I85PREP
⌘ K
Cisco ENARSI 300-410 study materials
Cisco ENARSI 300-410 study resources

Cisco ENARSI 300-410 practice questions

One question at a time. Build your Cisco ENARSI 300-410 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Layer 3 Technologies

A router running EIGRP has a feasible successor for a destination in its topology table. What is the primary operational advantage of this condition?

  1. The router suppresses the route from updates until the hold timer expires.
  2. The route can be installed immediately if the successor fails, without a DUAL diffusing computation. Correct answer.
  3. The router advertises the route with an infinite metric to prevent loops.
  4. The route is automatically load-balanced across unequal-cost paths.

Explanation

A feasible successor is a backup route whose reported distance is lower than the feasible distance of the current successor, which satisfies the feasibility condition and guarantees a loop-free path. Because of this, DUAL can promote it to successor immediately when the successor is lost, avoiding a diffusing computation and the associated query propagation. This is the core benefit of EIGRP's fast convergence design.

Question 2Layer 3 Technologies

Which OSPF network type elects a DR and BDR on a multiaccess segment by default?

  1. Loopback
  2. Point-to-multipoint
  3. Broadcast Correct answer.
  4. Point-to-point

Explanation

The OSPF broadcast network type treats the segment as multiaccess and runs a DR/BDR election so that all routers form full adjacencies only with the designated routers. Point-to-point and point-to-multipoint network types do not elect a DR/BDR. Loopback interfaces are advertised as stub host routes and never participate in DR election.

Question 3Layer 3 Technologies

What is the administrative distance of an EIGRP internal route by default on a Cisco router?

  1. 170
  2. 90 Correct answer.
  3. 120
  4. 110

Explanation

Cisco assigns internal EIGRP routes an administrative distance of 90, which makes them preferred over OSPF (110), RIP (120), and external EIGRP (170). Administrative distance is used to select between routes learned from different sources for the same prefix. Knowing these values is essential when troubleshooting route selection.

Question 4Layer 3 Technologies

Which command displays only the EIGRP routes installed in the routing table on a Cisco router?

  1. show ip protocols
  2. show ip eigrp topology
  3. show ip route eigrp Correct answer.
  4. show ip eigrp neighbors

Explanation

The show ip route eigrp command filters the routing table to display only routes learned via EIGRP, marked with a D or D EX code. This is useful to confirm which EIGRP prefixes are actually installed and their metrics. The other commands show topology, neighbor, or protocol configuration information rather than installed routes.

Question 5Layer 3 Technologies

A static route to 10.10.10.0/24 is configured with next hop 192.168.1.1, but that next hop is not reachable via any interface. What happens to the static route by default?

  1. It is converted into a floating static route automatically.
  2. It is installed with an administrative distance of 255.
  3. It is installed in the routing table and traffic is black-holed.
  4. It is not installed in the routing table until the next hop becomes reachable. Correct answer.

Explanation

By default, a static route with a specified next hop is only installed in the routing table if that next hop is resolvable through a connected or otherwise reachable route. If the next hop is unreachable, the route stays out of the table. This behavior prevents black-holing traffic toward an unresolvable gateway.

Question 6Layer 3 Technologies

Which IPv6 address type is used by OSPFv3 as the source for hello packets on an interface?

  1. The anycast address
  2. The link-local address Correct answer.
  3. The global unicast address only
  4. The solicited-node multicast address

Explanation

OSPFv3 uses the link-local address of the interface as the source address for hello and other protocol packets, and it uses link-local addresses for next-hop forwarding. This design decouples the protocol operation from global addressing. Neighbor adjacencies are therefore formed over link-local addresses.

Question 7Layer 3 Technologies

Which BGP attribute is used first in the best-path selection algorithm among the well-known attributes listed?

  1. Origin
  2. Multi-exit discriminator
  3. AS path length
  4. Local preference Correct answer.

Explanation

The BGP best-path algorithm evaluates weight first, then local preference, then locally originated routes, then AS path length, origin, MED, and so on. Local preference is therefore evaluated before AS path, origin, and MED. Higher local preference is preferred.

