VPN Technologies practice questions

A network engineer is configuring a site-to-site IPsec VPN between two Cisco routers. The engineer wants to ensure that the VPN tunnel uses the strongest possible encryption and authentication algorithms. The engineer configures the following: crypto isakmp policy 10, authentication pre-share, encryption aes-256, group 14, lifetime 86400. On the remote router, the engineer configures: crypto isakmp policy 10, authentication pre-share, encryption aes-256, group 14, lifetime 86400. The tunnel fails to establish. What is the most likely cause?

Trap 1: The lifetimes are set too high; they should be 3600 seconds.

The lifetimes match on both routers, so this is not the cause.

Trap 2: The Diffie-Hellman group 14 is not supported on these routers.

Group 14 is widely supported on modern Cisco routers.

Trap 3: Pre-shared keys cannot be used with AES-256 encryption.

Pre-shared keys are compatible with AES-256.

A
The lifetimes are set too high; they should be 3600 seconds.
Why wrong: The lifetimes match on both routers, so this is not the cause.
B
The hash algorithm is not specified and defaults may differ between routers.
Correct because the default hash algorithm can vary, causing a mismatch.
C
The Diffie-Hellman group 14 is not supported on these routers.
Why wrong: Group 14 is widely supported on modern Cisco routers.
D
Pre-shared keys cannot be used with AES-256 encryption.
Why wrong: Pre-shared keys are compatible with AES-256.

Question 2hardmultiple choice

A network engineer is tasked with deploying a DMVPN Phase 2 network for a company with multiple branch offices. The hub router is a Cisco 4451-X and the spoke routers are Cisco 4331s. After configuration, the spokes can ping the hub's tunnel IP, but cannot reach each other's tunnel IPs. The engineer checks the routing tables and sees that the hub has routes for both spoke subnets, but the spokes do not have routes to each other. What is the most likely cause?

Trap 1: The NHRP network ID is mismatched between the hub and spokes.

If NHRP were mismatched, the spokes would not even register with the hub.

Trap 2: The spokes are not configured with a crypto map for IPsec.

IPsec is used for encryption, not for routing between spokes.

Trap 3: The tunnel mode is set to GRE instead of mGRE on the spokes.

Spokes typically use GRE, not mGRE; mGRE is only on the hub.

A
The NHRP network ID is mismatched between the hub and spokes.
Why wrong: If NHRP were mismatched, the spokes would not even register with the hub.
B
The spokes are not configured with a crypto map for IPsec.
Why wrong: IPsec is used for encryption, not for routing between spokes.
C
The hub is not configured to propagate spoke routes to other spokes.
Correct because without route propagation, spokes cannot learn each other's networks.
D
The tunnel mode is set to GRE instead of mGRE on the spokes.
Why wrong: Spokes typically use GRE, not mGRE; mGRE is only on the hub.

Question 3mediummultiple choice

An engineer is configuring a FlexVPN hub-and-spoke network. The hub router has a loopback0 with IP 10.0.0.1/32. The spokes are configured to use IKEv2 with certificates. The engineer notices that the spokes can establish the IKEv2 tunnel and can ping the hub's tunnel IP, but cannot reach the loopback0 address. The hub has a static route for the spoke subnets. What is the most likely issue?

Trap 1: The IKEv2 proposal does not match between hub and spoke.

The tunnel is established, so IKEv2 is working.

Trap 2: The certificate authority is not trusted by the hub.

Certificate trust issues would prevent tunnel establishment.

Trap 3: The tunnel interface is not in an up/up state.

The tunnel is up because the spokes can ping the tunnel IP.

A
The IKEv2 proposal does not match between hub and spoke.
Why wrong: The tunnel is established, so IKEv2 is working.
B
The certificate authority is not trusted by the hub.
Why wrong: Certificate trust issues would prevent tunnel establishment.
C
The tunnel interface is not in an up/up state.
Why wrong: The tunnel is up because the spokes can ping the tunnel IP.
D
The loopback0 is not advertised in the routing protocol.
Correct because without a route, the spokes cannot reach the loopback.

