, causing fragmentation and potential drops.
Correct because the tunnel MTU of 1400 bytes does not account for IPsec overhead, leading to fragmentation and drops.
C
The physical interface MTU is set to 1500, which is too high for DMVPN.
Why wrong: Incorrect because the physical interface MTU is standard; the tunnel MTU should be lower to accommodate IPsec overhead.
D
The spokes have different IPsec transform sets configured.
Why wrong: Incorrect because mismatched transform sets would prevent IPsec negotiation, not cause intermittent drops.

Study the full EIGRP explanation →

Question 4mediummultiple choice

An engineer is troubleshooting a DMVPN phase 3 network where spokes are unable to reach the hub's LAN subnet. The hub router is running EIGRP over the DMVPN tunnel interface, and the spokes are learning the hub's LAN route. However, pings from a spoke to the hub's LAN IP fail. The engineer checks the hub's routing table and sees the spoke's LAN route. The hub's tunnel interface has 'ip nhrp redirect' and 'ip nhrp shortcut' enabled. What is the most likely cause?

Trap 1: The spoke's tunnel interface has 'ip nhrp shortcut' disabled.

Incorrect because shortcut is for spoke-to-spoke, not for hub-to-spoke traffic.

Trap 2: The hub's tunnel interface has 'no ip nhrp redirect' configured.

Incorrect because redirect is for spoke-to-spoke traffic, not hub-to-spoke.

Trap 3: The spoke's NHRP registration is not reaching the hub.

Incorrect because if registration failed, the spoke would not have a tunnel IP or routes.

A
The hub's EIGRP is not configured to advertise the LAN subnet.
Correct because if the hub's LAN subnet is not advertised via EIGRP, the spokes will not have a route to it.
B
The spoke's tunnel interface has 'ip nhrp shortcut' disabled.
Why wrong: Incorrect because shortcut is for spoke-to-spoke, not for hub-to-spoke traffic.
C
The hub's tunnel interface has 'no ip nhrp redirect' configured.
Why wrong: Incorrect because redirect is for spoke-to-spoke traffic, not hub-to-spoke.
D
The spoke's NHRP registration is not reaching the hub.
Why wrong: Incorrect because if registration failed, the spoke would not have a tunnel IP or routes.

Question 5mediummultiple choice

A network engineer is troubleshooting a DMVPN phase 2 network where the hub router is not forming an NHRP adjacency with a spoke. The spoke router is configured with 'ip nhrp nhs 10.0.0.1' and 'ip nhrp map 10.0.0.1 192.168.1.1'. The hub's tunnel interface IP is 10.0.0.1, and the physical interface IP is 192.168.1.1. The engineer pings the hub's tunnel IP from the spoke and it succeeds. However, 'show ip nhrp' on the spoke shows no NHRP entries. What is the most likely cause?

Trap 1: The spoke's tunnel interface is in a different VRF than the hub's.

Incorrect because VRF mismatch would prevent ping, but ping succeeds.

Trap 2: The hub's tunnel interface has 'no ip nhrp server-only' configured.

Incorrect because 'ip nhrp server-only' is not a standard command; the hub is the NHS by default.

Trap 3: The spoke's NHRP map is incorrect; it should map the hub's tunnel…

Incorrect because the NHRP map maps the tunnel IP to the physical IP, which is correct.

A
The hub router has 'ip nhrp authentication DMVPN' configured, but the spoke does not.
Correct because NHRP authentication must match between hub and spoke for registration to succeed.
B
The spoke's tunnel interface is in a different VRF than the hub's.
Why wrong: Incorrect because VRF mismatch would prevent ping, but ping succeeds.
C
The hub's tunnel interface has 'no ip nhrp server-only' configured.
Why wrong: Incorrect because 'ip nhrp server-only' is not a standard command; the hub is the NHS by default.
D
The spoke's NHRP map is incorrect; it should map the hub's tunnel IP to the hub's tunnel IP.
Why wrong: Incorrect because the NHRP map maps the tunnel IP to the physical IP, which is correct.

