Cisco CCNP Enterprise 350-401 ENCOR VRFs and GRE/IPsec Data Paths Practice Test

 

Topic 05 covers VRF routing contexts, GRE tunnels and IPsec data paths for Cisco ENCOR v1.2. These original scenarios separate tenant routing from the global table, underlay reachability from overlay routing, and IKE establishment from actual encrypted user traffic. Select one answer unless Choose TWO. or Choose THREE. is stated. For broader preparation, visit the Cisco 350-401 ENCOR Exam Dumps page. Every option has a scenario-specific explanation.

Question 1

Router R1 has VRFs BLUE and GREEN. GigabitEthernet0/0 serves the BLUE tenant, but show ip route vrf BLUE does not list its connected subnet. The interface configuration contains an IP address but no VRF assignment. Which change is required?

1. Configure a second default route in VRF GREEN.
2. Change the interface MAC address to match the VRF name.
3. Add the BLUE connected route only to the global routing table.
4. Assign the interface to VRF BLUE, then configure its BLUE-context IP address.
5. Enable GRE on the interface so connected routes become VRF-aware.

Correct Answer: D

 

Correct Answer

Answer D is correct because an interface participates in the routing table selected by its VRF assignment; the address must belong to that interface after VRF forwarding is applied.

Incorrect Answers

Answer A is incorrect because the problem is the interface routing-table membership, not GREEN default routing.

Answer B is incorrect because VRF membership is a routing configuration property, not a MAC naming relationship.

Answer C is incorrect because a global route does not move the interface or connected network into the BLUE routing context.

Answer E is incorrect because GRE is unrelated to assigning a routed interface to a VRF.

 

Question 2

An engineer applies ip vrf forwarding SALES to an already addressed IOS XE interface and then finds the interface no longer has its previous IPv4 address. What should the engineer do next?

1. Reconfigure the intended IPv4 address after assigning the interface to the VRF.
2. Remove the VRF because an interface in a VRF cannot have an IP address.
3. Configure the address only under router ospf instead of the interface.
4. Configure a VLAN access list to restore the Layer 3 address.
5. Add the address to the global loopback and leave the interface unnumbered automatically.

Correct Answer: A

 

Correct Answer

Answer A is correct because VRF attachment can remove the existing IP address, so the address must be reapplied in the new routing context.

Incorrect Answers

Answer B is incorrect because routed VRF interfaces require addressing; loss of the old address during reassignment does not prohibit configuring a new one.

Answer C is incorrect because OSPF configuration does not assign the interface IP address.

Answer D is incorrect because VACLs do not restore a removed routed-interface address.

Answer E is incorrect because no such automatic conversion is implied by VRF assignment.

 

Question 3

VRF BLUE must reach 10.50.0.0/16 through next hop 192.0.2.2, which is reachable only in BLUE. The global table already has a different route to 10.50.0.0/16. Which static route is appropriate?

10. Install the 10.50.0.0/16 route in VRF BLUE using the BLUE-reachable next hop.
11. Install the route in VRF GREEN because all non-global routes share one table.
12. Configure the route under the physical switchport command.
13. Rely on the global 10.50.0.0/16 route because more specific VRF context is automatic.
14. Use only an ARP entry for 192.0.2.2 and omit the route.

Correct Answer: A

 

Correct Answer

Answer A is correct because the tenant lookup occurs in the BLUE routing table, so its static route must be installed in that context.

Incorrect Answers

Answer B is incorrect because each VRF has its own routing context. It does not satisfy the stem’s governing point: Static routes for tenant traffic must be installed in the tenant VRF that performs the lookup.

Answer C is incorrect because the static route belongs to Layer 3 routing configuration rather than Layer 2 switchport state.

Answer D is incorrect because VRF isolation prevents an unrelated global route from automatically serving the tenant.

Answer E is incorrect because neighbor resolution does not replace the destination-prefix route.

 

Question 4

Two customer departments both use 10.10.10.0/24. The router must keep their routes and connected interfaces separate without renumbering either department. Which TWO configuration properties enable this design? Choose TWO.

1. Use the same interface for both VRFs simultaneously.
2. Maintain an independent routing table for each VRF.
3. Place each department-facing interface in a different VRF.
4. Change one department to IPv6 automatically.
5. Advertise both overlapping networks into the same unqualified global table.