Question 4hardmultiple choice

A network engineer is configuring a GETVPN solution for a large enterprise with many remote sites. The engineer wants to ensure that all traffic between sites is encrypted using a common group key. The key server (KS) is a Cisco ASR 1000. After configuration, the group members (GMs) can register with the KS, but traffic between GMs is not encrypted. The engineer checks the KS configuration and sees that the crypto gdoi group has been defined with a transform set and a security association. What is the most likely missing configuration?

Trap 1: The group name on the GMs does not match the KS.

If the group name mismatched, the GMs would not register.

Trap 2: The KS is not configured with an IPsec profile.

GETVPN uses GDOI, not IPsec profiles.

Trap 3: The GMs are in different IP subnets than the KS.

GETVPN works across different subnets.

A
The KS is missing an access list to define the traffic to encrypt.
Correct because the traffic selector is required for GETVPN policy.
B
The group name on the GMs does not match the KS.
Why wrong: If the group name mismatched, the GMs would not register.
C
The KS is not configured with an IPsec profile.
Why wrong: GETVPN uses GDOI, not IPsec profiles.
D
The GMs are in different IP subnets than the KS.
Why wrong: GETVPN works across different subnets.

Question 5easymultiple choice

An engineer is troubleshooting a site-to-site VPN between a Cisco ASA and a Cisco IOS router. The VPN is configured using IKEv1 with pre-shared keys. The tunnel establishes and traffic flows, but after a few hours, the tunnel drops and re-establishes. The engineer checks the logs and sees that the Phase 1 SA is being rekeyed. What is the most likely reason for the tunnel dropping?

Trap 1: The Dead Peer Detection (DPD) interval is too short.

DPD detects failures, but does not cause drops by itself.

Trap 2: The IPsec transform set is misconfigured.

Transform set issues would prevent tunnel establishment.

Trap 3: The Phase 2 lifetime is longer than Phase 1.

Phase 2 lifetime being longer does not cause drops.

A
The Dead Peer Detection (DPD) interval is too short.
Why wrong: DPD detects failures, but does not cause drops by itself.
B
The IKE Phase 1 lifetime is set too low.
Correct because a short lifetime causes frequent rekeys, which can lead to drops if not synchronized.
C
The IPsec transform set is misconfigured.
Why wrong: Transform set issues would prevent tunnel establishment.
D
The Phase 2 lifetime is longer than Phase 1.
Why wrong: Phase 2 lifetime being longer does not cause drops.

Question 6mediummultiple choice

A network engineer is configuring a remote access VPN using Cisco AnyConnect on an ASA. The engineer wants to use certificate-based authentication. The ASA is configured with a CA server. After configuration, users can connect, but they are prompted for a username and password instead of using certificates. The engineer checks the ASA configuration and sees that the tunnel group has authentication method set to AAA. What should the engineer do to fix this?

Trap 1: Re-enroll the CA certificate on the ASA.

The CA is already working since users can connect.

Trap 2: Change the connection profile to use the correct group.

The connection profile is separate from authentication method.

Trap 3: Configure the group policy to require certificates.

Group policies do not control authentication method.

A
Re-enroll the CA certificate on the ASA.
Why wrong: The CA is already working since users can connect.
B
Change the connection profile to use the correct group.
Why wrong: The connection profile is separate from authentication method.
C
Configure the group policy to require certificates.
Why wrong: Group policies do not control authentication method.
D
Change the tunnel group authentication method to certificate.
Correct because the authentication method must be set to certificate.

Question 7hardmultiple choice

An engineer is configuring a site-to-site VPN between two Cisco routers using IPsec with IKEv2. The engineer wants to use a pre-shared key. The configuration on both routers includes: crypto ikev2 proposal default, encryption aes-cbc-256, integrity sha256, group 14. The engineer also configures crypto ikev2 keyring and crypto ikev2 profile. The tunnel does not establish. The engineer sees that the IKEv2 SA is not created. What is the most likely missing configuration?

Trap 1: The IKEv2 proposal is not configured correctly.

The proposal is configured with valid parameters.

Trap 2: The IPsec transform set is missing.

The transform set is for Phase 2, not Phase 1.

Trap 3: The pre-shared key is not defined in the keyring.

The keyring is configured, but not applied.

