350-401 Security Practice Question
A network administrator is configuring IPsec VPN on a Cisco IOS router. The requirement is that the tunnel must support multicast traffic for OSPF neighbor adjacency across the VPN. Which IPsec configuration element is required to meet this requirement?
⚠ Common exam trap
The trap here is believing that IPsec itself can carry multicast, when in fact IPsec SAs are point-to-point unicast and require GRE encapsulation for multicast support.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure GRE over IPsec.
IPsec security associations are inherently unicast and cannot carry multicast or broadcast traffic. To support OSPF, which relies on multicast hellos, the design must encapsulate multicast inside a GRE tunnel and then protect that GRE tunnel with IPsec. This is commonly called GRE over IPsec or IPsec profile applied to a GRE tunnel interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a dynamic VTI with IKEv1.
Why it's wrong here
Dynamic VTIs are used for hub-and-spoke scenarios where the hub has a static IP and spokes are dynamic. They are still IPsec interfaces and do not natively support multicast. While VTI can carry multicast if combined with GRE, a pure dynamic VTI without GRE will not pass OSPF multicast. IKEv1 vs IKEv2 does not change this behavior.
- ✗
Use transport mode instead of tunnel mode.
Why it's wrong here
Transport mode encrypts only the payload and preserves the original IP header, but it does not inherently support multicast over IPsec. IPsec tunnels are point-to-point and do not natively carry multicast. Transport mode is typically used for host-to-host or when another tunneling protocol provides the tunnel, but it does not solve the multicast requirement.
- ✓
Configure GRE over IPsec.
Why this is correct
GRE tunnels can carry multicast traffic, and when combined with IPsec, the GRE packets are encrypted. This allows OSPF to form neighbor adjacencies over the tunnel because OSPF uses multicast (224.0.0.5/224.0.0.6). Native IPsec cannot carry multicast, so GRE over IPsec is the standard solution for dynamic routing protocols requiring multicast over a VPN.
- ✗
Enable IKEv2 with MOBIKE.
Why it's wrong here
MOBIKE is an IKEv2 extension for mobility and multihoming, allowing a peer's IP address to change. It does not provide multicast support over IPsec. While IKEv2 is a modern key exchange protocol, it does not change the fundamental limitation that IPsec SAs are unicast point-to-point and cannot carry multicast traffic.
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
ACLs and Infrastructure Security Features
Key term
GRE
GRE (Generic Routing Encapsulation) is a tunneling protocol that encapsulates packets inside other packets to transport them across incompatible networks.
Key term
GRE Tunnel
A GRE tunnel is a method that wraps one network protocol inside another, allowing data to travel across a network that might not support that protocol directly.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.