Question 330 A spoke's tunnel line protocol is up and NHRP resolves the peer, but IPsec security association negotiation fails due to incompatible transform proposals. Which technical mechanism best explains the behavior observed in this scenario? Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. ExplanationCorrect Answer B:GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. This explains why the initial condition produces the observed failure. The direct repair is: Align supported IKE/IPsec proposals and tunnel-protection profiles on the intended peers. Validate through: Show compatible negotiated IKE and IPsec SAs and successful encrypted traffic through the tunnel. Other Answers A:Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. C:NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. D:NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step.
Question 331 A spoke's tunnel line protocol is up and NHRP resolves the peer, but IPsec security association negotiation fails due to incompatible transform proposals. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Confirm registration to the approved active NHS and traffic forwarding after the old hub goes away. Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. Show compatible negotiated IKE and IPsec SAs and successful encrypted traffic through the tunnel. Fail the ISP path and observe neighbor loss, route withdrawal and recovery over the backup path. ExplanationCorrect Answer C:Show compatible negotiated IKE and IPsec SAs and successful encrypted traffic through the tunnel. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. Other Answers A:Confirm registration to the approved active NHS and traffic forwarding after the old hub goes away. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. B:Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. D:Fail the ISP path and observe neighbor loss, route withdrawal and recovery over the backup path. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step.
Question 332 A spoke's tunnel line protocol is up and NHRP resolves the peer, but IPsec security association negotiation fails due to incompatible transform proposals. Which lasting design or operational safeguard best prevents this particular issue from recurring? Include overlay transport-loss detection and timer tests in resilience reviews. Align routing next-hop policy with the deployed DMVPN phase and topology. Use NHRP registration monitoring and documented dynamic-address update procedures. Maintain approved interoperable cryptographic policy across hub and spoke firmware versions. ExplanationCorrect Answer D:Maintain approved interoperable cryptographic policy across hub and spoke firmware versions. This addresses the recurring cause: GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. A targeted acceptance check is: Show compatible negotiated IKE and IPsec SAs and successful encrypted traffic through the tunnel. Other Answers A:Include overlay transport-loss detection and timer tests in resilience reviews. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. B:Align routing next-hop policy with the deployed DMVPN phase and topology. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. C:Use NHRP registration monitoring and documented dynamic-address update procedures. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step.
Question 333 A DMVPN tunnel handles small pings but large TCP payloads stall after encryption because added GRE/IPsec overhead exceeds underlay MTU. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Repair the tunnel MTU and TCP MSS/path-MTU handling based on actual encapsulation overhead. Enable the intended routing process or address-family interface participation on that spoke tunnel. Review split-horizon behavior on the hub's multipoint tunnel and correct it for the overlay routing design. Correct overlay route origination or route selection for the affected private prefixes. ExplanationCorrect Answer A:Repair the tunnel MTU and TCP MSS/path-MTU handling based on actual encapsulation overhead. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. Test DF-sized packets and representative TCP application transfers after the MTU/MSS correction. Other Answers B:Enable the intended routing process or address-family interface participation on that spoke tunnel. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. C:Review split-horizon behavior on the hub's multipoint tunnel and correct it for the overlay routing design. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. D:Correct overlay route origination or route selection for the affected private prefixes. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions.
Question 334 A DMVPN tunnel handles small pings but large TCP payloads stall after encryption because added GRE/IPsec overhead exceeds underlay MTU. Which technical mechanism best explains the behavior observed in this scenario? NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. NHRP direct forwarding does not imply IPsec protection unless the relevant tunnel-protection design covers it. ExplanationCorrect Answer B:GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. This explains why the initial condition produces the observed failure. The direct repair is: Repair the tunnel MTU and TCP MSS/path-MTU handling based on actual encapsulation overhead. Validate through: Test DF-sized packets and representative TCP application transfers after the MTU/MSS correction. Other Answers A:NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. C:Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. D:NHRP direct forwarding does not imply IPsec protection unless the relevant tunnel-protection design covers it. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions.
Question 335 A DMVPN tunnel handles small pings but large TCP payloads stall after encryption because added GRE/IPsec overhead exceeds underlay MTU. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Confirm the spoke has an NHRP registration against the correct hub tunnel address. Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. Test DF-sized packets and representative TCP application transfers after the MTU/MSS correction. Confirm accepted NHRP mapping replies and successful targeted spoke-to-spoke data exchange. ExplanationCorrect Answer C:Test DF-sized packets and representative TCP application transfers after the MTU/MSS correction. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. Other Answers A:Confirm the spoke has an NHRP registration against the correct hub tunnel address. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. B:Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. D:Confirm accepted NHRP mapping replies and successful targeted spoke-to-spoke data exchange. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions.
