Question 310 A shared services VRF deliberately exchanges a small set of prefixes with two customer VRFs, but a broad import target unexpectedly exposes all routes. Which technical mechanism best explains the behavior observed in this scenario? VPNv4 NLRI and its route-target information require the appropriate multiprotocol BGP address family. Route-target membership can import entire sets of VPN routes unless the design constrains shared-service reachability. A VPNv4 route can be learned but unusable if its BGP next hop cannot be resolved to a transport LSP. Route distinguishers distinguish VPNv4 prefixes, while route targets control import/export membership. ExplanationCorrect Answer B:Route-target membership can import entire sets of VPN routes unless the design constrains shared-service reachability. This explains why the initial condition produces the observed failure. The direct repair is: Replace broad route-target imports with the designed selective route sharing mechanism and filters. Validate through: Test allowed shared-service prefixes and a denied private subnet in both VRFs. Other Answers A:VPNv4 NLRI and its route-target information require the appropriate multiprotocol BGP address family. Route-target membership can import entire sets of VPN routes unless the design constrains shared-service reachability. C:A VPNv4 route can be learned but unusable if its BGP next hop cannot be resolved to a transport LSP. Route-target membership can import entire sets of VPN routes unless the design constrains shared-service reachability. D:Route distinguishers distinguish VPNv4 prefixes, while route targets control import/export membership. Route-target membership can import entire sets of VPN routes unless the design constrains shared-service reachability.
Question 311 A shared services VRF deliberately exchanges a small set of prefixes with two customer VRFs, but a broad import target unexpectedly exposes all routes. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Inspect the customer VRF route tables and prove only authorized route targets are imported. Show unique VPNv4 prefixes and verify the intended VRF import based on route target. Test allowed shared-service prefixes and a denied private subnet in both VRFs. Validate separate encryption controls, such as an approved IPsec overlay, rather than treating label traces as security proof. ExplanationCorrect Answer C:Test allowed shared-service prefixes and a denied private subnet in both VRFs. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: Route-target membership can import entire sets of VPN routes unless the design constrains shared-service reachability. Other Answers A:Inspect the customer VRF route tables and prove only authorized route targets are imported. Route-target membership can import entire sets of VPN routes unless the design constrains shared-service reachability. B:Show unique VPNv4 prefixes and verify the intended VRF import based on route target. Route-target membership can import entire sets of VPN routes unless the design constrains shared-service reachability. D:Validate separate encryption controls, such as an approved IPsec overlay, rather than treating label traces as security proof. Route-target membership can import entire sets of VPN routes unless the design constrains shared-service reachability.
Question 312 A shared services VRF deliberately exchanges a small set of prefixes with two customer VRFs, but a broad import target unexpectedly exposes all routes. Which lasting design or operational safeguard best prevents this particular issue from recurring? Verify PE loopback reachability and transport labels as part of new VPN service turn-up. Validate matching route-target design at both ends of every L3 VPN service. Run layered CE-to-CE checks covering VRF routes, VPN labels and MPLS core connectivity. Apply least-privilege route-leak policies and negative test cases across tenant contexts. ExplanationCorrect Answer D:Apply least-privilege route-leak policies and negative test cases across tenant contexts. This addresses the recurring cause: Route-target membership can import entire sets of VPN routes unless the design constrains shared-service reachability. A targeted acceptance check is: Test allowed shared-service prefixes and a denied private subnet in both VRFs. Other Answers A:Verify PE loopback reachability and transport labels as part of new VPN service turn-up. Route-target membership can import entire sets of VPN routes unless the design constrains shared-service reachability. B:Validate matching route-target design at both ends of every L3 VPN service. Route-target membership can import entire sets of VPN routes unless the design constrains shared-service reachability. C:Run layered CE-to-CE checks covering VRF routes, VPN labels and MPLS core connectivity. Route-target membership can import entire sets of VPN routes unless the design constrains shared-service reachability.
Question 313 A customer thinks MPLS L3 VPN traffic is encrypted across the provider network by default and wants to send regulated payloads unprotected. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Explain the separation benefit of L3 VPN and specify independent encryption where confidentiality is required. Check VRF import/export route-target policy and remove the unintended cross-tenant import. Configure appropriate route-target policies; keep route distinguishers for VPN route uniqueness. Correct the intended export/import route-target association on the relevant PEs. ExplanationCorrect Answer A:Explain the separation benefit of L3 VPN and specify independent encryption where confidentiality is required. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload. Validate separate encryption controls, such as an approved IPsec overlay, rather than treating label traces as security proof. Other Answers B:Check VRF import/export route-target policy and remove the unintended cross-tenant import. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload. C:Configure appropriate route-target policies; keep route distinguishers for VPN route uniqueness. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload. D:Correct the intended export/import route-target association on the relevant PEs. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload.
Question 314 A customer thinks MPLS L3 VPN traffic is encrypted across the provider network by default and wants to send regulated payloads unprotected. Which technical mechanism best explains the behavior observed in this scenario? A VPN route can exist in the MP-BGP control plane without entering a VRF that does not import its route target. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload. VRF route-target import policy controls which VPNv4 routes enter each customer VRF, independent of prefix overlap. MPLS L3 VPN delivery relies on both customer route distribution and a functioning PE-to-PE labeled transport path. ExplanationCorrect Answer B:MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload. This explains why the initial condition produces the observed failure. The direct repair is: Explain the separation benefit of L3 VPN and specify independent encryption where confidentiality is required. Validate through: Validate separate encryption controls, such as an approved IPsec overlay, rather than treating label traces as security proof. Other Answers A:A VPN route can exist in the MP-BGP control plane without entering a VRF that does not import its route target. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload. C:VRF route-target import policy controls which VPNv4 routes enter each customer VRF, independent of prefix overlap. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload. D:MPLS L3 VPN delivery relies on both customer route distribution and a functioning PE-to-PE labeled transport path. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload.