A
The IKEv2 proposal is not configured correctly.
Why wrong: The proposal is configured with valid parameters.
B
The IKEv2 profile is not attached to the crypto map or interface.
Correct because the profile must be applied to activate the configuration.
C
The IPsec transform set is missing.
Why wrong: The transform set is for Phase 2, not Phase 1.
D
The pre-shared key is not defined in the keyring.
Why wrong: The keyring is configured, but not applied.

Question 8hardmultiple choice

A network engineer is configuring a DMVPN Phase 3 network. The hub router is a Cisco 4500X and the spokes are Cisco 4321s. The engineer wants to enable spoke-to-spoke direct communication. After configuration, the spokes can communicate via the hub, but not directly. The engineer checks the NHRP cache on a spoke and sees that it has a mapping for the other spoke's tunnel IP to the hub's physical IP. What is the most likely cause?

Trap 1: The NHRP network ID is mismatched between the spokes.

If the network ID mismatched, the spokes would not register.

Trap 2: The routing protocol is not redistributing spoke routes.

Routes are being exchanged because traffic flows via the hub.

Trap 3: The spokes are using GRE instead of mGRE.

Spokes use GRE, which is correct for DMVPN.

A
The NHRP network ID is mismatched between the spokes.
Why wrong: If the network ID mismatched, the spokes would not register.
B
The routing protocol is not redistributing spoke routes.
Why wrong: Routes are being exchanged because traffic flows via the hub.
C
The hub is not configured with NHRP redirect.
Correct because NHRP redirect is required for Phase 3 spoke-to-spoke shortcuts.
D
The spokes are using GRE instead of mGRE.
Why wrong: Spokes use GRE, which is correct for DMVPN.

Question 9easymultiple choice

An engineer is configuring a site-to-site VPN between two Cisco routers using IPsec with IKEv1. The engineer configures a crypto map on the outside interface. The tunnel establishes, but only traffic from one direction is encrypted. For example, traffic from Router A to Router B is encrypted, but traffic from Router B to Router A is not. The engineer checks the crypto map on Router B and finds that it is not applied to the correct interface. What is the most likely issue?

Trap 1: The access list on Router B is missing the permit statement for the…

If the access list were missing, no traffic would be encrypted.

Trap 2: The transform set on Router B is different from Router A.

Transform set mismatch would prevent tunnel establishment.

Trap 3: The peer address on Router B is configured incorrectly.

If the peer were wrong, the tunnel would not establish.

A
The crypto map is not applied to the outside interface on Router B.
Correct because the crypto map must be applied on both sides.
B
The access list on Router B is missing the permit statement for the traffic.
Why wrong: If the access list were missing, no traffic would be encrypted.
C
The transform set on Router B is different from Router A.
Why wrong: Transform set mismatch would prevent tunnel establishment.
D
The peer address on Router B is configured incorrectly.
Why wrong: If the peer were wrong, the tunnel would not establish.

Question 10mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa

dst src state conn-id slot

10.1.1.2        10.1.1.1        MM_NO_STATE       1       0

Based on this output, what can be concluded?

Trap 1: The IPsec VPN tunnel is fully established and passing traffic.

MM_NO_STATE means no IKE SA has been established; the tunnel is not up.

Trap 2: The ISAKMP SA has been deleted due to a timeout.

A deleted SA would not appear in the output; this shows an active attempt.

Trap 3: The remote peer has rejected the IKE proposal.

Rejection would typically show a different state like MM_NO_STATE with a failure reason, but this output does not indicate rejection.

A
The IPsec VPN tunnel is fully established and passing traffic.
Why wrong: MM_NO_STATE means no IKE SA has been established; the tunnel is not up.
B
IKE Phase 1 is in progress but not yet complete.
MM_NO_STATE is the initial state before Main Mode completes; it indicates negotiation is ongoing or stuck.
C
The ISAKMP SA has been deleted due to a timeout.
Why wrong: A deleted SA would not appear in the output; this shows an active attempt.
D
The remote peer has rejected the IKE proposal.
Why wrong: Rejection would typically show a different state like MM_NO_STATE with a failure reason, but this output does not indicate rejection.