Correct Answers: B, C

 

Correct Answers

Answer B is correct because the same prefix can coexist because each lookup occurs within its own tenant table.

Answer C is correct because separate VRF membership selects separate routing and forwarding contexts for the overlapping subnets.

Incorrect Answers

Answer A is incorrect because a routed Layer 3 interface belongs to one routing context at a time in the ordinary design described.

Answer D is incorrect because renumbering is explicitly not required and is not what provides the isolation.

Answer E is incorrect because a single global table cannot distinguish two identical destination prefixes by tenant context alone.

 

Question 5

Traffic arriving from a FINANCE-facing interface is unexpectedly using the global default route. show ip vrf interfaces does not list that interface under FINANCE. Which configuration error is most likely?

1. The interface was left in the global routing table instead of being assigned to FINANCE.
2. The interface must be an access switchport rather than routed.
3. The interface needs a VXLAN VNI before it can join a VRF.
4. The global default route should automatically be copied into every VRF.
5. The FINANCE VRF contains too many routes.

Correct Answer: A

 

Correct Answer

Answer A is correct because the observed lookup path and missing VRF interface membership both point to the interface remaining in the global context.

Incorrect Answers

Answer B is incorrect because VRF forwarding is a Layer 3 interface feature; converting to a Layer 2 access port would not solve the intended routing context.

Answer C is incorrect because VRF-Lite interface membership does not require VXLAN. It does not satisfy the stem’s governing point: Use interface membership evidence to diagnose traffic falling into the wrong routing table.

Answer D is incorrect because VRF tables are intentionally distinct unless explicit mechanisms are configured.

Answer E is incorrect because route count does not explain why the interface itself is absent from the VRF membership output.

 

Question 6

A host in VRF BLUE should reach 10.1.20.20. The router also has a global route to that address, but the engineer wants to test exactly the BLUE forwarding context. Which verification is most appropriate?

1. Issue a VRF-aware ping or enter the BLUE routing context before testing.
2. Use show vlan because VRF reachability is a Layer 2 property.
3. Ping without a VRF keyword and infer BLUE behavior from success.
4. Clear the global routing table first.
5. Disable all other VRFs before testing.

Correct Answer: A

 

Correct Answer

Answer A is correct because the probe must use the same routing table as the tenant rather than silently using global lookup.

Incorrect Answers

Answer B is incorrect because VLAN information does not verify the tenant Layer 3 route and forwarding path.

Answer C is incorrect because an ordinary ping can use the global table and therefore does not prove the tenant path.

Answer D is incorrect because destructive removal is unnecessary when VRF-aware verification commands can select the intended context.

Answer E is incorrect because tenant-specific commands provide isolation without taking unrelated services offline.

 

Question 7

show ip route vrf RED displays a connected 172.20.1.0/24 and a static 172.20.2.0/24. The global table shows 172.20.9.0/24. Which TWO statements are supported? Choose TWO.

172. The global 172.20.9.0/24 route is not automatically part of RED merely because it exists on the same router.
173. Every global route is preferred over a VRF route because the global table has no VRF name.
174. The connected RED route proves all remote RED destinations have return routes.
175. The RED table can contain only connected routes.
176. RED lookups can use the connected and static RED routes shown.

Correct Answers: A, E

 

Correct Answers

Answer A is correct because VRF separation prevents global routes from appearing in the tenant table without an explicit mechanism.

Answer E is correct because those prefixes are present in the routing table selected for the RED context.

Incorrect Answers

Answer B is incorrect because VRF selection occurs before normal route choice; tables are not ranked this way.

Answer C is incorrect because a local connected prefix does not establish reverse reachability for arbitrary remote sites.

Answer D is incorrect because static and dynamic routes can also be installed in a VRF.

 

Question 8

A RED host can send packets to a remote RED subnet through R1, and R1 sees the packets leave the correct RED egress. Replies never return. The remote router has no route back to the source RED subnet. What is the primary issue?

1. R1 must leak the RED source into the global table for all VRF traffic.
2. The VRF name must match the remote device hostname.
3. The source interface should be removed from RED so replies use global routing.
4. The remote RED routing context lacks a return route to the source network.
5. The local ARP cache must be cleared because the outbound packet already left R1.