Question 6hardmultiple choice

An engineer is troubleshooting a DMVPN phase 3 network where spoke-to-spoke tunnels are established, but traffic between spokes is taking a suboptimal path through the hub. The engineer checks 'show ip nhrp shortcut' on the spoke and sees no shortcut entries. The hub has 'ip nhrp redirect' enabled, and the spoke has 'ip nhrp shortcut' enabled. The engineer also verifies that the spoke's routing table has a route to the remote spoke's LAN via the hub. What is the most likely cause?

Trap 1: The spoke's 'ip nhrp shortcut' command is missing on the tunnel…

Incorrect because the engineer verified that 'ip nhrp shortcut' is enabled.

Trap 2: The spoke's routing table has a static route to the remote spoke's…

Incorrect because a static route would not prevent shortcut creation; the redirect is still needed.

Trap 3: The hub's tunnel interface has 'no ip nhrp redirect' configured.

Incorrect because the engineer verified that 'ip nhrp redirect' is enabled.

A
The hub router does not have a route to the remote spoke's LAN subnet.
Correct because the hub must have a route to the destination subnet to send an NHRP redirect.
B
The spoke's 'ip nhrp shortcut' command is missing on the tunnel interface.
Why wrong: Incorrect because the engineer verified that 'ip nhrp shortcut' is enabled.
C
The spoke's routing table has a static route to the remote spoke's LAN via the hub.
Why wrong: Incorrect because a static route would not prevent shortcut creation; the redirect is still needed.
D
The hub's tunnel interface has 'no ip nhrp redirect' configured.
Why wrong: Incorrect because the engineer verified that 'ip nhrp redirect' is enabled.

Study the full EIGRP explanation →

Question 7mediummultiple choice

A network engineer is troubleshooting a DMVPN phase 2 network where the hub router is not learning the loopback interface routes from the spokes via EIGRP. The spokes have EIGRP configured on the tunnel interface and are advertising their loopback0 interface. The hub's EIGRP neighbor relationship with the spokes is established. However, the hub's routing table does not contain the loopback routes. The engineer checks the spoke's EIGRP configuration and sees that the loopback interface is not included in any network statement. What is the most likely cause?

Trap 1: The hub's EIGRP is configured with a distribute-list that filters…

Incorrect because the issue is on the spoke side; the hub is not receiving the routes.

Trap 2: The tunnel interface on the spoke has 'no ip split-horizon'…

Incorrect because split-horizon affects the hub's ability to advertise routes back to spokes, not the spoke's ability to advertise.

Trap 3: The loopback interface on the spoke is in a different VRF than the…

Incorrect because VRF mismatch would prevent EIGRP from learning the loopback, but the neighbor relationship is established.

A
The spoke's EIGRP network statement does not include the loopback subnet.
Correct because EIGRP must have a network statement that matches the loopback subnet to advertise it.
B
The hub's EIGRP is configured with a distribute-list that filters the loopback routes.
Why wrong: Incorrect because the issue is on the spoke side; the hub is not receiving the routes.
C
The tunnel interface on the spoke has 'no ip split-horizon' configured.
Why wrong: Incorrect because split-horizon affects the hub's ability to advertise routes back to spokes, not the spoke's ability to advertise.
D
The loopback interface on the spoke is in a different VRF than the tunnel interface.
Why wrong: Incorrect because VRF mismatch would prevent EIGRP from learning the loopback, but the neighbor relationship is established.

Study the full EIGRP explanation →

Question 8mediummultiple choice

An engineer is troubleshooting a DMVPN phase 2 network where the hub router is not forming an EIGRP neighbor relationship with a spoke. The spoke's tunnel interface is configured with 'ip nhrp nhs 10.0.0.1' and 'ip nhrp map 10.0.0.1 192.168.1.1'. The hub's tunnel interface IP is 10.0.0.1. The engineer pings the hub's tunnel IP from the spoke and it succeeds. The engineer checks 'show ip eigrp neighbors' on the hub and sees no neighbors. What is the most likely cause?

