SkillTestPro | CCNP 300-410 ENARSI Practice Test 22

CCNP ENARSI 300-410 Practice Test 22 (Hard) - VPN Services

CCNP Enterprise logo

1 / 10

A GRE tunnel between two routers is configured correctly, but the tunnel interface remains in an 'up/down' state rather than 'up/up'. What is a likely cause?

The tunnel's IP address is configured with an incorrect subnet mask, which would generally cause a different, addressing-related symptom rather than up/down status

The tunnel interface has a description configured that is too long

The tunnel source and destination addresses are simply swapped on one router, which would generally prevent the tunnel from ever coming up rather than showing 'up/down'

The tunnel interface's bandwidth statement doesn't match the physical interface's actual bandwidth

The GRE tunnel keepalive feature has been explicitly disabled entirely on both ends, which by itself does not commonly cause an up/down protocol status

The tunnel destination address is not reachable via the routing table, often because the route to the destination points back through the tunnel itself (recursive routing issue)

2 / 10

Which term describes the specific issue where a GRE tunnel's destination becomes reachable only via the tunnel itself, creating an unstable, flapping tunnel state?

A simple duplicate IP address alone

NHRP misregistration alone (a DMVPN-specific issue)

IKE Phase 1 failure alone (an IPsec-specific issue)

IPsec Phase 2 failure alone

Recursive routing

MTU mismatch alone (a distinct, unrelated tunnel issue)

3 / 10

A DMVPN spoke fails to register with the hub, and 'show ip nhrp' shows no successful registration entry. What should be checked first?

Only the spoke's SNMP configuration, which is unrelated to basic NHRP registration success

Only the spoke's EIGRP or OSPF configuration, without first confirming basic NHRP registration itself succeeded

Basic underlying IP connectivity between the spoke and hub's physical (NBMA) addresses, and matching NHRP network ID/authentication configuration

Only the spoke's NTP configuration, which is unrelated to basic NHRP registration success

Only the spoke's syslog configuration, which is unrelated to basic NHRP registration success

Only the spoke's QoS configuration, which is unrelated to basic NHRP registration success

4 / 10

An IPsec VPN tunnel using a pre-shared key fails during Phase 1 (IKE) negotiation. What is a likely cause worth checking first?

A mismatched transform set (encryption/hashing algorithm for Phase 2) alone, which would typically be negotiated after Phase 1 already succeeds

A mismatched 'interesting traffic' ACL alone, which is also relevant primarily to Phase 2

A mismatched EIGRP autonomous system number alone

A mismatched pre-shared key configured on the two peers

A mismatched OSPF area number alone

A mismatched NHRP network ID alone (a DMVPN-specific concept, not directly an IPsec Phase 1 parameter)

5 / 10

Which troubleshooting command would show real-time debug output specifically for IKE/ISAKMP negotiation, useful for pinpointing exactly where a Phase 1 failure is occurring?

debug ip ospf alone

debug ip nhrp alone (an NHRP/DMVPN-specific debug, not IKE-specific)

debug crypto ipsec alone (focuses on Phase 2 details, not the initial Phase 1 negotiation)

debug ip bgp alone

debug ip eigrp alone

debug crypto isakmp

6 / 10

A GET VPN deployment shows Group Members successfully registering with the Key Server, but traffic between Group Members remains unencrypted. What should be checked?

Only the Key Server's own hostname configuration, which is unrelated to whether traffic on Group Member interfaces is actually being encrypted

Whether the correct GDOI group and IPsec policy have been properly applied to the Group Members' relevant interfaces

Only the Key Server's SNMP configuration, which is unrelated to whether traffic on Group Member interfaces is actually being encrypted

Only the Key Server's syslog configuration, which is unrelated to whether traffic on Group Member interfaces is actually being encrypted

Only the Key Server's NTP configuration, which is unrelated to whether traffic on Group Member interfaces is actually being encrypted

Only the Key Server's CDP configuration, which is unrelated to whether traffic on Group Member interfaces is actually being encrypted

7 / 10

Which term describes verifying that a VPN tunnel's actual throughput and latency meet expected performance levels, beyond simply confirming the tunnel is 'up'?

Basic tunnel status verification alone (confirms the tunnel is merely 'up', not that it meets performance expectations)

A one-time configuration backup alone

A basic show command review alone

A basic traceroute alone

A basic ping test alone (a useful but limited check, not a comprehensive performance validation)

VPN performance validation

8 / 10

Which command would display a summary of active crypto sessions on a router, including the associated interface, peer, and current status, useful for a quick overview across multiple VPN tunnels?

show crypto ipsec sa alone (shows individual Phase 2 SAs, without the consolidated per-session summary view)

show dmvpn alone (DMVPN-specific, not a general crypto session summary)

show crypto isakmp sa alone (shows individual Phase 1 SAs, without the consolidated per-session summary view)

show ip route alone

show ip nhrp alone

show crypto session

9 / 10

An MPLS Layer 3 VPN customer reports that routes from one site are not appearing at another site within the same VPN. What is a likely configuration issue to check?

Only the PE router's NTP configuration

Only the PE router's SNMP configuration

Only the CE router's CDP configuration

Only the CE router's hostname configuration

Only the physical interface status on the PE routers, without first checking VRF-specific route target alignment

Whether the route target import/export values configured on the relevant VRFs actually match and are correctly aligned for that specific customer VPN

10 / 10

Which command on a PE router would display the VPNv4 BGP table, showing routes for all customer VRFs along with their associated route distinguishers?

show running-config alone

show ip bgp alone (shows only the default/global BGP table, not the VPNv4 address family)

show ip protocols alone

show ip bgp vpnv4 all

show mpls forwarding-table alone

show ip route vrf [name] alone (shows routes for one specific VRF's routing table, not the broader VPNv4 BGP table across all VRFs)

Your score is

The average score is 0%