Correct Answer: D

 

Correct Answer

Answer D is correct because forward-path success on R1 does not provide reverse reachability at the remote side.

Incorrect Answers

Answer A is incorrect because the scenario does not require global routing; the missing route is within the tenant path.

Answer B is incorrect because VRF names are locally significant labels unless a design explicitly maps them; hostname equality is not a routing requirement.

Answer C is incorrect because that would break the intended tenant isolation rather than supply the missing remote route.

Answer E is incorrect because the evidence localizes the problem beyond the successful local forwarding decision.

 

Question 9

A security test confirms that 192.168.10.0/24 in VRF A cannot reach the identical prefix in VRF B. Which conclusion is safest?

1. The test proves path isolation, but not the absence of every route-leaking mechanism.
2. The test proves all VRFs on the router are permanently isolated from all others.
3. The duplicate prefix proves the VRFs must be merged.
4. The test means the global routing table has been disabled.
5. The test proves the two departments use different physical routers.

Correct Answer: A

 

Correct Answer

Answer A is correct because one successful isolation test validates the tested flow and conditions, not every possible cross-VRF policy or prefix.

Incorrect Answers

Answer B is incorrect because other routes or explicit leaks could exist outside the tested scope.

Answer C is incorrect because overlapping space is a valid reason to keep tables separate.

Answer D is incorrect because VRF isolation does not imply removal of global routing.

Answer E is incorrect because logical routing separation can exist on the same device.

 

Question 10

VRF GOLD has a route to 203.0.113.0/24 through its own next hop. The global table has a lower administrative-distance route to the same prefix. A packet arrives on a GOLD interface. Which route is relevant to the normal lookup?

1. The GOLD route, because the ingress routing context selects the GOLD table before route comparison.
2. The global route, because lower administrative distance always wins across all VRFs.
3. Neither route can be used because identical prefixes cannot exist in two tables.
4. Both routes are automatically load-balanced.
5. The packet must first be NATed into the global table.

Correct Answer: A

 

Correct Answer

Answer A is correct because a lower administrative distance in another routing table does not compete in the tenant lookup.

Incorrect Answers

Answer B is incorrect because administrative distance is evaluated among candidate routes in the selected routing context, not across unrelated tables by default.

Answer C is incorrect because VRF design explicitly allows independent tables to contain the same destination prefixes.

Answer D is incorrect because routes in separate contexts are not automatically combined into one forwarding set.

Answer E is incorrect because NAT is not a prerequisite for VRF forwarding.

 

Question 11

R1 Tunnel10 is intended to use Loopback0 192.0.2.1 as its transport source and reach remote endpoint 198.51.100.1. Which configuration pair defines the GRE transport endpoints?

1. ip vrf forwarding GRE and switchport mode trunk.
2. tunnel key 10 only, because a key replaces source and destination addresses.
3. ip address 10.10.10.1 and tunnel destination 10.10.10.2 only.
4. tunnel source Loopback0 and tunnel destination 198.51.100.1.
5. tunnel source 10.10.10.1 and ip route 198.51.100.1 255.255.255.255 Tunnel10.

Correct Answer: D

 

Correct Answer

Answer D is correct because GRE uses the configured source interface or address and remote destination address for the outer transport header.

Incorrect Answers

Answer A is incorrect because GRE tunnel interfaces are routed interfaces and do not require Layer 2 trunking.

Answer B is incorrect because a GRE key does not supply underlay endpoint reachability or the tunnel destination.

Answer C is incorrect because the tunnel-interface addresses identify the overlay network; they do not by themselves define the underlay transport endpoints.

Answer E is incorrect because routing the transport destination into its own tunnel risks recursion and the overlay address is not established as the transport source.

 

Question 12

Tunnel0 on R1 is down. Its configured destination is 203.0.113.2, and show ip route has no route to 203.0.113.2 outside Tunnel0. Which check should come first?

1. Change the tunnel IP address to match the destination transport address.
2. Add more routes to remote overlay prefixes through Tunnel0.
3. Increase the tunnel interface bandwidth statement.
4. Restore underlay reachability to the configured tunnel destination without using the tunnel itself.
5. Enable NAT overload on the tunnel interface.

