NSE7 Advanced VPN and Zero Trust Practice Question
An administrator is configuring a hub-and-spoke ADVPN with IBGP as the overlay routing protocol. The hub is configured as a route reflector. Which two conditions must be met for a shortcut tunnel to be established between two spokes? (Choose TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The hub must have a route to the spoke's subnet via the IPsec tunnel
For shortcut tunnels to establish, the hub must send a shortcut offer to the spokes. This requires that the hub learns the route from one spoke via IBGP and reflects it to the other spoke. The spoke must also have auto-discovery-shortcut-mode enabled to accept the shortcut. Additionally, the spokes must be able to communicate directly (no NAT between them).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The hub must have a route to the spoke's subnet via the IPsec tunnel
Why this is correct
The hub needs to have the route in its routing table to advertise to other spokes.
- ✗
The spokes must use overlapping IPsec proposal sets
Why it's wrong here
Proposal sets must match but not necessarily overlapping; they can be identical.
- ✗
The hub must have 'set auto-discovery-shortcut-mode both'
Why it's wrong here
This is not required; the hub needs 'set auto-discovery-sender enable'.
- ✗
The spokes must be in the same VDOM
Why it's wrong here
VDOM membership does not affect shortcut establishment.
- ✓
The spokes must have 'set auto-discovery-shortcut-mode client' enabled
Why this is correct
This setting allows the spoke to accept shortcut offers and establish direct tunnels.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.