N10-009 Network Implementation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Site-to-site IPsec VPN with static IPs

  Why it's wrong here

  A traditional site-to-site IPsec VPN typically requires static public IP addresses for both the hub and each spoke. This is because the IPsec Security Associations (SAs) are usually configured with specific peer IP addresses, which are are used for authentication and tunnel establishment. If a branch office's IP address changes dynamically, the pre-configured IPsec tunnel parameters become invalid, breaking connectivity and requiring manual reconfiguration or reliance on more advanced dynamic IPsec features.

  When this WOULD be correct

  A company needs to establish a secure VPN tunnel between two offices, and both offices have static public IP addresses. The question would specify 'static IP addresses' for both sites.

• ✗

  Remote access VPN using SSL

  Why it's wrong here

  Remote access VPNs, often utilizing SSL/TLS, are designed for individual users or client devices to securely connect to a corporate network from remote locations. This solution establishes a secure tunnel between a single client and a VPN concentrator, allowing the client to access internal resources. It is not intended for connecting entire branch office networks (LAN-to-LAN) to a central site, as it lacks the necessary routing and network-level encapsulation for site-to-site connectivity.

  When this WOULD be correct

  A remote access VPN using SSL would be correct in a scenario where a company needs to provide secure remote access for individual employees working from home or traveling, allowing them to connect to the corporate network using a web browser or SSL VPN client.

• ✓

  Dynamic Multipoint VPN (DMVPN)

  Why this is correct

  Dynamic Multipoint VPN (DMVPN) is an ideal solution for connecting multiple branch offices, especially when they have dynamic IP addresses, to a central hub. It leverages Multipoint Generic Routing Encapsulation (mGRE) tunnels and Next Hop Resolution Protocol (NHRP) to establish dynamic, on-demand spoke-to-spoke or spoke-to-hub tunnels. This architecture significantly simplifies VPN management and scaling, as spokes only need to know the hub's IP, and NHRP dynamically resolves the actual IP addresses of other spokes.

• ✗

  Policy-based VPN

  Why it's wrong here

  Policy-based VPNs rely on access control lists (ACLs) or traffic selectors to define which specific traffic flows are encrypted and sent over the VPN tunnel. These policies are typically configured with explicit source and destination IP addresses or subnets. While robust for specific traffic, they do not inherently provide a mechanism for dynamically updating tunnel endpoints or traffic selectors when branch office IP addresses change, making them unsuitable for dynamic IP environments without additional complex configurations.

  When this WOULD be correct

  A policy-based VPN would be correct when both sites have static public IP addresses and the VPN is configured based on traffic selectors (e.g., specific source/destination subnets) rather than a virtual tunnel interface, such as in a simple site-to-site IPsec VPN between two fixed offices.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question