View Full Cisco CCNP Security 300-730 Exam Dumps and Practice Test Dumps.

 

Question 301

Which VPN architecture allows multiple remote sites to dynamically establish secure tunnels through a shared multipoint tunnel interface?

1. GETVPN
2. DMVPN
3. MACsec
4. Remote-access SSL VPN

Correct Answer: 2

Explanation

DMVPN is designed to provide scalable VPN connectivity among multiple sites using a combination of multipoint GRE, NHRP, and IPsec. The multipoint GRE interface allows a single tunnel interface to support multiple destinations instead of requiring a separate point-to-point tunnel interface for every remote site. NHRP dynamically resolves tunnel endpoint information, while IPsec provides encryption and security. GETVPN also supports group-based encryption but uses a different architecture and does not rely on mGRE and NHRP. MACsec protects Layer 2 Ethernet traffic, while remote-access VPNs primarily connect individual users. DMVPN is therefore appropriate for dynamic multi-site VPN environments.

Question 302

In a DMVPN network, which device normally acts as the central NHRP server?

1. Hub
2. Spoke
3. Certificate Authority
4. Key Server

Correct Answer: 1

Explanation

In a traditional DMVPN architecture, the hub commonly acts as the central NHRP server. Spokes register their tunnel and NBMA information with the hub so that the hub can maintain mappings and assist with dynamic peer discovery. Depending on the DMVPN phase and design, spokes can use NHRP information to establish direct spoke-to-spoke communication. The Certificate Authority performs PKI functions, while a GETVPN Key Server distributes group encryption information. The hub’s NHRP role is therefore fundamental to DMVPN operation because it provides centralized registration and resolution services for participating spokes.

Question 303

Which DMVPN mechanism allows a spoke to register its tunnel endpoint information with the hub?

1. IKE_AUTH
2. NHRP Registration
3. RADIUS Access-Request
4. SCEP Enrollment

Correct Answer: 2

Explanation

NHRP Registration allows a DMVPN spoke to register information about its tunnel endpoint with the NHRP server, typically the hub. The registration allows the hub to learn the spoke’s relevant NBMA and tunnel addressing information. This information can later be used to resolve destinations and support dynamic communication between DMVPN peers. IKE_AUTH is part of IKEv2 authentication, RADIUS Access-Request messages are associated with AAA, and SCEP is used for certificate enrollment. NHRP Registration is therefore the mechanism that establishes the necessary dynamic mapping information between DMVPN spokes and the central NHRP server.

Question 304

Which DMVPN phase primarily uses the hub as the communication point between spokes?

1. Phase 3
2. Phase 2
3. Phase 1
4. GETVPN Phase 1

Correct Answer: 3

Explanation

DMVPN Phase 1 primarily uses a hub-and-spoke communication model in which spoke traffic is sent through the hub. Spokes do not dynamically establish direct spoke-to-spoke tunnels in the same manner supported by later DMVPN phases. Phase 2 introduced direct spoke-to-spoke communication using NHRP resolution, while Phase 3 added NHRP Redirect and Shortcut mechanisms to improve scalability and routing flexibility. GETVPN is a separate group-encryption technology. Understanding the differences between DMVPN phases is important when determining whether traffic should remain hub-centric or whether direct spoke-to-spoke paths can be established.

Question 305

Which DMVPN phase supports dynamic spoke-to-spoke tunnels using NHRP resolution?

1. Phase 1
2. Phase 2
3. Phase 3 only
4. Phase 0

Correct Answer: 2

Explanation

DMVPN Phase 2 supports dynamic spoke-to-spoke communication. When a spoke needs to reach another spoke, NHRP can be used to resolve the destination’s NBMA address, allowing the originating spoke to establish a direct tunnel path. This reduces the need for traffic to continuously traverse the hub. Phase 1 primarily uses hub-and-spoke forwarding, while Phase 3 builds on the architecture with NHRP Redirect and Shortcut mechanisms. Therefore, Phase 2 is the DMVPN phase associated with direct dynamic spoke-to-spoke tunnels based on NHRP resolution.

Question 306

What is the primary function of mGRE in a DMVPN deployment?

1. Provide centralized AAA
2. Allow a tunnel interface to support multiple tunnel destinations
3. Issue digital certificates
4. Encrypt Ethernet frames

Correct Answer: 2

Explanation

Multipoint GRE, or mGRE, allows a single GRE tunnel interface to support multiple tunnel endpoints. This is one of the reasons DMVPN can scale more efficiently than architectures requiring a separate point-to-point tunnel interface for every remote peer. NHRP complements mGRE by dynamically resolving the information required to communicate with other tunnel endpoints, while IPsec provides encryption. mGRE itself does not provide centralized AAA, certificate issuance, or Ethernet frame encryption. Its primary purpose is therefore to provide the multipoint tunneling capability that forms an important part of DMVPN architecture.

Question 307

Which technology provides encryption for traffic carried through a DMVPN tunnel?