Trap 1: The hub's tunnel interface has 'no ip nhrp redirect' configured.

Incorrect because redirect is for spoke-to-spoke traffic, not for multicast.

Trap 2: The spoke's EIGRP AS number does not match the hub's.

Incorrect because AS mismatch would prevent neighbor formation, but the engineer would check that first.

Trap 3: The hub's tunnel interface has 'ip nhrp authentication' configured…

Incorrect because NHRP authentication affects NHRP registration, not EIGRP neighbor formation.

A
The spoke's tunnel interface is missing the 'ip nhrp map multicast dynamic' command.
Correct because without multicast mapping, the spoke cannot send multicast traffic (including EIGRP hellos) to the hub.
B
The hub's tunnel interface has 'no ip nhrp redirect' configured.
Why wrong: Incorrect because redirect is for spoke-to-spoke traffic, not for multicast.
C
The spoke's EIGRP AS number does not match the hub's.
Why wrong: Incorrect because AS mismatch would prevent neighbor formation, but the engineer would check that first.
D
The hub's tunnel interface has 'ip nhrp authentication' configured but the spoke does not.
Why wrong: Incorrect because NHRP authentication affects NHRP registration, not EIGRP neighbor formation.

Question 9hardmultiple choice

A network engineer is troubleshooting a DMVPN phase 2 network where spoke-to-spoke tunnels are not being established. The hub router has 'ip nhrp redirect' enabled, and spokes have 'ip nhrp shortcut' enabled. The engineer notices that when a spoke sends traffic to another spoke, the hub forwards the traffic correctly, but the spoke does not initiate an NHRP resolution request to the destination spoke. The spoke's routing table shows the destination subnet via the hub. What is the most likely cause?

Trap 1: The hub's tunnel interface does not have 'ip nhrp redirect' enabled.

Incorrect because the engineer verified that 'ip nhrp redirect' is enabled on the hub.

Trap 2: The spoke's routing table has a static route to the destination…

Incorrect because a static route would still allow the spoke to send a resolution request if shortcut is enabled.

Trap 3: The hub's NHRP authentication is configured but the spoke's is not.

Incorrect because NHRP authentication affects registration, not resolution requests.

A
The spoke's tunnel interface does not have 'ip nhrp shortcut' enabled.
Correct because 'ip nhrp shortcut' is required for the spoke to initiate NHRP resolution requests for spoke-to-spoke tunnels.
B
The hub's tunnel interface does not have 'ip nhrp redirect' enabled.
Why wrong: Incorrect because the engineer verified that 'ip nhrp redirect' is enabled on the hub.
C
The spoke's routing table has a static route to the destination subnet via the hub.
Why wrong: Incorrect because a static route would still allow the spoke to send a resolution request if shortcut is enabled.
D
The hub's NHRP authentication is configured but the spoke's is not.
Why wrong: Incorrect because NHRP authentication affects registration, not resolution requests.

Question 10mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show dmvpn

Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete N: NATed, L: Local, X: No Socket #Ent -> Number of NHRP entries with same NBMA peer NHS Status: E => Expecting Replies, R => Responding, W => Waiting UpDn Time -> Up or Down Time for a Tunnel ==========================================================================

Interface: Tunnel0, IPv4 NHRP Details

Type:Hub, NHRP Peers:2,

# Ent  Peer NBMA Addr Peer Tunnel Addr State  UpDn Tm Attrb

----- --------------- ---------------- ----- -------- ----- 1 10.1.1.2 172.16.0.2 UP 00:02:15 D 1 10.1.1.3 172.16.0.3 UP 00:01:45 D

Based on this output, which statement is correct?

Trap 1: Router R1 is a spoke with two hub peers.

The Type:Hub indicates R1 is a hub, not a spoke.

Trap 2: The NHRP peers are static and not dynamic.