Question 11mediummultiple choice

A network engineer runs the following command on Router R2:

R2# show crypto ipsec sa peer 10.2.2.2
interface: Tunnel0
    Crypto map tag: CMAP, local addr 10.1.1.2

protected vrf: (none) local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0) current_peer 10.2.2.2 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 1500, #pkts encrypt: 1500, #pkts digest: 1500 #pkts decaps: 1200, #pkts decrypt: 1200, #pkts verify: 1200 #pkts compressed: 0, #pkts decompress: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0

Based on this output, what can be concluded?

Trap 1: The IPsec tunnel is functioning correctly with no issues.

The mismatch in packet counts suggests a problem; a healthy tunnel would have roughly equal counts.

Trap 2: The tunnel is using compression, as shown by the compress counters.

The compress counters are zero, so no compression is being used.

Trap 3: The remote peer is not responding to IKE requests.

The presence of decapsulated packets shows the remote peer is responding; the issue is packet loss.

A
The IPsec tunnel is functioning correctly with no issues.
Why wrong: The mismatch in packet counts suggests a problem; a healthy tunnel would have roughly equal counts.
B
There is a routing problem causing packets to be dropped in one direction.
The difference between encaps and decaps counts indicates that some packets sent are not being received, likely due to routing or firewall issues.
C
The tunnel is using compression, as shown by the compress counters.
Why wrong: The compress counters are zero, so no compression is being used.
D
The remote peer is not responding to IKE requests.
Why wrong: The presence of decapsulated packets shows the remote peer is responding; the issue is packet loss.

Question 12hardmultiple choice

A network engineer runs the following command on Router R3:

R3# show dmvpn

Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete N: NATed, L: Local, X: No Socket

# Ent -> Number of NHRP entries with same NBMA peer

NHS Status: E => Expecting Replies, R => Responding, W => Waiting UpDn Time -> Up or Down Time for a Tunnel ==========================================================================

Interface: Tunnel0, IPv4 NHRP Details

Type:Hub, NHRP Peers:2,

# Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb

----- --------------- --------------- ----- -------- ----- 1 192.168.1.1 10.0.0.1 UP 00:12:34 D 1 192.168.1.2 10.0.0.2 UP 00:10:20 D

Based on this output, what can be concluded?

Trap 1: This router is a spoke in the DMVPN network.

The output shows 'Type:Hub', so this router is configured as a hub.

Trap 2: The tunnel interface is down because no peers are listed.

Peers are listed and the state is UP, so the tunnel is operational.

Trap 3: The router is using static NHRP mappings for all peers.

The 'D' attribute indicates dynamic mappings, not static.

A
This router is a spoke in the DMVPN network.
Why wrong: The output shows 'Type:Hub', so this router is configured as a hub.
B
There are two active spoke routers connected to this hub.
Two peers are listed with UP state, both dynamically registered, indicating two active spokes.
C
The tunnel interface is down because no peers are listed.
Why wrong: Peers are listed and the state is UP, so the tunnel is operational.
D
The router is using static NHRP mappings for all peers.
Why wrong: The 'D' attribute indicates dynamic mappings, not static.

Read the full MPLS explanation →

Question 13mediummultiple choice

A network engineer runs the following command on Router R4:

R4# show mpls ldp neighbor

Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0 TCP connection: 10.0.0.2.646 - 10.0.0.1.54567 State: Oper; Msgs sent/rcvd: 100/95; Downstream Up time: 00:15:30 LDP discovery sources: GigabitEthernet0/0, Src IP addr: 10.0.0.2 Addresses bound to peer LDP Ident:

10.0.0.2        192.168.1.1

Based on this output, what can be concluded?

Trap 1: The LDP session is down due to a TCP connection issue.

The state is 'Oper', meaning operational, not down.

Trap 2: The peer is not sending any LDP messages.

Messages sent/rcvd are 100/95, so messages are being exchanged.

Trap 3: The local router has only one label binding for the peer.

The output shows addresses bound, not label bindings; label bindings are shown with 'show mpls ldp bindings'.

A
The LDP session is down due to a TCP connection issue.
Why wrong: The state is 'Oper', meaning operational, not down.
B
The LDP session is established over the GigabitEthernet0/0 interface.
The discovery source shows GigabitEthernet0/0, confirming the session is via that interface.
C
The peer is not sending any LDP messages.
Why wrong: Messages sent/rcvd are 100/95, so messages are being exchanged.
D
The local router has only one label binding for the peer.
Why wrong: The output shows addresses bound, not label bindings; label bindings are shown with 'show mpls ldp bindings'.