1. IPsec
2. RADIUS
3. NHRP
4. SCEP

Correct Answer: 1

Explanation

IPsec provides the cryptographic protection for traffic carried through a DMVPN deployment. DMVPN combines mGRE for multipoint tunneling and NHRP for dynamic endpoint discovery, while IPsec secures the actual traffic. IPsec can provide confidentiality, integrity, authentication, and anti-replay protection depending on the configured algorithms and security services. RADIUS provides AAA, NHRP handles dynamic address resolution, and SCEP supports certificate enrollment. Therefore, when analyzing the DMVPN architecture, IPsec should be identified as the component responsible for securing the tunneled traffic.

Question 308

Which VPN technology is specifically designed for group-based encryption rather than individual point-to-point tunnels?

1. GETVPN
2. DHCP Snooping
3. Remote-access VPN
4. MACsec

Correct Answer: 1

Explanation

GETVPN is designed for group-based encryption in which authorized routers participate in a common security group. A centralized Key Server distributes cryptographic keys and policies to Group Members. This architecture can preserve original IP addressing information and is particularly useful for enterprise networks where many sites communicate with each other over an existing routed infrastructure. Remote-access VPNs focus on individual users, while MACsec provides Layer 2 link protection. DHCP Snooping is unrelated to VPN encryption. GETVPN therefore provides a distinct group-encryption architecture compared with traditional point-to-point IPsec VPNs.

Question 309

Which GETVPN characteristic can simplify routing because the original IP packet addressing is preserved?

1. NHRP shortcut
2. Original IP header preservation
3. NAT translation
4. TCP proxying

Correct Answer: 2

Explanation

GETVPN can preserve the original IP header when traffic is protected, allowing the original source and destination addresses to remain visible to the network infrastructure. This can simplify routing because the protected traffic does not necessarily require a new tunnel-specific IP header in the same way traditional tunnel-mode point-to-point VPNs do. NHRP shortcuts are associated with DMVPN, NAT translation changes addressing, and TCP proxying serves a different security function. Original IP header preservation is therefore one of the characteristics that differentiates GETVPN from conventional tunnel-based VPN architectures.

Question 310

Which component distributes encryption keys to authorized GETVPN Group Members?

1. Key Server
2. Hub NHRP server
3. RADIUS server
4. Certificate Authority

Correct Answer: 1

Explanation

The GETVPN Key Server centrally distributes cryptographic keys and security policies to authorized Group Members. This centralized key-management model allows multiple routers to participate in the same encryption group without requiring manually configured point-to-point security relationships between every pair of sites. The NHRP server is associated with DMVPN, RADIUS provides AAA services, and a Certificate Authority issues digital certificates. The Key Server is therefore a critical GETVPN component because it controls the distribution of group encryption information and helps maintain consistent security policy among participating Group Members.

Question 311

Which Cisco VPN approach uses IKEv2 and can use virtual tunnel interfaces for route-based connectivity?

1. FlexVPN
2. DHCP Snooping
3. TrustSec
4. Port Security

Correct Answer: 1

Explanation

FlexVPN is a Cisco VPN framework based heavily on IKEv2 and supports flexible route-based VPN designs. It can use virtual tunnel interfaces to provide routed connectivity across encrypted tunnels. This approach can integrate VPN connectivity with routing protocols and provide a consistent architecture for different VPN topologies. DHCP Snooping and Port Security are Layer 2 switch-security features, while TrustSec provides identity-based segmentation. FlexVPN therefore represents an IKEv2-based VPN framework that can be used for scalable and flexible site-to-site or other routed VPN deployments.

Question 312

What is a major advantage of route-based VPNs over traditional policy-based VPNs?

1. They do not require encryption
2. Routing decisions can determine which traffic enters the VPN
3. They eliminate all firewall policies
4. They automatically issue certificates

Correct Answer: 2

Explanation

A major advantage of route-based VPNs is that routing decisions can determine which traffic is sent through the VPN interface. Instead of defining every protected flow through a traditional crypto ACL, the VPN can be represented by a logical interface such as a VTI. Routes can then direct appropriate destinations toward that interface. This can simplify configurations and make dynamic routing protocols easier to integrate into VPN designs. Route-based VPNs still require encryption and appropriate security policies, and they do not automatically issue certificates. Their main architectural benefit is integration with conventional routing.

Question 313

Which interface type is commonly associated with route-based IPsec VPN configurations?

1. VTI
2. Loopback only
3. Switched virtual interface only
4. Port-channel only

Correct Answer: 1

Explanation

A Virtual Tunnel Interface, or VTI, is commonly used to represent a route-based IPsec VPN as a logical routed interface. Traffic can be routed through the VTI according to the routing table, allowing the VPN to participate in a routing architecture more naturally than traditional policy-based designs. A loopback interface can provide other networking functions but does not itself represent an IPsec tunnel. Switched virtual interfaces and port channels serve different Layer 2 or aggregation purposes. Therefore, VTI is the interface type most closely associated with route-based IPsec VPN designs.

Question 314

Which troubleshooting condition indicates that IKE negotiation succeeded but the IPsec data plane may still be unavailable?

