NSE7 Advanced VPN and Zero Trust Practice Question
An administrator is deploying a hub-and-spoke ADVPN with three spoke sites. The spokes have dynamic IP addresses. The hub has a static IP. The administrator wants the spokes to establish direct shortcut tunnels when they communicate with each other. Which THREE conditions must be met for shortcut tunnels to be established? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The spoke tunnel interfaces must be in the same IP subnet
For ADVPN shortcuts to be established, three conditions must be met: (A) The spoke tunnel interfaces must be in the same IP subnet to allow direct routing. (D) Auto-discovery must be enabled in the phase1 settings on all spokes to exchange shortcut information. (E) The hub must have routes to all spoke local subnets so it can forward shortcut initiation packets. Option B is incorrect because spokes can have dynamic IP addresses with ADVPN. Option C is incorrect because 'set shortcuthub enable' is not required; the hub functions as a shortcut hub by default.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The spoke tunnel interfaces must be in the same IP subnet
Why this is correct
Shortcut tunnels require the spoke tunnel interfaces to be in the same subnet (e.g., 10.0.0.0/24) to allow direct communication.
- ✗
The spokes must have static public IP addresses
Why it's wrong here
Dynamic IPs are fine; auto-discovery handles dynamic addresses.
- ✗
The hub must be configured with 'set shortcuthub enable' to act as a shortcut hub
Why it's wrong here
Shortcuthub is not required; the hub automatically facilitates shortcut negotiation.
- ✓
Auto-discovery must be enabled in the phase1 settings on all spokes
Why this is correct
Without auto-discovery, the spoke will not initiate or respond to shortcut requests.
- ✓
The hub must have routes to all spoke local subnets
Why this is correct
The hub needs routes to forward traffic to the correct spoke, which triggers shortcut negotiation.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.