Attrb shows D for dynamic, not S for static.

Trap 3: One spoke is experiencing a registration failure.

Both peers are UP, no failure indicated.

A
Router R1 is a spoke with two hub peers.
Why wrong: The Type:Hub indicates R1 is a hub, not a spoke.
B
Router R1 is a hub with two dynamically registered spokes.
Type:Hub and two dynamic (D) entries confirm this.
C
The NHRP peers are static and not dynamic.
Why wrong: Attrb shows D for dynamic, not S for static.
D
One spoke is experiencing a registration failure.
Why wrong: Both peers are UP, no failure indicated.

Question 11hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nhrp
192.168.1.0/24 via 172.16.0.2

Tunnel0 created 00:00:15, expire 00:01:45 Type: dynamic, Flags: unique NBMA address: 10.1.1.2

192.168.2.0/24 via 172.16.0.3

Tunnel0 created 00:00:10, expire 00:01:50 Type: dynamic, Flags: unique NBMA address: 10.1.1.3

Based on this output, what is the problem?

Trap 1: The NHRP entries are static and will not expire.

Type is dynamic, not static.

Trap 2: The tunnel interface is down.

Entries are present and created recently, tunnel is up.

Trap 3: The NBMA addresses are incorrect.

NBMA addresses are shown and match expected spoke addresses.

A
The NHRP holdtime is too short, causing frequent re-registrations.
Expire time of 2 minutes indicates a holdtime of 120 seconds, which is low.
B
The NHRP entries are static and will not expire.
Why wrong: Type is dynamic, not static.
C
The tunnel interface is down.
Why wrong: Entries are present and created recently, tunnel is up.
D
The NBMA addresses are incorrect.
Why wrong: NBMA addresses are shown and match expected spoke addresses.

Question 12mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa

dst src state conn-id slot status

10.1.1.2        10.1.1.1        MM_ACTIVE      1       0     ACTIVE
10.1.1.3        10.1.1.1        MM_ACTIVE      2       0     ACTIVE

Based on this output, which statement is correct?

Trap 1: IKE phase 2 is complete for both peers.

This command only shows IKE phase 1 SA status.

Trap 2: The IPsec tunnels are established.

IPsec SA status is shown by show crypto ipsec sa.

Trap 3: The peers are not responding.

ACTIVE state indicates they are responding.

A
IKE phase 1 is complete for both peers.
MM_ACTIVE indicates successful IKE phase 1.
B
IKE phase 2 is complete for both peers.
Why wrong: This command only shows IKE phase 1 SA status.
C
The IPsec tunnels are established.
Why wrong: IPsec SA status is shown by show crypto ipsec sa.
D
The peers are not responding.
Why wrong: ACTIVE state indicates they are responding.

Question 13hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa
interface: Tunnel0
    Crypto map tag: DMVPN, local addr 10.1.1.1

protected vrf: (none) local ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/47/0) remote ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/47/0) current_peer 10.1.1.2 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 150, #pkts encrypt: 150, #pkts digest: 150 #pkts decaps: 145, #pkts decrypt: 145, #pkts verify: 145 #send errors 0, #recv errors 0

local crypto endpt.: 10.1.1.1, remote crypto endpt.: 10.1.1.2 path mtu 1500, ip mtu 1500, ip mtu idb Tunnel0 current outbound spi: 0x12345678(305419896) PFS (Y/N): N, DH group: none

Based on this output, what is the problem?

Trap 1: The IPsec SA is using PFS.

PFS (Y/N): N indicates PFS is not used.

Trap 2: The tunnel is not encrypting traffic.

Encrypt/decrypt counts are non-zero, so encryption is happening.

Trap 3: The remote peer is 10.1.1.1.

Remote peer is 10.1.1.2, not 10.1.1.1.