Review the full OSPF breakdown →

Question 14hardmultiple choice

A network engineer runs the following command on Router R5:

R5# show ip route vrf CUSTOMER-A

Routing Table: CUSTOMER-A Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.1.1.1 to network 0.0.0.0

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C       10.1.1.0/24 is directly connected, GigabitEthernet0/0
B       10.2.2.0/24 [20/0] via 10.1.1.1, 00:10:20

Based on this output, what can be concluded?

Trap 1: The VRF has no routes and is not functional.

The VRF has both a connected and a BGP route, so it is functional.

Trap 2: The route 10.2.2.0/24 is learned via OSPF.

The code 'B' indicates BGP, not OSPF.

Trap 3: The BGP route is sourced from an internal BGP peer.

The administrative distance 20 indicates EBGP; IBGP would show 200.

A
The VRF has no routes and is not functional.
Why wrong: The VRF has both a connected and a BGP route, so it is functional.
B
The route 10.2.2.0/24 is learned via OSPF.
Why wrong: The code 'B' indicates BGP, not OSPF.
C
The VRF has a default route pointing to 10.1.1.1.
The gateway of last resort is 10.1.1.1, meaning a default route exists via that next hop.
D
The BGP route is sourced from an internal BGP peer.
Why wrong: The administrative distance 20 indicates EBGP; IBGP would show 200.

Open the full BGP breakdown →

Question 15hardmultiple choice

A network engineer runs the following command on Router R6:

R6# show ip bgp vpnv4 all summary

BGP router identifier 10.0.0.6, local AS number 65000 BGP table version is 10, main routing table version 10 10 network entries using 1440 bytes of memory 10 path entries using 800 bytes of memory 4/3 BGP path/bestpath attribute entries using 576 bytes of memory 2 BGP AS-PATH entries using 48 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory Bitfield cache entries: current 1 (at peak 2) using 32 bytes of memory BGP using 2896 total bytes of memory BGP activity 20/10 prefixes, 20/10 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.0.7        4        65001    1000    1000       10    0    0 00:20:00        5
10.0.0.8        4        65002     500     500       10    0    0 00:10:00        3

Based on this output, what can be concluded?

Trap 1: Both BGP sessions are in the Idle state.

The State/PfxRcd column shows numbers (5 and 3), not Idle, indicating the sessions are established.

Trap 2: The BGP table has no entries because the table version is 10.

The table version indicates the number of changes, not the absence of entries; there are 10 network entries.

Trap 3: The neighbor 10.0.0.8 is not configured for VPNv4.

The output shows prefixes received from 10.0.0.8, so it is configured for VPNv4.

A
Both BGP sessions are in the Idle state.
Why wrong: The State/PfxRcd column shows numbers (5 and 3), not Idle, indicating the sessions are established.
B
The router is receiving VPNv4 prefixes from both neighbors.
The State/PfxRcd shows 5 and 3 prefixes received, confirming VPNv4 route exchange.
C
The BGP table has no entries because the table version is 10.
Why wrong: The table version indicates the number of changes, not the absence of entries; there are 10 network entries.
D
The neighbor 10.0.0.8 is not configured for VPNv4.
Why wrong: The output shows prefixes received from 10.0.0.8, so it is configured for VPNv4.

Question 16mediummultiple choice

A network engineer runs the following command on Router R7:

R7# show crypto ikev2 sa detail

IKEv2 SAs:

Session-id:1, Status:UP-ACTIVE, IKE count:1, Child count:1

Tunnel-id Local Remote Status Role 1 10.1.1.1/4500 10.2.2.2/4500 READY INITIATOR Encr: AES-CBC 256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK Life/Active Time: 86400/3600 sec

Child SA: Local selector 10.1.1.0/0 - 10.1.1.255/65535 Remote selector 10.2.2.0/0 - 10.2.2.255/65535 ESP spi in/out: 0x12345678/0x87654321

Based on this output, what can be concluded?

Trap 1: The IKEv2 SA is in a failed state because it is READY.

READY is a normal operational state for an IKEv2 SA.

Trap 2: The tunnel is using RSA signatures for authentication.

The output shows PSK, not RSA.

