hardMultiple Select
350-401 NHRP Redirect Practice Question
Which two statements about DMVPN Phase 3 are true? (Choose two.)
⚠ Common exam trap
The trap is confusing DMVPN Phase 1, 2, and 3 behaviors — especially the hub's role in the data path and the tunnel type — so candidates must remember that Phase 3 uses NHRP redirect plus mGRE for dynamic spoke-to-spoke shortcuts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NHRP redirect messages are sent by the hub to inform a spoke that a better path exists directly to another spoke.
Option C is correct because in DMVPN Phase 3 the hub uses NHRP redirect messages to tell a spoke that a more optimal direct path to the destination spoke exists, prompting the spoke to resolve the destination's NBMA address and build a direct tunnel. Option E is correct because Phase 3 retains mGRE interfaces and NHRP so spokes can dynamically establish direct spoke-to-spoke tunnels, while the hub only handles initial resolution and redirects rather than remaining in the data path. Option A is wrong because Phase 3 specifically enables spoke-to-spoke traffic to bypass the hub after NHRP resolution, so the hub is not always in the data path. Option B is wrong because spokes registering their physical NBMA addresses with the NHRP server is characteristic of DMVPN in general (including Phase 1/2), not a Phase 3-specific truth. Option D is wrong because DMVPN uses mGRE (multipoint GRE) with NHRP, not point-to-point GRE tunnels, for spoke-to-spoke connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
In DMVPN Phase 3, the hub router must always be in the data path for all traffic between spokes.
Why it's wrong here
Incorrect. DMVPN Phase 3 allows spoke-to-spoke direct tunnels after the hub sends a redirect, so the hub does not remain in the data path for all traffic.
- ✗
Spokes register their physical (non-NBMA) addresses with the NHRP server (hub) to enable dynamic tunnel establishment.
Why it's wrong here
Incorrect. Spokes register their NBMA (physical) address, not a 'non-NBMA' address. The phrase 'non-NBMA' contradicts the definition of NBMA as the actual network address used for tunnel endpoints.
- ✓
NHRP redirect messages are sent by the hub to inform a spoke that a better path exists directly to another spoke.
Why this is correct
In DMVPN Phase 3, the hub sends NHRP redirect messages telling a spoke that a superior direct path to another spoke exists. The spoke then resolves the target's NBMA address and builds a direct tunnel, bypassing the hub.
- ✗
DMVPN Phase 3 uses point-to-point GRE tunnels for spoke-to-spoke connections.
Why it's wrong here
Incorrect. DMVPN Phase 3 uses multipoint GRE (mGRE) for spoke-to-spoke connections, not point-to-point GRE.
- ✓
DMVPN Phase 3 supports dynamic spoke-to-spoke tunnel establishment using NHRP and mGRE.
Why this is correct
Correct. DMVPN Phase 3 supports dynamic spoke-to-spoke tunnel establishment using NHRP for resolution and mGRE for encapsulation.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.