A
There is packet loss on the IPsec tunnel.
Encaps count (150) is higher than decaps count (145), indicating loss.
B
The IPsec SA is using PFS.
Why wrong: PFS (Y/N): N indicates PFS is not used.
C
The tunnel is not encrypting traffic.
Why wrong: Encrypt/decrypt counts are non-zero, so encryption is happening.
D
The remote peer is 10.1.1.1.
Why wrong: Remote peer is 10.1.1.2, not 10.1.1.1.

Review the full OSPF breakdown →

Question 14hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show ip route ospf

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP a - application route + - replicated route, % - next hop override

Gateway of last resort is not set

172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks
O        172.16.0.0/24 [110/100] via 172.16.0.2, 00:00:15, Tunnel0
O        172.16.0.0/24 [110/100] via 172.16.0.3, 00:00:10, Tunnel0

Based on this output, what is the problem?

Trap 1: The OSPF cost is 100, which is high.

Cost is not necessarily a problem; it's a metric.

Trap 2: The routes are learned via EIGRP.

The O prefix indicates OSPF.

Trap 3: The tunnel interface is down.

Routes are present and recent, so tunnel is up.

A
OSPF is learning the same subnet from multiple spokes, indicating a misconfiguration.
Duplicate routes for the same network via different next hops is problematic.
B
The OSPF cost is 100, which is high.
Why wrong: Cost is not necessarily a problem; it's a metric.
C
The routes are learned via EIGRP.
Why wrong: The O prefix indicates OSPF.
D
The tunnel interface is down.
Why wrong: Routes are present and recent, so tunnel is up.

Question 15mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show dmvpn detail

Interface: Tunnel0, IPv4 NHRP Details

Type:Spoke, NHRP Peers:1,

# Ent  Peer NBMA Addr Peer Tunnel Addr State  UpDn Tm Attrb

----- --------------- ---------------- ----- -------- ----- 1 10.1.1.1 172.16.0.1 UP 00:10:00 S

Based on this output, what is the problem?

Trap 1: The spoke has dynamically learned the hub.

Attrb shows S for static, not D.

Trap 2: The hub is not reachable.

State UP indicates reachability.

Trap 3: The spoke is configured as a hub.

Type:Spoke indicates it is a spoke.

A
The spoke has a static NHRP mapping for the hub, which is correct for phase 1 DMVPN.
In phase 1, spokes only communicate via hub; static mapping is normal.
B
The spoke has dynamically learned the hub.
Why wrong: Attrb shows S for static, not D.
C
The hub is not reachable.
Why wrong: State UP indicates reachability.
D
The spoke is configured as a hub.
Why wrong: Type:Spoke indicates it is a spoke.

Question 16hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nhrp nhs

NHS: 172.16.0.1 Tunnel0 status: registered NHS: 172.16.0.2 Tunnel0 status: not registered

Based on this output, what is the problem?

Trap 1: Both NHS are registered successfully.

One is not registered.

Trap 2: The tunnel interface is down.

Registration with first NHS implies tunnel is up.

Trap 3: The NHS addresses are swapped.

No evidence of swapping.

A
Router R1 is not registered with the second NHS, indicating a registration failure.
Status 'not registered' for second NHS indicates a problem.
B
Both NHS are registered successfully.
Why wrong: One is not registered.
C
The tunnel interface is down.
Why wrong: Registration with first NHS implies tunnel is up.
D
The NHS addresses are swapped.
Why wrong: No evidence of swapping.

Question 17mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa detail

Codes: C - IKE, M - IKEv2, P - IPsec

C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap. 1 10.1.1.1 10.1.1.2 ACTIVE aes sha md5 2 86400 2 10.1.1.1 10.1.1.3 ACTIVE aes sha md5 2 86400

Based on this output, what is the problem?

Trap 1: The IKE SAs are not active.

Status is ACTIVE.

Trap 2: The IPsec SAs are missing.

This command only shows IKE SAs.

Trap 3: The lifetime is too short.

86400 seconds (24 hours) is standard.