Question 336 A DMVPN tunnel handles small pings but large TCP payloads stall after encryption because added GRE/IPsec overhead exceeds underlay MTU. Which lasting design or operational safeguard best prevents this particular issue from recurring? Align routing next-hop policy with the deployed DMVPN phase and topology. Keep NHRP registration and resolution authorization aligned with the branch inventory. Test hub and dynamic spoke peer coverage in cryptographic profile changes. Include encapsulation overhead and path-MTU tests in overlay design baselines. ExplanationCorrect Answer D:Include encapsulation overhead and path-MTU tests in overlay design baselines. This addresses the recurring cause: GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. A targeted acceptance check is: Test DF-sized packets and representative TCP application transfers after the MTU/MSS correction. Other Answers A:Align routing next-hop policy with the deployed DMVPN phase and topology. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. B:Keep NHRP registration and resolution authorization aligned with the branch inventory. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. C:Test hub and dynamic spoke peer coverage in cryptographic profile changes. GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions.
Question 337 A spoke registers with the hub, but the hub's NHRP database shows a stale public NBMA address after an ISP modem replacement. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Refresh the spoke's registration and correct NAT or mapping behavior for its current NBMA endpoint. Validate NAT traversal and peer identity handling in the IKE/IPsec design, then correct supported settings. Update the spoke's NHRP server mapping and routing policy to match the approved single-hub active design. Configure the NHRP shortcut and redirect roles compatible with the actual DMVPN phase and software support. ExplanationCorrect Answer A:Refresh the spoke's registration and correct NAT or mapping behavior for its current NBMA endpoint. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. Other Answers B:Validate NAT traversal and peer identity handling in the IKE/IPsec design, then correct supported settings. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. C:Update the spoke's NHRP server mapping and routing policy to match the approved single-hub active design. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. D:Configure the NHRP shortcut and redirect roles compatible with the actual DMVPN phase and software support. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs.
Question 338 A spoke registers with the hub, but the hub's NHRP database shows a stale public NBMA address after an ISP modem replacement. Which technical mechanism best explains the behavior observed in this scenario? GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. NHRP authentication and policy can refuse resolution even when basic hub registration exists. ExplanationCorrect Answer B:NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. This explains why the initial condition produces the observed failure. The direct repair is: Refresh the spoke's registration and correct NAT or mapping behavior for its current NBMA endpoint. Validate through: Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. Other Answers A:GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. C:GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. D:NHRP authentication and policy can refuse resolution even when basic hub registration exists. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs.
Question 339 A spoke registers with the hub, but the hub's NHRP database shows a stale public NBMA address after an ISP modem replacement. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Inspect the route's next hop plus NHRP shortcut entry and capture direct spoke-to-spoke packets. Inspect private-prefix routes and observe packets encapsulated into the tunnel rather than sent directly to WAN. Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. Observe the expected spoke-to-spoke IKE/IPsec SA with the correct negotiated authentication identity. ExplanationCorrect Answer C:Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. Other Answers A:Inspect the route's next hop plus NHRP shortcut entry and capture direct spoke-to-spoke packets. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. B:Inspect private-prefix routes and observe packets encapsulated into the tunnel rather than sent directly to WAN. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. D:Observe the expected spoke-to-spoke IKE/IPsec SA with the correct negotiated authentication identity. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs.
Question 340 A spoke registers with the hub, but the hub's NHRP database shows a stale public NBMA address after an ISP modem replacement. Which lasting design or operational safeguard best prevents this particular issue from recurring? Include encapsulation overhead and path-MTU tests in overlay design baselines. Maintain authoritative hub addressing and decommission obsolete NHRP entries during migrations. Validate overlay registration and routing-protocol adjacency as separate acceptance gates. Use NHRP registration monitoring and documented dynamic-address update procedures. ExplanationCorrect Answer D:Use NHRP registration monitoring and documented dynamic-address update procedures. This addresses the recurring cause: NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. A targeted acceptance check is: Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. Other Answers A:Include encapsulation overhead and path-MTU tests in overlay design baselines. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. B:Maintain authoritative hub addressing and decommission obsolete NHRP entries during migrations. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. C:Validate overlay registration and routing-protocol adjacency as separate acceptance gates. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs.