Question 8Layer 3 Technologies

Which protocol uses the Diffusing Update Algorithm to guarantee loop-free paths?

  1. OSPF
  2. EIGRP Correct answer.
  3. RIP
  4. IS-IS

Explanation

EIGRP uses DUAL, which relies on the feasibility condition and reported distance to ensure that successor and feasible successor paths are loop-free. When a successor is lost and no feasible successor exists, DUAL runs a diffusing computation by querying neighbors. OSPF and IS-IS use the SPF algorithm, and RIP uses hop count with split horizon mechanisms.

Question 9Layer 3 Technologies

A network engineer wants an EIGRP router to advertise a summary route for 10.0.0.0/8 covering its component subnets. Which interface-level command accomplishes this?

  1. network 10.0.0.0 0.255.255.255
  2. ip eigrp summary 10.0.0.0/8
  3. ip summary-address eigrp 100 10.0.0.0 255.0.0.0 Correct answer.
  4. auto-summary

Explanation

The interface-level command ip summary-address eigrp <AS> <prefix> <mask> causes the router to advertise a summary route out of that interface while suppressing the more specific component routes. The summary is generated locally and points to Null0 on the summarizing router. The network command enables EIGRP on interfaces rather than summarizing.

Question 10Layer 3 Technologies

An engineer configures a floating static route to 172.16.0.0/16 with administrative distance 200 while OSPF also learns the same prefix with default distance 110. What is the result?

  1. Both routes are installed and load-balanced equally.
  2. The static route is installed and OSPF is suppressed.
  3. The OSPF route is installed while the static route remains a backup. Correct answer.
  4. Neither route is installed due to distance conflict.

Explanation

A floating static route uses a higher administrative distance than the dynamic protocol, so the OSPF route (AD 110) is preferred and installed. The static route (AD 200) is only installed if the OSPF route is withdrawn. This is the standard technique for providing a backup path.

Question 11Layer 3 Technologies

An OSPF router is stuck in EXSTART state with a neighbor. Which condition is the most likely cause?

  1. Mismatched hello and dead timers
  2. Mismatched authentication keys
  3. Mismatched area IDs
  4. Mismatched MTU values on the two interfaces Correct answer.

Explanation

The EXSTART state is where the master/slave relationship is negotiated and database description packets are exchanged. A mismatched MTU causes the larger DBD packet to be dropped, so the routers cannot progress past EXSTART. Timer, area, and authentication mismatches prevent adjacency earlier, typically keeping neighbors from forming at all.

Question 12Layer 3 Technologies

Which OSPF LSA type is generated by an ABR to describe networks in another area to routers in a non-backbone area?

  1. Type 1 router LSA
  2. Type 3 summary LSA Correct answer.
  3. Type 5 external LSA
  4. Type 2 network LSA

Explanation

Type 3 summary LSAs are generated by area border routers to advertise inter-area prefixes into an area. They describe networks that exist in other areas so that internal routers can reach them. Type 1 and Type 2 LSAs stay within an area, and Type 5 LSAs describe external redistributed routes.

Question 13Layer 3 Technologies

A router is configured with ipv6 unicast-routing and OSPFv3 on two interfaces in area 0. Which statement about OSPFv3 configuration is correct?

  1. OSPFv3 is enabled per interface rather than with a network statement. Correct answer.
  2. OSPFv3 uses the same router-id selection as OSPFv2 without configuration.
  3. OSPFv3 requires an IPv4 network command to enable interfaces.
  4. OSPFv3 requires a global IPv6 address on each interface.

Explanation

OSPFv3 is enabled by applying the ipv6 ospf <process> area <area> command directly under each interface, replacing the OSPFv2 network statement model. A router ID is still required and is typically configured manually as an IPv4 address. Interfaces need only a link-local address to run OSPFv3.