Correct Answer: D

 

Correct Answer

Answer D is correct because the GRE outer packet needs an independent route to the remote transport endpoint before the overlay can function.

Incorrect Answers

Answer A is incorrect because overlay and transport addressing are distinct roles. It does not satisfy the stem’s governing point: Verify underlay reachability before troubleshooting overlay reachability.

Answer B is incorrect because overlay routes do not solve missing reachability to the tunnel destination and can worsen recursion.

Answer C is incorrect because the bandwidth metadata does not create underlay reachability.

Answer E is incorrect because NAT does not substitute for a route to the configured GRE endpoint.

 

Question 13

R1 Tunnel0 has IP address 10.255.0.1/30. Its tunnel source is 192.0.2.1 and tunnel destination is 198.51.100.1. Which TWO statements are correct? Choose TWO.

10. 10.255.0.1 must equal 192.0.2.1 for GRE to work.
11. 192.0.2.1 and 198.51.100.1 are transport addresses used for the outer GRE path.
12. 10.255.0.1 is an overlay interface address used inside the tunnel relationship.
13. The /30 overlay prefix replaces the need for an underlay route to 198.51.100.1.
14. 198.51.100.1 is the remote tunnel-interface IP by definition.

Correct Answers: B, C

 

Correct Answers

Answer B is correct because the source and destination commands establish the routed underlay endpoints for encapsulated packets.

Answer C is correct because it identifies the logical tunnel interface rather than the outer transport source.

Incorrect Answers

Answer A is incorrect because the tunnel interface and transport source can use different addressing because they serve different layers.

Answer D is incorrect because the outer packet still must reach the transport destination through the underlay.

Answer E is incorrect because the destination command names the remote transport endpoint; the far tunnel interface can have another overlay address.

 

Question 14

R1 has a static route to GRE destination 198.51.100.9 that points to Tunnel0. Tunnel0 itself is configured with tunnel destination 198.51.100.9. What problem does this create?

1. A native VLAN mismatch.
2. An IPsec selector mismatch.
3. A recursive dependency makes the tunnel destination reachable only through the tunnel itself.
4. A valid way to force the GRE packet into itself.
5. A mandatory GRE load-balancing design.

Correct Answer: C

 

Correct Answer

Answer C is correct because the transport endpoint must be reachable independently of the tunnel being established.

Incorrect Answers

Answer A is incorrect because the issue is Layer 3 route resolution to the tunnel endpoint.

Answer B is incorrect because no IPsec policy is needed to identify the recursive GRE route.

Answer D is incorrect because self-recursion prevents a usable outer transport path rather than creating a functional tunnel.

Answer E is incorrect because the route does not create legitimate multipath; it creates a circular resolution problem.

 

Question 15

A GRE tunnel is up and can ping the remote tunnel IP. LAN A 10.1.0.0/16 must reach LAN B 10.2.0.0/16, but R1 has no route to 10.2.0.0/16. Which route is required at R1?

1. A default route from LAN B pointing at R1 physical interface.
2. A host route to R1 own tunnel IP.
3. A Layer 2 trunk entry for 10.2.0.0/16.
4. Route 10.2.0.0/16 through the GRE tunnel or a next hop reachable through it.
5. A route for the GRE destination that points back through the GRE tunnel.

Correct Answer: D

 

Correct Answer

Answer D is correct because the overlay interface being up does not automatically install routes for remote user subnets.

Incorrect Answers

Answer A is incorrect because the immediate missing information described is the R1 forward route to the remote overlay subnet.

Answer B is incorrect because the local tunnel address is already directly connected and does not represent LAN B.

Answer C is incorrect because IP prefixes are routed rather than added to a trunk allowed-VLAN list.

Answer E is incorrect because the transport destination should remain independently reachable and must not recurse through the tunnel.

 

Question 16

Tunnel0 uses GigabitEthernet0/0 as its tunnel source. The physical source interface goes administratively down, while the remote destination route still exists through another interface. Which outcome should be expected?

