SkillTestPro | CCNP Security 300-745 SDSI Practice Test 7

CCNP Security 300-745 SDSI Practice Test 7 (Hard) - Selecting a VPN and Tunneling Solution - SD-WAN, IPsec, MPLS, GRE, DMVPN, and Public Cloud Tunnel Options

CISCO CCNP Security Exam Logo

1 / 10

Which tunneling technology natively provides encryption and integrity protection for traffic traversing an untrusted network, without requiring an additional overlay protocol for confidentiality?

NTP synchronization, which is a time protocol rather than a tunneling or encryption technology

Plain, unencrypted VLAN trunking across a shared untrusted network

GRE by itself, which encapsulates traffic but provides no native encryption or integrity protection

SNMP polling, which is a device management protocol rather than a tunneling technology

IPsec

MPLS by itself, which is a label-switching technology that does not natively encrypt payload traffic

2 / 10

Which characteristic distinguishes MPLS from a typical internet-based VPN/tunneling solution when selecting a WAN transport for a business with strict latency and reliability requirements?

MPLS is exclusively available for residential internet connections and cannot be used for business WAN transport

MPLS is typically a provider-managed, private label-switched network offering predictable performance and SLAs, whereas internet-based tunnels traverse shared, less predictable public paths

MPLS and internet-based VPN tunnels are simply two different names for the exact same identical transport technology, which is inconsistent with expected behavior, regardless of the platform version in use

MPLS eliminates the need for any WAN transport redundancy planning once deployed

MPLS always provides native end-to-end encryption equivalent to IPsec with no additional configuration required

MPLS requires no contractual relationship with any service provider whatsoever

3 / 10

Which design scenario would most directly justify selecting an SD-WAN solution over a traditional single-transport WAN architecture?

A branch office located in a region where no WAN connectivity of any kind is available

A branch office where traffic prioritization and path selection are entirely irrelevant to business operations, under normal operating conditions, which is inconsistent with expected behavior, regardless of the platform version in use

A branch office needs to intelligently use multiple transport links (such as MPLS and broadband internet) simultaneously, dynamically steering application traffic based on real-time path performance and policy

A branch office that has exactly one available transport link with no possibility of using a second link

A branch office that requires no application-aware routing or path performance monitoring of any kind

A branch office that has no security or policy requirements for any of its traffic whatsoever

4 / 10

Which tunneling technology combination is most associated with providing dynamic, scalable hub-and-spoke or spoke-to-spoke connectivity without requiring the hub to be manually reconfigured each time a new spoke is added?

DMVPN (Dynamic Multipoint VPN), typically combining mGRE and IPsec with a dynamic routing protocol and NHRP for on-demand tunnel establishment

A single physical leased line connecting exactly two fixed sites with no support for additional spokes

A statically configured point-to-point GRE tunnel that must be manually reconfigured for every new site added

A single flat, unencrypted Layer 2 broadcast domain spanning every remote site

SNMP-based polling used to monitor tunnel status with no role in establishing connectivity

A manually maintained spreadsheet listing IP addresses for each remote site with no automated tunnel negotiation, in a properly maintained environment

5 / 10

Which design consideration is most important when selecting a tunneling option for connecting a branch office directly to a public cloud provider's virtual network (such as via a cloud provider's native VPN gateway)?

Requiring the branch office to abandon all existing on-premises tunneling technology before any cloud connection can be established

Assuming cloud provider VPN gateways have no bandwidth or throughput limitations of any kind

Compatibility between the branch's on-premises tunneling technology (such as IPsec parameters and routing protocol support) and the specific capabilities and limits of the cloud provider's native VPN gateway offering

Selecting the tunnel technology based solely on which option has the most visually appealing management console

Assuming public cloud tunnel options never require any encryption configuration at all

Assuming every cloud provider's native VPN gateway supports an identical, universal configuration with no compatibility verification needed, which is not the standard approach, which is inconsistent with expected behavior

6 / 10

Which factor would most influence whether a design team selects IPsec, GRE-over-IPsec, or DMVPN for a given multi-site connectivity requirement?