Question 14Layer 3 Technologies

Which command on a Cisco router enables EIGRP for the 10.1.0.0/16 network using a wildcard mask?

  1. router eigrp 10.1.0.0
  2. network 10.1.0.0 255.255.0.0
  3. network 10.1.0.0/16
  4. network 10.1.0.0 0.0.255.255 Correct answer.

Explanation

EIGRP uses the network command with a wildcard mask to identify interfaces on which the protocol is enabled. The wildcard 0.0.255.255 matches the 10.1.0.0/16 range. The network command does not accept a subnet mask in place of a wildcard mask, and the router eigrp command takes an autonomous system number.

Question 15Layer 3 Technologies

After enabling OSPF on a router, the engineer notices that a loopback interface is advertised as a /32 host route instead of its configured /24. What is the cause?

  1. The loopback is configured as passive by default.
  2. OSPF advertises loopbacks as stub host routes by default. Correct answer.
  3. The network type is point-to-point.
  4. The interface has a duplicate router ID.

Explanation

OSPF treats loopback interfaces as loopback network type and advertises them as stub host routes with a /32 mask by default. To advertise the actual subnet mask, the interface must be configured with ip ospf network point-to-point. This is a common surprise when summarizing loopback addresses.

Question 16Layer 3 Technologies

Which EIGRP packet type is sent as a multicast to discover neighbors and to acknowledge received packets?

  1. Hello Correct answer.
  2. Update
  3. Query
  4. Reply

Explanation

EIGRP hello packets are sent to the multicast address 224.0.0.10 to discover and maintain neighbors, and they also serve as acknowledgments for received reliable packets. Updates, queries, and replies are sent reliably and are used for topology information and DUAL computations. Hello packets are the keepalive mechanism of EIGRP.

Question 17Layer 3 Technologies

A network uses route redistribution from OSPF into EIGRP. Which mechanism should be used to prevent routing loops between the two domains?

  1. Increasing the EIGRP variance value
  2. Disabling split horizon on all interfaces
  3. Configuring OSPF as a stub area
  4. Route tags applied during redistribution and matched in route maps Correct answer.

Explanation

Route tags allow the redistributing router to mark routes from one protocol and then deny those tagged routes when redistributing back, preventing mutual redistribution loops. Route maps match the tag and filter as needed. Variance, stub areas, and split horizon do not address two-way redistribution loops.

Question 18Layer 3 Technologies

Which BGP attribute is considered a well-known discretionary attribute?

  1. Multi-exit discriminator
  2. Local preference Correct answer.
  3. Origin
  4. AS path

Explanation

Local preference is a well-known discretionary attribute, meaning all BGP implementations must recognize it but it does not have to be included in every update. It is used to influence outbound path selection within an autonomous system. AS path and origin are well-known mandatory attributes, and MED is optional non-transitive.

Question 19Layer 3 Technologies

A router has two equal-cost OSPF paths to a remote network. Which behavior occurs by default?

  1. The path with the lowest interface cost is installed.
  2. The paths are summarized into a single route.
  3. Both paths are installed and traffic is load-balanced. Correct answer.
  4. Only one path is installed and the other is discarded.

Explanation

OSPF supports equal-cost multipath by default, so up to the platform maximum of equal-cost routes are installed and traffic is load-balanced. No additional configuration is required for equal-cost balancing. Unequal-cost balancing is not supported by OSPF.

Question 20Layer 3 Technologies

An engineer needs to prevent a specific OSPF-enabled interface from forming adjacencies while still advertising its connected subnet. Which configuration achieves this?

  1. Set the interface OSPF cost to 65535.
  2. Change the interface to point-to-multipoint.
  3. Remove the network statement for the interface.
  4. Configure the interface as passive with passive-interface. Correct answer.

Explanation

The passive-interface command stops OSPF from sending hellos and forming adjacencies on the interface while the connected subnet is still advertised as a stub network in the router LSA. Removing the network statement would stop advertising the subnet entirely. Changing cost or network type does not prevent adjacency formation.