1. IKE SA established but Child SA is missing
2. Interface has an IP address
3. DNS resolution succeeds
4. User is authenticated to Wi-Fi

Correct Answer: 1

Explanation

An established IKE SA confirms that the peers successfully negotiated the IKE security relationship, but it does not by itself guarantee that protected application traffic can pass. If the expected IPsec Child SA is missing, the data-plane security association required to protect traffic may not be available. Administrators should investigate traffic selectors, authentication, IPsec proposals, policy configuration, and related settings. An interface having an IP address, successful DNS resolution, or Wi-Fi authentication does not prove that the VPN data plane is operational. Therefore, an established IKE SA with no expected Child SA is an important troubleshooting indicator.

Question 315

Which issue can cause an IPsec VPN to remain established while application traffic fails because the protected networks do not match?

1. Incorrect traffic selectors
2. Correct NTP time
3. Successful DNS lookup
4. Proper hostname resolution

Correct Answer: 1

Explanation

Traffic selectors define which source and destination traffic should be protected by an IPsec Child SA. If the selectors configured on the two peers do not correspond to the actual networks that need VPN protection, the tunnel may establish successfully while application traffic fails to match the security policy. This situation is especially important in policy-based IPsec configurations using crypto ACLs. NTP synchronization, DNS lookup, and hostname resolution may be useful for other functions but do not correct mismatched VPN traffic selectors. Checking the expected local and remote protected networks is therefore an important troubleshooting step.

Question 316

Which troubleshooting method helps determine whether traffic is actually being encrypted by an IPsec tunnel?

1. Check IPsec encapsulation counters
2. Check only the hostname
3. Check only the ARP cache
4. Check the local username database

Correct Answer: 1

Explanation

IPsec encapsulation counters can help determine whether matching traffic is actually being processed by the IPsec data plane. If the encapsulation counter increases when application traffic is generated, it provides evidence that traffic is entering the encryption process. Decapsulation counters can similarly help determine whether protected traffic is being received and processed on the remote side. If counters remain unchanged, administrators can investigate routing, traffic selectors, ACLs, NAT, or other policy issues. Hostnames, ARP entries, and local usernames can be relevant to other functions but do not directly confirm IPsec encryption activity.

Question 317

Which condition can prevent a traditional policy-based IPsec VPN from matching expected traffic?

1. The crypto ACL does not include the actual source and destination networks
2. The interface has a description
3. SSH is enabled
4. The device has a hostname

Correct Answer: 1

Explanation

Traditional policy-based IPsec configurations commonly use a crypto ACL to identify interesting traffic. If the ACL does not correctly represent the source and destination networks that should be protected, the traffic may not match the IPsec policy. As a result, packets can be routed normally without entering the VPN. Administrators should compare the actual traffic flow with the configured crypto ACL and verify that the selectors correspond appropriately on both VPN peers. Interface descriptions, SSH configuration, and device hostnames do not determine whether application traffic matches the IPsec crypto policy.

Question 318

Which component of a traditional Cisco IPsec configuration defines the algorithms used to protect IPsec data traffic?

1. IKEv2 Profile
2. Transform Set
3. RADIUS Server
4. NHRP Mapping

Correct Answer: 2

Explanation

A transform set traditionally defines the cryptographic algorithms and security protocols used to protect IPsec data traffic. Depending on the configuration, it can specify combinations involving ESP encryption and integrity or other supported IPsec protection parameters. The IKEv2 profile handles peer identity and authentication-related policy, while RADIUS provides AAA and NHRP mappings support DMVPN address resolution. The transform set is therefore associated with the IPsec data-plane protection parameters in traditional policy-based configurations. Understanding this distinction helps separate IKE negotiation settings from the actual protection applied to user traffic.

Question 319

Which IPsec protocol provides encryption and can also provide integrity and authentication for protected traffic?

1. AH
2. ESP
3. GRE
4. NHRP

Correct Answer: 2

Explanation

Encapsulating Security Payload, or ESP, can provide confidentiality through encryption and can also provide integrity, authentication, and anti-replay protection depending on the configured algorithms and mode. ESP is widely used in modern IPsec VPN deployments. AH provides integrity and authentication but does not provide encryption. GRE provides tunneling but does not itself provide cryptographic protection, while NHRP performs dynamic address resolution in DMVPN. ESP is therefore the IPsec protocol most commonly associated with encrypted VPN data and can provide multiple security services within a single protection framework.

Question 320

Which IPsec mode adds a new outer IP header while protecting the complete original IP packet?

1. Transport mode
2. Tunnel mode
3. Authentication mode
4. Access mode

Correct Answer: 2

Explanation

IPsec tunnel mode protects the complete original IP packet and encapsulates it inside a new IP packet with a new outer IP header. This design is commonly used for gateway-to-gateway site-to-site VPNs because the original internal addressing can remain protected inside the encrypted tunnel. Transport mode generally protects the payload of the original IP packet while retaining its original IP header, making it more commonly associated with host-to-host protection. Authentication mode and access mode are not standard IPsec operating modes. Tunnel mode is therefore the appropriate answer when the entire original IP packet is protected and a new outer IP header is added.