1. The tunnel becomes a VXLAN VTEP.
2. The tunnel automatically chooses any other interface without configuration because a destination route exists.
3. Only the tunnel bandwidth statement changes.
4. The tunnel loses its configured source while that source interface is unavailable.
5. The tunnel must remain fully operational because GRE ignores source state.

Correct Answer: D

 

Correct Answer

Answer D is correct because a tunnel sourced from an interface depends on that interface being operational as the outer source.

Incorrect Answers

Answer A is incorrect because source-interface loss does not change the encapsulation technology.

Answer B is incorrect because a configured tunnel source is explicit and is not silently replaced merely by alternate reachability.

Answer C is incorrect because the issue affects the usable transport endpoint, not metadata.

Answer E is incorrect because the outer packet requires a valid source endpoint.

 

Question 17

An underlay path supports a 1500-byte IP packet without fragmentation. GRE adds outer headers to an inner packet that is already 1500 bytes. Which TWO design considerations follow? Choose TWO.

1. MTU matters only when IPsec is present, not for plain GRE.
2. The effective size available to the inner payload may need to be reduced when the path cannot carry the added overhead.
3. GRE removes the original IP header, so the outer packet is always smaller.
4. The encapsulated packet is larger than the inner packet and may exceed the underlay MTU.
5. The GRE key value automatically increases the physical MTU.

Correct Answers: B, D

 

Correct Answers

Answer B is correct because lowering tunnel/endpoint MTU or MSS is one way a design can avoid oversize packets on a fixed transport MTU.

Answer D is correct because GRE adds header overhead, so the transport path must accommodate the larger outer packet or the design must account for fragmentation/PMTUD behavior.

Incorrect Answers

Answer A is incorrect because GRE alone adds encapsulation overhead that can create MTU issues.

Answer C is incorrect because encapsulation preserves the inner packet and adds an outer header.

Answer E is incorrect because a tunnel key is metadata and does not change link capacity.

 

Question 18

A team proposes plain GRE between two sites to satisfy a requirement that captured WAN packets reveal neither application payload nor inner addresses. Which assessment is correct?

1. A larger MTU provides confidentiality by preventing fragmentation.
2. Use GRE with IPsec or another approved encryption mechanism for confidentiality.
3. A tunnel key provides the same protection as an encryption key.
4. GRE encrypts because the original packet becomes an inner packet.
5. Using a loopback source makes GRE encrypted.

Correct Answer: B

 

Correct Answer

Answer B is correct because GRE is an encapsulation mechanism, not an encryption guarantee.

Incorrect Answers

Answer A is incorrect because packet size and encryption are unrelated security properties.

Answer C is incorrect because a GRE key is not a cryptographic confidentiality mechanism.

Answer D is incorrect because encapsulation can hide structure from simple parsing but does not provide cryptographic confidentiality.

Answer E is incorrect because source stability does not add encryption. It does not satisfy the stem’s governing point: Separate tunneling/encapsulation from cryptographic protection.

 

Question 19

A routing protocol that uses multicast hellos must form an adjacency across a point-to-point overlay between two routers. Which property of GRE can make it useful compared with an ordinary unicast-only transport path?

1. GRE guarantees encryption of routing hellos.
2. GRE makes the routing protocol use TCP automatically.
3. GRE can carry multicast traffic inside the tunnel when the design supports it.
4. GRE converts every multicast address into a globally routed public prefix.
5. GRE eliminates the need for an underlay route to the tunnel destination.

Correct Answer: C

 

Correct Answer

Answer C is correct because the encapsulation can transport protocol packets that would not otherwise traverse a unicast-only IP path as native multicast.

Incorrect Answers

Answer A is incorrect because multicast carriage and confidentiality are separate concerns. It does not satisfy the stem’s governing point: GRE can carry additional protocol types, including multicast, while relying on a routed outer path.

Answer B is incorrect because encapsulation does not change the protocol into TCP.

Answer D is incorrect because it transports the inner packet rather than readdressing every multicast destination for public routing.

Answer E is incorrect because the outer unicast transport still needs reachability. It does not satisfy the stem’s governing point: GRE can carry additional protocol types, including multicast, while relying on a routed outer path.

 

Question 20

An engineer sees line protocol up on a GRE tunnel and concludes that all remote LAN routes and applications must be healthy. Which statement is most accurate?