Question 21Layer 3 Technologies

A router running EIGRP receives a query for a route for which it has no feasible successor. What is the correct description of its behavior?

  1. It drops the query and waits for the hold timer to expire.
  2. It immediately replies with an infinite metric and stops processing.
  3. It installs the queried route as a successor and replies with the metric.
  4. It marks the route active and queries its own neighbors except the one it received the query from. Correct answer.

Explanation

When a router loses its successor and has no feasible successor, the route becomes active and DUAL sends queries to all neighbors except the one that caused the change. Each neighbor either replies with a feasible path or continues the query propagation. The route remains active until all replies are received.

Question 22Layer 3 Technologies

An ABR connects area 0 and area 1. A Type 3 LSA for a network in area 1 is advertised into area 0 with the advertising router set to the ABR. What is the metric carried in that LSA?

  1. Zero, since summary LSAs do not carry metrics
  2. The cost of the ABR's interface into area 1 only
  3. The ABR's cost to reach the destination within area 1 Correct answer.
  4. The original cost from the originating router

Explanation

When an ABR generates a Type 3 summary LSA, the metric is the ABR's own cost to reach the destination network inside the source area, not just the outgoing interface cost. This metric is used by routers in the receiving area to compute their total distance. The cost is therefore the ABR's shortest path cost to the prefix.

Question 23Layer 3 Technologies

A router has an EIGRP route with a reported distance of 1000 and a feasible distance of 1500. A neighbor advertises the same prefix with a reported distance of 1600. What is the status of that neighbor's path?

  1. It becomes the successor because 1600 is higher than 1500.
  2. It does not satisfy the feasibility condition and cannot be a feasible successor. Correct answer.
  3. It is installed as a backup route with an infinite metric.
  4. It becomes a feasible successor because 1600 is a valid metric.

Explanation

The feasibility condition requires the reported distance of the candidate path to be lower than the current feasible distance of the successor. Here 1600 is greater than 1500, so the condition fails and the path cannot become a feasible successor. It may still be used if the route goes active and no better path exists.

Question 24Layer 3 Technologies

A network uses OSPFv2 and OSPFv3 on the same interfaces. Which statement about running both protocols simultaneously is correct?

  1. OSPFv2 and OSPFv3 maintain separate adjacencies and LSDBs per address family. Correct answer.
  2. OSPFv3 automatically imports OSPFv2 routes into its database.
  3. Both protocols share a single link-state database keyed by router ID.
  4. OSPFv3 requires OSPFv2 to be disabled on the interface first.

Explanation

OSPFv2 and OSPFv3 are independent protocol instances with separate neighbor tables and link-state databases, even when enabled on the same interface. They can run concurrently and do not share topology information. Route exchange between them requires redistribution.

Question 25Layer 3 Technologies

A route map is used in redistribution with a permit sequence that matches a tag and a deny sequence with no match clause. What is the effect on routes that do not match the permit sequence?

  1. They are redistributed because the implicit final action is permit.
  2. They are redistributed with a default metric of zero.
  3. They are queued for the next redistribution cycle.
  4. They are denied because the explicit deny sequence matches all remaining routes. Correct answer.

Explanation

A route map deny sequence with no match clause matches all routes, so any route not matched by an earlier permit sequence is denied. This is a common way to build a whitelist of redistributed routes. The implicit deny at the end of a route map would also deny unmatched routes, but the explicit deny makes the intent clear.

Question 26Layer 3 Technologies

A router running OSPF has three equal-cost paths to 192.168.10.0/24. Which default behavior does Cisco IOS apply for forwarding traffic to that prefix?

  1. It installs only the path with the highest interface bandwidth
  2. It installs only the first path learned and marks the others as backup
  3. It installs only the path with the lowest next-hop IP address
  4. It installs all equal-cost paths and load-balances per flow using CEF hashing Correct answer.