A
The IKE policy uses weak authentication (MD5) and DH group 2.
MD5 and DH group 2 are cryptographically weak.
B
The IKE SAs are not active.
Why wrong: Status is ACTIVE.
C
The IPsec SAs are missing.
Why wrong: This command only shows IKE SAs.
D
The lifetime is too short.
Why wrong: 86400 seconds (24 hours) is standard.

Question 18mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nhrp traffic

NHRP Traffic Statistics Sent: 100 requests, 50 replies Received: 50 requests, 100 replies

Based on this output, what is the problem?

Trap 1: The router is receiving more replies than requests.

It sent 100 requests but got 50 replies; not more.

Trap 2: The NHRP process is functioning normally.

The mismatch indicates a problem.

Trap 3: The router is configured as a hub.

Traffic stats do not indicate role.

A
There is a mismatch between sent requests and received replies, indicating packet loss.
100 requests sent vs 50 replies received shows loss.
B
The router is receiving more replies than requests.
Why wrong: It sent 100 requests but got 50 replies; not more.
C
The NHRP process is functioning normally.
Why wrong: The mismatch indicates a problem.
D
The router is configured as a hub.
Why wrong: Traffic stats do not indicate role.

Question 19mediummultiple choice

Consider the following partial DMVPN configuration on a hub router:

interface Tunnel0
 ip address 10.0.0.1 255.255.255.0
 ip nhrp network-id 100
 ip nhrp authentication cisco123

tunnel source GigabitEthernet0/0 tunnel mode gre multipoint

ip nhrp map multicast dynamic

What is the effect of this configuration?

Trap 1: The hub will only forward multicast traffic to spokes that are…

Dynamic mapping allows automatic forwarding to all registered spokes without static maps.

Trap 2: The hub will not forward multicast traffic at all because dynamic…

Dynamic mapping is supported and commonly used for DMVPN hubs.

Trap 3: The hub will use broadcast instead of multicast for all traffic.

The command specifically handles multicast, not broadcast.

A
The hub will dynamically register spoke NHRP addresses and forward multicast traffic to all registered spokes.
This is correct; dynamic multicast mapping enables the hub to forward multicast to all spokes that have registered with NHRP.
B
The hub will only forward multicast traffic to spokes that are statically mapped.
Why wrong: Dynamic mapping allows automatic forwarding to all registered spokes without static maps.
C
The hub will not forward multicast traffic at all because dynamic mapping is not supported.
Why wrong: Dynamic mapping is supported and commonly used for DMVPN hubs.
D
The hub will use broadcast instead of multicast for all traffic.
Why wrong: The command specifically handles multicast, not broadcast.

Question 20mediummultiple choice

A spoke router has the following DMVPN configuration:

interface Tunnel0
 ip address 10.0.0.2 255.255.255.0
 ip nhrp network-id 100
 ip nhrp nhs 10.0.0.1

tunnel source GigabitEthernet0/0 tunnel mode gre multipoint

ip nhrp map 10.0.0.1 192.168.1.1

What is missing from this configuration?

Trap 1: The spoke is missing the 'ip nhrp authentication' command.

Authentication is optional; the spoke can still register without it if the hub does not require it.

Trap 2: The spoke is missing the 'tunnel key' command.

Tunnel key is not required for basic DMVPN operation.

Trap 3: The spoke is missing the 'ip nhrp holdtime' command.

Holdtime is optional and defaults to 3600 seconds.

A
The spoke is missing the 'ip nhrp map multicast dynamic' command to register with the hub.
Without multicast mapping, the spoke cannot send NHRP registration or receive routing updates via multicast.
B
The spoke is missing the 'ip nhrp authentication' command.
Why wrong: Authentication is optional; the spoke can still register without it if the hub does not require it.
C
The spoke is missing the 'tunnel key' command.
Why wrong: Tunnel key is not required for basic DMVPN operation.
D
The spoke is missing the 'ip nhrp holdtime' command.
Why wrong: Holdtime is optional and defaults to 3600 seconds.