The number of parking spaces available at each branch office

The color scheme configured for the WAN management platform's dashboard, based on standard platform behavior, which is not the standard approach, based on standard platform behavior, though this is not generally recommended, which does not align with best practices

The font used in the organization's internal newsletter

The specific brand of coffee served in the network operations center

Whether the requirement is simple point-to-point connectivity (favoring plain IPsec), needs to carry non-IP or multicast traffic and routing protocols (favoring GRE-over-IPsec), or requires dynamic, scalable multi-site connectivity (favoring DMVPN)

The average outdoor temperature at each branch office location

7 / 10

Which risk would most likely result from a design that selects GRE tunneling alone, without pairing it with IPsec, to carry sensitive traffic across an untrusted public network?

GRE alone would automatically reduce the organization's WAN transport costs compared to any encrypted option

GRE alone would automatically provide encryption equivalent to a dedicated IPsec tunnel

The organization's DNS infrastructure would automatically fail as a direct result of using GRE without IPsec

Using GRE alone would automatically cause the untrusted public network to become a trusted private network

The traffic would be encapsulated but not encrypted, leaving its contents readable to anyone able to intercept it along the untrusted path

Using GRE alone would have no security implications whatsoever compared to pairing it with IPsec

8 / 10

Which combination of tunneling and transport design choices would provide a scalable, resilient, and appropriately secured WAN architecture for an enterprise with many branch offices and public cloud connectivity needs?

A single unencrypted GRE tunnel connecting every branch office and public cloud environment, in accordance with common design practices, which is not the standard approach, under normal operating conditions, which is inconsistent with expected behavior

Public cloud connections established with no verification of the cloud provider's VPN gateway compatibility requirements

SD-WAN deployed with no accompanying encryption for any transport path used

A design that assumes MPLS alone, without any encrypted overlay, is sufficient for all sensitive traffic

SD-WAN for intelligent multi-transport path selection at branches, DMVPN or IPsec-based tunnels for encrypted dynamic site connectivity, and provider-specific validated VPN gateway configurations for public cloud connections

DMVPN configured without IPsec, relying on encapsulation alone for confidentiality

9 / 10

Which troubleshooting step would be appropriate if a newly established DMVPN spoke-to-spoke tunnel fails to form even though both spokes can independently reach the DMVPN hub?

Assume the issue is unrelated to NHRP and only check the branch office's physical air conditioning system, which is not the standard approach, which is not the standard approach, under typical configuration conditions, in accordance with common design practices

Verify NHRP registration and resolution between the spokes, and confirm that any intermediate firewall or NAT device is not blocking the NHRP resolution request/reply or the resulting direct spoke-to-spoke IPsec negotiation

Assume the issue is caused by the phase of the moon

Immediately replace both spoke routers' hardware as the first troubleshooting step

Assume DMVPN spoke-to-spoke tunneling is a deprecated capability no longer supported by any platform

Assume the issue is caused by the network administrator's choice of desktop wallpaper

10 / 10

Which statement accurately describes why an organization might select SD-WAN with underlying IPsec tunnels rather than relying solely on a traditional MPLS-only WAN design?

SD-WAN and MPLS-only design are simply two different names for the exact same identical WAN architecture with no distinction

SD-WAN with IPsec allows the organization to combine cost-effective broadband internet transport with encrypted, policy-driven traffic steering, reducing dependence on expensive MPLS circuits while maintaining security and application performance

SD-WAN with IPsec is only relevant for guest Wi-Fi traffic and has no bearing on branch office WAN architecture

Selecting SD-WAN with IPsec eliminates the need for any WAN transport whatsoever going forward

MPLS-only design automatically provides application-aware traffic steering equivalent to SD-WAN with no additional configuration, which is inconsistent with expected behavior, which is not the standard approach, in a properly maintained environment

MPLS-only design always provides strictly better security than any SD-WAN with IPsec design under every circumstance

Your score is

The average score is 0%