Explanation

Cisco IOS supports equal-cost multipath, so all OSPF paths with identical cost are installed in the routing table. CEF then load-balances across them using a hash of the source and destination addresses. No tie-breaking by next-hop address or arrival order is applied by default.

Question 27Layer 3 Technologies

Which OSPF network type elects a DR and BDR on a segment and sends hello packets every 10 seconds by default?

  1. Point-to-point
  2. Non-broadcast
  3. Point-to-multipoint
  4. Broadcast Correct answer.

Explanation

The broadcast network type behaves like a LAN: it elects a DR and BDR and uses a 10-second hello interval with a 40-second dead interval. Point-to-point and point-to-multipoint types do not elect a DR. Non-broadcast also elects a DR but uses a 30-second hello interval.

Question 28Layer 3 Technologies

An engineer wants EIGRP to advertise a default route into a stub area of the network without redistributing a static default. Which configuration accomplishes this on the EIGRP process?

  1. ip summary-address eigrp 100 0.0.0.0 0.0.0.0 Correct answer.
  2. default-information allowed
  3. network 0.0.0.0
  4. redistribute static

Explanation

On Cisco IOS, the ip summary-address eigrp command with 0.0.0.0/0 creates a default summary that is advertised to EIGRP neighbors on the interface where it is applied. This avoids redistributing a static route. The other options either do not exist or do not inject a default into EIGRP.

Question 29Layer 3 Technologies

Which BGP path attribute is classified as optional transitive and can carry community values between autonomous systems?

  1. ORIGIN
  2. MULTI_EXIT_DISC
  3. LOCAL_PREF
  4. COMMUNITIES Correct answer.

Explanation

COMMUNITIES is an optional transitive attribute, so it can be propagated to eBGP peers and used for route tagging and policy. LOCAL_PREF and ORIGIN are well-known attributes. MULTI_EXIT_DISC is optional nontransitive.

Question 30Layer 3 Technologies

An engineer configures a static route to 10.20.0.0/16 pointing to a next hop that is reachable through an OSPF-learned route. The static route is installed in the routing table. Which statement describes how this route behaves if the OSPF route to the next hop is withdrawn?

  1. The static route is removed because its recursive next hop is no longer resolvable Correct answer.
  2. The static route is retained but marked as unreachable in the RIB
  3. The static route remains installed because it is a directly connected route
  4. The static route is converted into an OSPF external route

Explanation

A static route whose next hop is resolved recursively through another route depends on that resolving route. If the OSPF route to the next hop disappears, the recursive lookup fails and the static route is removed from the RIB. This is standard recursive route resolution behavior.

Question 31Layer 3 Technologies

A router has two OSPF paths to 172.16.5.0/24: path A through a FastEthernet interface with cost 10 and path B through a GigabitEthernet interface with cost 20. Which path is installed and why?

  1. Neither path, because the cost mismatch prevents installation
  2. Path B, because GigabitEthernet has higher bandwidth
  3. Both paths, because OSPF load-balances unequal costs by default
  4. Path A, because OSPF prefers the lower total cost Correct answer.

Explanation

OSPF selects the path with the lowest cumulative cost. Path A has cost 10 versus path B's cost 20, so path A is installed. OSPF does not load-balance unequal costs without additional features such as variance in EIGRP, which OSPF does not support.

Question 32Layer 3 Technologies

An engineer wants to prevent OSPF from forming adjacencies on a LAN interface while still advertising the connected subnet into OSPF. Which configuration achieves this?

  1. ip ospf network point-to-point on the interface
  2. router ospf; passive-interface <interface> Correct answer.
  3. ip ospf hello-interval 65535 on the interface
  4. ip ospf passive-interface on the interface

Explanation

The passive-interface command under router ospf stops hello packets on the interface while still including the connected network in OSPF advertisements. The interface-level ip ospf passive-interface command is not valid IOS syntax. Changing the network type or hello interval does not achieve suppression while keeping advertisement.