Question 315 A customer thinks MPLS L3 VPN traffic is encrypted across the provider network by default and wants to send regulated payloads unprotected. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Inspect the customer VRF route tables and prove only authorized route targets are imported. Inspect the VPNv4 route's extended communities and the destination VRF's import list. Validate separate encryption controls, such as an approved IPsec overlay, rather than treating label traces as security proof. Inspect the received VPNv4 next hop and available label-switched path toward that PE. ExplanationCorrect Answer C:Validate separate encryption controls, such as an approved IPsec overlay, rather than treating label traces as security proof. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload. Other Answers A:Inspect the customer VRF route tables and prove only authorized route targets are imported. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload. B:Inspect the VPNv4 route's extended communities and the destination VRF's import list. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload. D:Inspect the received VPNv4 next hop and available label-switched path toward that PE. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload.
Question 316 A customer thinks MPLS L3 VPN traffic is encrypted across the provider network by default and wants to send regulated payloads unprotected. Which lasting design or operational safeguard best prevents this particular issue from recurring? Document route distinguisher and route-target roles separately in service templates. Include VPN address-family and community carriage in PE-to-PE peering checklists. Run layered CE-to-CE checks covering VRF routes, VPN labels and MPLS core connectivity. Require explicit encryption classification for every MPLS VPN service carrying sensitive information. ExplanationCorrect Answer D:Require explicit encryption classification for every MPLS VPN service carrying sensitive information. This addresses the recurring cause: MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload. A targeted acceptance check is: Validate separate encryption controls, such as an approved IPsec overlay, rather than treating label traces as security proof. Other Answers A:Document route distinguisher and route-target roles separately in service templates. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload. B:Include VPN address-family and community carriage in PE-to-PE peering checklists. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload. C:Run layered CE-to-CE checks covering VRF routes, VPN labels and MPLS core connectivity. MPLS VPN labels support traffic separation and forwarding context, not cryptographic confidentiality of the payload.
Question 317 A new spoke has internet connectivity but cannot register with the DMVPN hub because its NHRP network ID differs from the hub tunnel configuration. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Align the tunnel and NHRP identity parameters with the hub's registered network design. Correct routing next-hop preservation or shortcut policy for the intended DMVPN phase. Refresh the spoke's registration and correct NAT or mapping behavior for its current NBMA endpoint. Review split-horizon behavior on the hub's multipoint tunnel and correct it for the overlay routing design. ExplanationCorrect Answer A:Align the tunnel and NHRP identity parameters with the hub's registered network design. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. Other Answers B:Correct routing next-hop preservation or shortcut policy for the intended DMVPN phase. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. C:Refresh the spoke's registration and correct NAT or mapping behavior for its current NBMA endpoint. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. D:Review split-horizon behavior on the hub's multipoint tunnel and correct it for the overlay routing design. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server.
Question 318 A new spoke has internet connectivity but cannot register with the DMVPN hub because its NHRP network ID differs from the hub tunnel configuration. Which technical mechanism best explains the behavior observed in this scenario? GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. NHRP authentication and policy can refuse resolution even when basic hub registration exists. NHRP registers a tunnel-to-NBMA mapping; duplicate tunnel addresses cause conflicting mappings and unpredictable forwarding. ExplanationCorrect Answer B:NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. This explains why the initial condition produces the observed failure. The direct repair is: Align the tunnel and NHRP identity parameters with the hub's registered network design. Validate through: Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. Other Answers A:GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. C:NHRP authentication and policy can refuse resolution even when basic hub registration exists. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. D:NHRP registers a tunnel-to-NBMA mapping; duplicate tunnel addresses cause conflicting mappings and unpredictable forwarding. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server.
Question 319 A new spoke has internet connectivity but cannot register with the DMVPN hub because its NHRP network ID differs from the hub tunnel configuration. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Show compatible negotiated IKE and IPsec SAs and successful encrypted traffic through the tunnel. Verify tunnel neighbor establishment and advertisement of the spoke's LAN prefix. Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. Observe the expected spoke-to-spoke IKE/IPsec SA with the correct negotiated authentication identity. ExplanationCorrect Answer C:Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. Other Answers A:Show compatible negotiated IKE and IPsec SAs and successful encrypted traffic through the tunnel. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. B:Verify tunnel neighbor establishment and advertisement of the spoke's LAN prefix. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. D:Observe the expected spoke-to-spoke IKE/IPsec SA with the correct negotiated authentication identity. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server.
Question 320 A new spoke has internet connectivity but cannot register with the DMVPN hub because its NHRP network ID differs from the hub tunnel configuration. Which lasting design or operational safeguard best prevents this particular issue from recurring? Include overlay transport-loss detection and timer tests in resilience reviews. Include hub interface routing policies in DMVPN baseline validation. Choose one documented DMVPN phase and validate its NHRP features on all nodes. Keep hub and spoke NHRP parameters in synchronized deployment templates. ExplanationCorrect Answer D:Keep hub and spoke NHRP parameters in synchronized deployment templates. This addresses the recurring cause: NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. A targeted acceptance check is: Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. Other Answers A:Include overlay transport-loss detection and timer tests in resilience reviews. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. B:Include hub interface routing policies in DMVPN baseline validation. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. C:Choose one documented DMVPN phase and validate its NHRP features on all nodes. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server.