1. An up tunnel means the underlay can never fail.
2. An up GRE line protocol proves IPsec is established even when no IPsec is configured.
3. Tunnel state is a complete end-to-end application SLA test.
4. Tunnel state proves the remote LAN uses the correct default gateway.
5. Tunnel-up state alone does not prove routes, return path, MTU, or application reachability.

Correct Answer: E

 

Correct Answer

Answer E is correct because a logical tunnel can be operational while other forwarding or service requirements remain broken.

Incorrect Answers

Answer A is incorrect because current state is not a guarantee of future transport availability.

Answer B is incorrect because GRE and IPsec are independent mechanisms. It does not satisfy the stem’s governing point: Treat tunnel state as one layer of evidence, not an end-to-end service proof.

Answer C is incorrect because interface state does not validate all application-layer conditions.

Answer D is incorrect because a remote endpoint configuration is outside what the local interface state establishes.

 

Question 21

Two IPsec peers use pre-shared-key authentication. Peer A is configured with key CORAL and Peer B with key COBALT for the same peer identity. IKE does not establish. Which issue should be corrected first?

1. Enable HSRP preemption on both peers.
2. Change the protected subnet mask only on Peer A.
3. Make the peer authentication secrets consistent according to the intended IKE configuration.
4. Add a GRE route through the failed IPsec SA.
5. Increase the inside NAT pool.

Correct Answer: C

 

Correct Answer

Answer C is correct because mismatched pre-shared authentication data prevents the peers from authenticating the negotiation.

Incorrect Answers

Answer A is incorrect because first-hop redundancy does not authenticate IPsec peers. It does not satisfy the stem’s governing point: Localize IKE failure to explicit peer-authentication mismatches before changing data-plane policy.

Answer B is incorrect because traffic selectors matter later, but the explicit authentication mismatch already explains failure to establish IKE.

Answer D is incorrect because routing changes do not correct a peer-authentication mismatch.

Answer E is incorrect because NAT pool size is unrelated to the stated IKE authentication evidence.

 

Question 22

Peer A protects traffic 10.1.0.0/16 to 10.2.0.0/16. Peer B is configured to protect only 10.2.0.0/16 to 10.1.5.0/24. Hosts in 10.1.20.0/24 cannot pass encrypted traffic. Which cause best fits?

1. The peers have incompatible traffic selectors for the affected flow.
2. The remote subnet must be placed in the global routing table even if the tunnel uses a VRF.
3. The GRE tunnel number must equal the IPsec SPI.
4. IPsec can encrypt only /24 networks.
5. The IKE peers must use identical inside interface IP addresses.

Correct Answer: A

 

Correct Answer

Answer A is correct because the flow matches A broad selector but falls outside B narrower reverse definition, so the protected traffic domains do not agree.

Incorrect Answers

Answer B is incorrect because routing context depends on the design and does not explain the explicit selector asymmetry.

Answer C is incorrect because tunnel interface numbering and Security Parameter Index values are unrelated.

Answer D is incorrect because IPsec selectors can describe many prefix lengths; the mismatch is the problem, not /16 itself.

Answer E is incorrect because peer interfaces do not need the same local address; the issue is the stated protected prefix scope.

 

Question 23

Two peers must negotiate an IPsec security association. Peer A permits AES-256/SHA-256 with DH group 14. Peer B permits AES-256/SHA-256 with DH group 19 only. No common proposal exists. Which TWO conclusions are correct? Choose TWO.

1. The peers need at least one mutually compatible set of negotiated parameters.
2. Once proposals differ, IPsec automatically chooses the numerically larger DH group.
3. The peers should use different encryption algorithms to improve compatibility.
4. Aligning or adding a compatible DH group can create common proposal space if policy permits.
5. The lack of a common proposal can be fixed by changing only a LAN default gateway.

Correct Answers: A, D

 

Correct Answers

Answer A is correct because successful negotiation requires overlap in the proposal attributes used by both endpoints.

Answer D is correct because the stated mismatch is the DH choice while the other listed parameters already agree.

Incorrect Answers

Answer B is incorrect because negotiation selects from compatible configured choices; it does not invent an unsupported common group.

Answer C is incorrect because deliberately removing algorithm overlap would not solve negotiation.