Question 33Layer 3 Technologies

A router running EIGRP has a successor with feasible distance 2000 and reported distance 1500. A new advertisement from a different neighbor reports a distance of 1800. What is the result?

  1. The new route is rejected because 1800 is less than the successor's reported distance
  2. The new route is rejected because 1800 is greater than the feasibility condition threshold
  3. The new route becomes the successor because 1800 is lower than 2000 Correct answer.
  4. The new route becomes a feasible successor

Explanation

The feasibility condition for a feasible successor requires that the reported distance be less than the current feasible distance (1500 < 2000). However, a new route with a lower total distance than the current successor (1800 < 2000) becomes the new successor. The feasibility condition applies to backup selection, not to replacing the successor with a better path.

Question 34Layer 3 Technologies

Which command displays the OSPF link-state database entries originated by the local router only?

  1. show ip ospf interface brief
  2. show ip ospf database self-originate Correct answer.
  3. show ip ospf neighbor detail
  4. show ip ospf border-routers

Explanation

The show ip ospf database self-originate command filters the LSDB to LSAs that the local router itself originated. The other commands show neighbor state, interface parameters, or ABR/ASBR reachability, not self-originated LSAs.

Question 35Layer 3 Technologies

A network engineer is redistributing routes from EIGRP into OSPF. Which configuration element is required to set the OSPF external metric type to E2 with a metric of 20?

  1. redistribute eigrp 100 metric-type 2 metric 20 subnets
  2. redistribute eigrp 100 route-map SET-E2
  3. redistribute eigrp 100 metric 20 metric-type 2 subnets Correct answer.
  4. redistribute eigrp 100 subnets metric-type 2

Explanation

Under router ospf, the redistribute command accepts the metric keyword followed by the value and the metric-type keyword. The order metric <value> metric-type <type> is the documented syntax. The subnets keyword is needed to include subnetted routes.

Question 36Layer 3 Technologies

Which BGP feature allows a router to advertise a prefix to a peer even when the exact prefix is not present in the local BGP table, provided a matching route exists in the IGP?

  1. Default originate
  2. Network command with a matching IGP route Correct answer.
  3. Route aggregation with the summary-only keyword
  4. Conditional advertisement

Explanation

The BGP network command injects a prefix into BGP only if a matching route exists in the routing table, which can come from an IGP. Conditional advertisement controls advertisement based on the presence of another prefix. Aggregation and default originate serve different purposes.

Question 37Layer 3 Technologies

An engineer notices that a redistributed OSPF external route appears with a forwarding address of 0.0.0.0 in the Type 5 LSA. Which condition causes this?

  1. The external route is summarized by the ASBR
  2. The external route is in a stub area
  3. The ASBR is also the next hop for the redistributed route
  4. The redistributed route is a connected or static route with no next-hop address Correct answer.

Explanation

When the redistributed route is connected or static without a next-hop address, the ASBR cannot supply a meaningful forwarding address, so the Type 5 LSA carries 0.0.0.0. Receivers then forward traffic through the ASBR itself. Summarization and stub areas do not cause this field to be zero.

Question 38Layer 3 Technologies

A router has an EIGRP topology entry with feasible distance 3000. A neighbor reports a route with reported distance 2500 and total distance 3500. What is the correct classification of this route?

  1. Neither successor nor feasible successor
  2. Successor
  3. Feasible successor Correct answer.
  4. Successor after the current successor fails

Explanation

The reported distance of 2500 is less than the feasible distance of 3000, so the route satisfies the feasibility condition and is kept as a feasible successor. Its total distance of 3500 is higher than the current successor, so it is not installed as the successor. It can be promoted if the successor fails.

Question 39Layer 3 Technologies

An OSPF ABR receives a Type 3 LSA for a network in area 1 and advertises it into area 0. A Type 3 LSA for the same network is then received back from another ABR in area 0. What does the receiving ABR do with the returning LSA?