Trap 3: The IKEv2 SA has expired because the life time is 86400 seconds.

The life time is 86400 seconds (24 hours), and the active time is 3600 seconds (1 hour), so it is still valid.

A
The IKEv2 SA is in a failed state because it is READY.
Why wrong: READY is a normal operational state for an IKEv2 SA.
B
The tunnel is using pre-shared keys for authentication.
The output shows 'Auth sign: PSK' and 'Auth verify: PSK', confirming PSK authentication.
C
The tunnel is using RSA signatures for authentication.
Why wrong: The output shows PSK, not RSA.
D
The IKEv2 SA has expired because the life time is 86400 seconds.
Why wrong: The life time is 86400 seconds (24 hours), and the active time is 3600 seconds (1 hour), so it is still valid.

Question 17mediummultiple choice

A network engineer runs the following command on Router R8:

R8# show ip nhrp

10.0.0.1/32 via 10.0.0.1

Tunnel0 created 00:10:00, expire 01:50:00 Type: dynamic, Flags: unique registered NBMA address: 192.168.1.1

10.0.0.2/32 via 10.0.0.2

Tunnel0 created 00:05:00, expire 01:55:00 Type: dynamic, Flags: unique registered NBMA address: 192.168.1.2

Based on this output, what can be concluded?

Trap 1: The router has static NHRP mappings configured.

The entries are marked as 'dynamic', not static.

Trap 2: The NHRP entries are about to expire because the expire time is…

The expire times are 1 hour 50 minutes and 1 hour 55 minutes, which is normal; they will be refreshed.

Trap 3: The router is a spoke because it has only two entries.

A spoke typically has only one entry (the hub), while a hub has multiple entries from spokes.

A
The router has static NHRP mappings configured.
Why wrong: The entries are marked as 'dynamic', not static.
B
The router is a DMVPN hub with two registered spokes.
Dynamic entries with 'unique registered' flags indicate spoke registrations on a hub.
C
The NHRP entries are about to expire because the expire time is less than 2 hours.
Why wrong: The expire times are 1 hour 50 minutes and 1 hour 55 minutes, which is normal; they will be refreshed.
D
The router is a spoke because it has only two entries.
Why wrong: A spoke typically has only one entry (the hub), while a hub has multiple entries from spokes.

Open the full BGP breakdown →

Question 18hardmultiple choice

A network engineer runs the following command on Router R9:

R9# show ip interface tunnel 0

Tunnel0 is up, line protocol is up Internet address is 10.0.0.9/24 Broadcast address is 255.255.255.255 Address determined by non-volatile memory MTU is 1400 bytes Helper address is not set Directed broadcast forwarding is disabled Outgoing access list is not set Inbound access list is not set Proxy ARP is disabled Local Proxy ARP is disabled Security level is default Split horizon is enabled ICMP redirects are always sent ICMP unreachables are always sent ICMP mask replies are never sent

IP fast switching is enabled
  IP CEF switching is enabled
  IP CEF switching turbo vector
  IP Null turbo vector
  IP multicast fast switching is enabled
  IP multicast distributed fast switching is disabled
  IP route-cache flags are Fast, CEF
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled

TCP/IP header compression is disabled RTP/IP header compression is disabled Probe proxy name replies are disabled Policy routing is disabled Network address translation is disabled WCCP Redirect outbound is disabled WCCP Redirect inbound is disabled WCCP Redirect exclude is disabled BGP Policy Mapping is disabled

Based on this output, what can be concluded?

Trap 1: The tunnel is down because the line protocol is up.

The line protocol is up, so the tunnel is operational.

Trap 2: The tunnel is using IP compression because TCP/IP header…

TCP/IP header compression is disabled, but that does not indicate compression is used; it is the opposite.

Trap 3: The tunnel has a helper address configured for DHCP.

The output shows 'Helper address is not set', so no DHCP helper is configured.

A
The tunnel is down because the line protocol is up.
Why wrong: The line protocol is up, so the tunnel is operational.
B
The MTU of 1400 bytes suggests this is a GRE or IPsec tunnel.
A reduced MTU is typical for tunnels that add encapsulation headers, such as GRE (24 bytes) or IPsec (up to 100 bytes).
C
The tunnel is using IP compression because TCP/IP header compression is disabled.
Why wrong: TCP/IP header compression is disabled, but that does not indicate compression is used; it is the opposite.
D
The tunnel has a helper address configured for DHCP.
Why wrong: The output shows 'Helper address is not set', so no DHCP helper is configured.