Answer E is incorrect because gateway routing does not change cryptographic proposal compatibility.

 

Question 24

An IOS XE tunnel interface is protected with an IPsec profile. The engineer also configures a crypto-map traffic ACL that selects a different set of subnets and assumes the tunnel profile will obey that crypto-map selector. Which correction is most appropriate?

1. Use the GRE key as the crypto-map sequence number.
2. Verify the deployed IPsec model rather than treating VTI and crypto-map selection as equivalent.
3. Attach the crypto map to the tunnel interface twice so both models merge.
4. Convert the IPsec profile into an STP instance.
5. Remove all routing to the tunnel because the crypto ACL replaces the routing table.

Correct Answer: B

 

Correct Answer

Answer B is correct because a route-based protected tunnel uses the tunnel interface and associated profile rather than an unrelated crypto-map ACL to define every packet admitted to the interface.

Incorrect Answers

Answer A is incorrect because the values serve unrelated purposes and numerical equality is not a requirement.

Answer C is incorrect because duplicating unrelated policy constructs does not create a valid combined selection model.

Answer D is incorrect because spanning tree has no role in IPsec traffic selection.

Answer E is incorrect because route-based forwarding still depends on routing toward the tunnel interface.

 

Question 25

An IPsec VTI between R1 and R2 is established. R1 has no route for remote subnet 172.31.0.0/16 through the tunnel. Which change is still required for LAN traffic to use the protected path?

1. Change the tunnel source to the remote LAN prefix.
2. Install or learn a route to 172.31.0.0/16 through the protected tunnel.
3. Disable IP routing so the tunnel becomes the default path.
4. Configure the remote LAN as a local interface address on R1.
5. Increase the IKE lifetime because routing tables are derived from SA lifetime.

Correct Answer: B

 

Correct Answer

Answer B is correct because an established security association does not by itself direct arbitrary remote user prefixes into a route-based tunnel.

Incorrect Answers

Answer A is incorrect because the tunnel source must be a valid local transport endpoint, not a remote user subnet.

Answer C is incorrect because turning off routing would prevent the intended Layer 3 forwarding.

Answer D is incorrect because that would falsely claim local ownership rather than provide a route to the remote network.

Answer E is incorrect because IKE lifetime and IP routing are separate mechanisms.

 

Question 26

show crypto ikev2 sa shows an established IKE relationship, but show crypto ipsec sa shows zero encapsulations and decapsulations while a test host sends traffic. Which conclusion is safest?

1. Zero counters prove the remote LAN is down.
2. The IKE SA should be removed because data counters can never be zero on a valid peer.
3. The router must be dropping packets due to an STP loop.
4. The user traffic is definitely encrypted because IKE is established.
5. IKE succeeded, but the test flow is not yet proven to use an IPsec child SA.

Correct Answer: E

 

Correct Answer

Answer E is correct because an IKE SA establishes peer security negotiation; zero IPsec data counters indicate the user flow has not been observed through the protected data path.

Incorrect Answers

Answer A is incorrect because the counters localize lack of IPsec data usage but do not by themselves identify remote endpoint availability.

Answer B is incorrect because an established peer can exist before matching traffic is sent or when traffic selection/routing is wrong.

Answer C is incorrect because no Layer 2 loop evidence is provided. It does not satisfy the stem’s governing point: Differentiate peer/IKE establishment from actual encrypted user-data use.

Answer D is incorrect because control-plane establishment does not prove the specific user packets matched an IPsec SA.

 

Question 27

During a one-minute test, R1 IPsec SA encapsulation counter rises by 500 while decapsulation remains unchanged. R2 shows corresponding decapsulation increments but no packets are returned by the application. Which TWO observations are supported? Choose TWO.

1. R2 decapsulation proves its application server sent a valid response.
2. The peers have a selector mismatch for the forward flow because the counters rise.
3. The missing return traffic must be investigated beyond the successful forward IPsec direction.
4. R1 decapsulation must rise whenever it encapsulates packets, even if the application sends no reply.
5. The forward test traffic is being encrypted by R1 and received/decapsulated by R2.

Correct Answers: C, E

 

Correct Answers

Answer C is correct because the forward counters do not prove application response generation, reverse routing, or reverse IPsec selection.