  1. It floods the LSA into all nonbackbone areas
  2. It installs the LSA and creates a routing loop
  3. It ignores the LSA because Type 3 LSAs are not flooded back into the originating area Correct answer.
  4. It converts the LSA into a Type 5 LSA

Explanation

OSPF area structure prevents Type 3 LSAs from being flooded back into the area they originated from. The ABR recognizes that the network belongs to area 1 and does not reinstall or re-advertise the returning summary. This is a core loop-prevention property of the OSPF hierarchy.

Question 40Layer 3 Technologies

A network uses route redistribution in both directions between OSPF and EIGRP. Which mechanism should be used to prevent routes from being redistributed back into their original protocol?

  1. Route tags applied during redistribution and matched with route maps Correct answer.
  2. BGP confederations between the two domains
  3. OSPF stub areas on all nonbackbone areas
  4. EIGRP stub routing on all spokes

Explanation

Route tags mark routes as belonging to a source protocol during redistribution. On the reverse redistribution, a route map denies routes carrying that tag, preventing feedback loops. Stub areas, EIGRP stub, and BGP confederations address different design problems and do not prevent mutual redistribution loops.

Question 41VPN Technologies

Which technology allows a service provider to carry a customer's multicast traffic across an MPLS backbone without enabling multicast routing on the provider core routers?

  1. IPsec transport mode with multicast replication
  2. GRE tunnel with PIM sparse mode configured on the tunnel interface
  3. Multicast VPN using mLDP in-band signaling Correct answer.
  4. MPLS L3VPN unicast VRF with PIM enabled on the PE-to-CE link only

Explanation

An mVPN uses a provider core that forwards multicast inside labeled tunnels, so core routers only need MPLS forwarding rather than PIM state. mLDP (and RSVP-TE P2MP) provide the in-band signaling that builds these point-to-multipoint LSPs. The customer multicast domain stays isolated in the VRF at the provider edge.

Question 42VPN Technologies

In a DMVPN Phase 3 design, which mechanism allows spoke-to-spoke traffic to bypass the hub after the initial resolution?

  1. Multicast replication of all traffic at the hub
  2. Static point-to-point tunnels between every pair of spokes
  3. NHRP redirect on the hub and NHRP shortcut on the spokes Correct answer.
  4. OSPF point-to-multipoint network type on the tunnel interface

Explanation

Phase 3 introduces NHRP redirect messages from the hub and NHRP shortcut lookup on the spokes. When a spoke sends traffic to the hub, the hub redirects it, prompting the spoke to resolve the destination spoke's NBMA address directly. The resulting direct tunnel carries subsequent packets without transiting the hub.

Question 43VPN Technologies

A GET VPN deployment must keep the same encryption keys active across a WAN so that any group member can decrypt traffic from any other member without rekeying per pair. Which keying model does GET VPN use?

  1. Static pre-shared keys configured on each peer pair
  2. Group Domain of Interpretation with a group security association Correct answer.
  3. Public-key infrastructure certificates issued per tunnel
  4. Per-peer IKEv2 with unique session keys

Explanation

GET VPN uses GDOI, in which a key server distributes a group security association (a shared policy and traffic encryption key) to all group members. Because every member holds the same group keys, traffic can flow directly between any pair without per-pair IPsec negotiation. This is what preserves native routing across the WAN.

Question 44VPN Technologies

Which statement describes the role of the tunnel interface in a classic IPsec VTI-based site-to-site VPN?

  1. It replaces IKE by carrying keys in the ESP payload
  2. It is a routable interface whose state follows the IPsec SA, allowing dynamic routing over the tunnel Correct answer.
  3. It provides NAT traversal by encapsulating ESP in TCP
  4. It encrypts traffic before the crypto map is applied to the physical interface

Explanation

A VTI is a logical interface that can be assigned an IP address and included in routing protocols. Its line protocol tracks the IPsec security association, so routes are withdrawn when the tunnel drops. Traffic routed out the VTI is encrypted according to the associated IPsec profile.