Question 19mediummultiple choice

Given the following configuration on a Cisco IOS-XE router:

interface Tunnel100
 ip address 10.0.0.1 255.255.255.252

tunnel source GigabitEthernet0/0/0 tunnel destination 192.168.1.1 tunnel mode ipsec ipv4 tunnel protection ipsec profile MYPROFILE

What is the effect of this configuration?

Trap 1: It creates a GRE tunnel with IPsec encryption.

GRE tunnels use tunnel mode gre ip, not tunnel mode ipsec ipv4. The mode ipsec ipv4 is used for VTI (Virtual Tunnel Interface) tunnels.

Trap 2: It creates a DMVPN phase 1 tunnel with mGRE.

DMVPN uses mGRE (tunnel mode gre multipoint) and NHRP, not tunnel mode ipsec ipv4.

Trap 3: It creates a L2TPv3 tunnel for layer 2 transport.

L2TPv3 uses tunnel mode l2tpv3, not ipsec ipv4.

A
It creates a GRE tunnel with IPsec encryption.
Why wrong: GRE tunnels use tunnel mode gre ip, not tunnel mode ipsec ipv4. The mode ipsec ipv4 is used for VTI (Virtual Tunnel Interface) tunnels.
B
It creates a VTI (Virtual Tunnel Interface) that encrypts all traffic routed into the tunnel using IPsec.
The tunnel mode ipsec ipv4 creates a static VTI, which encrypts any traffic sent to the tunnel interface using the referenced IPsec profile.
C
It creates a DMVPN phase 1 tunnel with mGRE.
Why wrong: DMVPN uses mGRE (tunnel mode gre multipoint) and NHRP, not tunnel mode ipsec ipv4.
D
It creates a L2TPv3 tunnel for layer 2 transport.
Why wrong: L2TPv3 uses tunnel mode l2tpv3, not ipsec ipv4.

Question 20mediummultiple choice

Examine the following IPsec configuration snippet:

crypto ikev2 proposal IKEV2_PROP

encryption aes-cbc-256 integrity sha256 group 14 !

crypto ikev2 policy IKEV2_POL

proposal IKEV2_PROP !

crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac

mode tunnel !

crypto ipsec profile IPSEC_PROF

set transform-set TSET set ikev2-profile IKEV2_POL

Which statement about this configuration is true?

Trap 1: The IKEv2 proposal uses AES-256, SHA-256, and DH group 14, but the…

The syntax 'set ikev2-profile IKEV2_POL' is correct; the 'set' keyword is present. However, note that the profile name is 'IKEV2_POL' but the policy is named 'IKEV2_POL' as well, which is fine.

Trap 2: The transform set is configured in transport mode, which is…

The 'mode tunnel' command is explicitly configured, so it is in tunnel mode, not transport mode.

Trap 3: The IPsec profile is incomplete because it does not include a PFS…

PFS is optional; the configuration is valid without it. The profile can still be applied.

A
The transform set uses ESP with AES-256 encryption and SHA-256 HMAC for authentication.
The transform set command 'esp-aes 256 esp-sha256-hmac' specifies ESP with AES-256 encryption and SHA-256 HMAC for integrity/authentication.
B
The IKEv2 proposal uses AES-256, SHA-256, and DH group 14, but the IPsec profile will not apply because the ikev2-profile command is missing the 'set' keyword.
Why wrong: The syntax 'set ikev2-profile IKEV2_POL' is correct; the 'set' keyword is present. However, note that the profile name is 'IKEV2_POL' but the policy is named 'IKEV2_POL' as well, which is fine.
C
The transform set is configured in transport mode, which is incorrect for site-to-site VPN.
Why wrong: The 'mode tunnel' command is explicitly configured, so it is in tunnel mode, not transport mode.
D
The IPsec profile is incomplete because it does not include a PFS (Perfect Forward Secrecy) setting.
Why wrong: PFS is optional; the configuration is valid without it. The profile can still be applied.