Answer E is correct because matching counter movement at the peers is evidence that the protected forward path is carrying the test packets.

Incorrect Answers

Answer A is incorrect because decapsulation proves packet receipt at the IPsec endpoint, not that the ultimate application produced return traffic.

Answer B is incorrect because rising protected counters are evidence that the forward flow is matching and using the SA.

Answer D is incorrect because encapsulation and decapsulation represent opposite traffic directions and need not increase together.

 

Question 28

A test flow is 10.1.20.10 to 10.2.30.20. The IPsec policy on R1 selects 10.1.10.0/24 to 10.2.30.0/24. The peers otherwise have healthy IKE sessions. Why does the test flow remain unencrypted?

1. The destination must use the same subnet number as the source.
2. The router needs an HSRP virtual address before it can classify interesting traffic.
3. The local source 10.1.20.10 falls outside the configured protected source selector.
4. The flow is unencrypted because both addresses are RFC1918.
5. A healthy IKE session encrypts every packet regardless of traffic selectors.

Correct Answer: C

 

Correct Answer

Answer C is correct because the flow does not match the explicit local protected subnet even though its destination fits the remote selector.

Incorrect Answers

Answer A is incorrect because protected networks do not need matching subnet numbers.

Answer B is incorrect because FHRP is unrelated to matching the IPsec selector.

Answer D is incorrect because private addressing does not prevent IPsec. It does not satisfy the stem’s governing point: Compare the actual packet tuple with the configured protected traffic selectors.

Answer E is incorrect because IKE establishment does not remove the data-plane selector or route conditions.

 

Question 29

R1 encrypts packets for a remote subnet and its encapsulation counter increases. The remote peer decapsulates them successfully, but return traffic leaves the remote site through a different Internet router that has no IPsec relationship with R1. Which issue best explains failed sessions?

1. R1 should disable encryption so the remote route becomes symmetric automatically.
2. R1 needs a larger GRE MTU because all return-path problems are fragmentation.
3. The remote peer must change its hostname to match R1.
4. The R1 encapsulation counter proves the reverse path is also correct.
5. The return path bypasses the IPsec peer, creating an asymmetric protected path.

Correct Answer: E

 

Correct Answer

Answer E is correct because successful forward encryption does not help when replies take an unrelated egress and therefore cannot use the matching security association back to R1.

Incorrect Answers

Answer A is incorrect because removing protection does not correct remote routing policy and violates the intended secure path.

Answer B is incorrect because no MTU evidence is provided; the explicit reverse egress explains the asymmetry.

Answer C is incorrect because hostnames are not the reason replies are routed through another Internet router.

Answer D is incorrect because a directional outbound counter cannot validate remote return routing.

 

Question 30

IKEv2 on two peers remains in an early negotiation state and no IPsec child SA exists. Packet captures show requests reaching the remote peer, which responds with a notification that no acceptable proposal was found. Which THREE troubleshooting steps are relevant? Choose THREE.

1. Check both sides logs or debug output for the specific proposal attributes being rejected.
2. Increase the inside DHCP lease time because it changes IKE proposal selection.
3. Troubleshoot remote LAN application ports first because the child SA cannot form until the application answers.
4. Force every user prefix into the global routing table before comparing IKE policies.
5. Compare the peers configured IKE proposal parameters for a mutually supported set.
6. Verify that the intended IKE policies/proposals are actually applied to the peer relationship.

Correct Answers: A, E, F

 

Correct Answers

Answer A is correct because peer evidence helps identify whether encryption, integrity, PRF or DH choices fail to overlap.

Answer E is correct because the notification directly indicates that negotiation could not find common cryptographic parameters.

Answer F is correct because correct values in unused policy objects would not create a common negotiation.

Incorrect Answers

Answer B is incorrect because DHCP timing does not supply cryptographic compatibility. It does not satisfy the stem’s governing point: Use IKE state and notifications to localize negotiation failures before investigating unrelated user data paths.

Answer C is incorrect because IKE proposal negotiation occurs before protected application traffic is required.

Answer D is incorrect because routing may matter for peer reachability, but the capture already proves exchange and the explicit no-proposal notification localizes the next check.