Question 45VPN Technologies

A FlexVPN spoke must learn a default route from the hub while the hub learns the specific spoke LAN prefixes. Which IKEv2 authorization feature accomplishes this?

  1. Reverse route injection on the spoke for hub prefixes
  2. OSPF demand circuits on the virtual access interface
  3. Static routes redistributed into BGP on the spoke
  4. Per-user or per-identity attribute-based route injection using AAA attributes Correct answer.

Explanation

FlexVPN uses IKEv2 authorization to push attributes such as routes from AAA to the peer during session establishment. The hub can send a default route to the spoke, and the spoke can advertise its local prefixes to the hub. This attribute-based route injection removes the need for dynamic routing protocols in hub-and-spoke designs.

Question 46VPN Technologies

Which MPLS VPN label is used by the egress PE to identify the customer VRF to which an incoming packet belongs?

  1. The IGP label (outer label)
  2. The BGP extended community route target
  3. The VPNv4 route label (inner label) Correct answer.
  4. The EXP bits in the label stack

Explanation

The inner label in an MPLS VPN label stack is the VPN label advertised with the VPNv4 route. The egress PE uses it to select the correct VRF for the packet after the outer label is popped. The outer IGP label only delivers the packet to the egress PE.

Question 47VPN Technologies

Which DMVPN component maps a spoke's tunnel IP address to its public NBMA address?

  1. NHRP Correct answer.
  2. mGRE
  3. IPsec profile
  4. EIGRP stuck-in-active helper

Explanation

NHRP is the resolution protocol that registers each spoke's tunnel address with its NBMA address at the hub. Spokes query NHRP to learn the NBMA address of a destination spoke before building a direct tunnel. mGRE provides the multipoint tunnel itself but does not perform address resolution.

Question 48VPN Technologies

In a DMVPN Phase 2 network, spokes must be able to form spoke-to-spoke tunnels and also form routing adjacencies directly. Which tunnel and routing configuration supports this?

  1. Point-to-point GRE tunnels with EIGRP split horizon enabled
  2. mGRE with NHRP disabled and static routes on each spoke
  3. mGRE with OSPF broadcast network type and a single /32 tunnel subnet
  4. mGRE with a /24 tunnel subnet and EIGRP split horizon disabled on the hub tunnel Correct answer.

Explanation

Phase 2 requires a multipoint GRE tunnel with a common subnet so spokes can resolve each other and form direct adjacencies. Because the hub tunnel is a single interface, split horizon must be disabled so routes learned from one spoke are advertised to others. This combination enables spoke-to-spoke tunnels and full routing convergence.

Question 49VPN Technologies

Which statement best describes the purpose of the Group Domain of Interpretation rekey message in a GET VPN network?

  1. It triggers IKEv2 reauthentication between each pair of group members
  2. It distributes new traffic encryption keys and policy to group members from the key server Correct answer.
  3. It performs NAT traversal detection for ESP packets
  4. It refreshes the MPLS label binding for the group

Explanation

The key server sends GDOI rekey messages to refresh the group security association, delivering new traffic encryption keys and policy before the old ones expire. This keeps the group synchronized without per-pair negotiation. Rekey can be unicast or multicast to the group.

Question 50VPN Technologies

A network engineer is configuring a point-to-point IPsec tunnel between two routers using IKEv2 with a pre-shared key. Which two proposals must match on both peers for the IKE SA to establish?

  1. IKEv2 cookie and NAT-T keepalive timers
  2. Encryption, integrity, PRF, DH group, and authentication method Correct answer.
  3. Encryption, integrity, and ESP anti-replay window only
  4. BGP AS number and route target

Explanation

IKEv2 SA negotiation requires matching encryption, integrity, pseudorandom function, Diffie-Hellman group, and authentication method in the IKE proposal. If any of these differ, the peers cannot agree on an IKE SA. The IPsec proposal is negotiated separately after the IKE SA is up.