Question 340 A spoke registers with the hub, but the hub's NHRP database shows a stale public NBMA address after an ISP modem replacement. Which lasting design or operational safeguard best prevents this particular issue from recurring? Include encapsulation overhead and path-MTU tests in overlay design baselines. Maintain authoritative hub addressing and decommission obsolete NHRP entries during migrations. Validate overlay registration and routing-protocol adjacency as separate acceptance gates. Use NHRP registration monitoring and documented dynamic-address update procedures. ExplanationCorrect Answer D:Use NHRP registration monitoring and documented dynamic-address update procedures. This addresses the recurring cause: NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. A targeted acceptance check is: Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. Other Answers A:Include encapsulation overhead and path-MTU tests in overlay design baselines. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. B:Maintain authoritative hub addressing and decommission obsolete NHRP entries during migrations. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. C:Validate overlay registration and routing-protocol adjacency as separate acceptance gates. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs.
Question 341 Two spokes form direct NHRP mappings, but a routing protocol still sends spoke-to-spoke traffic through the hub because its advertised next hop is the hub. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Correct routing next-hop preservation or shortcut policy for the intended DMVPN phase. Review split-horizon behavior on the hub's multipoint tunnel and correct it for the overlay routing design. Use compatible routing failure detection and verify underlay-to-overlay withdrawal rather than trusting logical tunnel state. Configure the NHRP shortcut and redirect roles compatible with the actual DMVPN phase and software support. ExplanationCorrect Answer A:Correct routing next-hop preservation or shortcut policy for the intended DMVPN phase. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. Inspect the route's next hop plus NHRP shortcut entry and capture direct spoke-to-spoke packets. Other Answers B:Review split-horizon behavior on the hub's multipoint tunnel and correct it for the overlay routing design. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. C:Use compatible routing failure detection and verify underlay-to-overlay withdrawal rather than trusting logical tunnel state. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. D:Configure the NHRP shortcut and redirect roles compatible with the actual DMVPN phase and software support. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding.
Question 342 Two spokes form direct NHRP mappings, but a routing protocol still sends spoke-to-spoke traffic through the hub because its advertised next hop is the hub. Which technical mechanism best explains the behavior observed in this scenario? NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. ExplanationCorrect Answer B:Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. This explains why the initial condition produces the observed failure. The direct repair is: Correct routing next-hop preservation or shortcut policy for the intended DMVPN phase. Validate through: Inspect the route's next hop plus NHRP shortcut entry and capture direct spoke-to-spoke packets. Other Answers A:NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. C:GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. D:GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding.
Question 343 Two spokes form direct NHRP mappings, but a routing protocol still sends spoke-to-spoke traffic through the hub because its advertised next hop is the hub. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Capture SA counters for both hub-spoke and direct spoke-spoke flows under the policy. Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. Inspect the route's next hop plus NHRP shortcut entry and capture direct spoke-to-spoke packets. Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. ExplanationCorrect Answer C:Inspect the route's next hop plus NHRP shortcut entry and capture direct spoke-to-spoke packets. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. Other Answers A:Capture SA counters for both hub-spoke and direct spoke-spoke flows under the policy. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. B:Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. D:Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding.
Question 344 Two spokes form direct NHRP mappings, but a routing protocol still sends spoke-to-spoke traffic through the hub because its advertised next hop is the hub. Which lasting design or operational safeguard best prevents this particular issue from recurring? Validate both tunnel and underlay address roles during spoke provisioning. Prevent duplicated tunnel identity fields in automated branch provisioning. Maintain authoritative hub addressing and decommission obsolete NHRP entries during migrations. Align routing next-hop policy with the deployed DMVPN phase and topology. ExplanationCorrect Answer D:Align routing next-hop policy with the deployed DMVPN phase and topology. This addresses the recurring cause: Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. A targeted acceptance check is: Inspect the route's next hop plus NHRP shortcut entry and capture direct spoke-to-spoke packets. Other Answers A:Validate both tunnel and underlay address roles during spoke provisioning. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. B:Prevent duplicated tunnel identity fields in automated branch provisioning. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. C:Maintain authoritative hub addressing and decommission obsolete NHRP entries during migrations. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding.
Question 345 A DMVPN hub can reach all spokes, but EIGRP spokes do not learn each other's routes because the hub suppresses advertisements back out its shared tunnel. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Review split-horizon behavior on the hub's multipoint tunnel and correct it for the overlay routing design. Apply consistent tunnel protection to eligible spoke-to-spoke flows and reject unsecured paths. Refresh the spoke's registration and correct NAT or mapping behavior for its current NBMA endpoint. Validate NAT traversal and peer identity handling in the IKE/IPsec design, then correct supported settings. ExplanationCorrect Answer A:Review split-horizon behavior on the hub's multipoint tunnel and correct it for the overlay routing design. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. Verify route exchange between two spokes and expected split-horizon state on the hub tunnel. Other Answers B:Apply consistent tunnel protection to eligible spoke-to-spoke flows and reject unsecured paths. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. C:Refresh the spoke's registration and correct NAT or mapping behavior for its current NBMA endpoint. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. D:Validate NAT traversal and peer identity handling in the IKE/IPsec design, then correct supported settings. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface.
Question 346 A DMVPN hub can reach all spokes, but EIGRP spokes do not learn each other's routes because the hub suppresses advertisements back out its shared tunnel. Which technical mechanism best explains the behavior observed in this scenario? NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. NHRP direct forwarding does not imply IPsec protection unless the relevant tunnel-protection design covers it. ExplanationCorrect Answer B:Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. This explains why the initial condition produces the observed failure. The direct repair is: Review split-horizon behavior on the hub's multipoint tunnel and correct it for the overlay routing design. Validate through: Verify route exchange between two spokes and expected split-horizon state on the hub tunnel. Other Answers A:NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. C:Spoke-to-spoke shortcuts need both NBMA resolution and routing next-hop semantics compatible with direct forwarding. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. D:NHRP direct forwarding does not imply IPsec protection unless the relevant tunnel-protection design covers it. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface.
Question 347 A DMVPN hub can reach all spokes, but EIGRP spokes do not learn each other's routes because the hub suppresses advertisements back out its shared tunnel. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Confirm registration to the approved active NHS and traffic forwarding after the old hub goes away. Check the hub cache for distinct tunnel addresses and stable unique NBMA resolutions. Verify route exchange between two spokes and expected split-horizon state on the hub tunnel. Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. ExplanationCorrect Answer C:Verify route exchange between two spokes and expected split-horizon state on the hub tunnel. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. Other Answers A:Confirm registration to the approved active NHS and traffic forwarding after the old hub goes away. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. B:Check the hub cache for distinct tunnel addresses and stable unique NBMA resolutions. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. D:Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface.
Question 348 A DMVPN hub can reach all spokes, but EIGRP spokes do not learn each other's routes because the hub suppresses advertisements back out its shared tunnel. Which lasting design or operational safeguard best prevents this particular issue from recurring? Standardize tunnel type for the approved DMVPN phase and shortcut behavior. Align routing next-hop policy with the deployed DMVPN phase and topology. Use NHRP registration monitoring and documented dynamic-address update procedures. Include hub interface routing policies in DMVPN baseline validation. ExplanationCorrect Answer D:Include hub interface routing policies in DMVPN baseline validation. This addresses the recurring cause: Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. A targeted acceptance check is: Verify route exchange between two spokes and expected split-horizon state on the hub tunnel. Other Answers A:Standardize tunnel type for the approved DMVPN phase and shortcut behavior. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. B:Align routing next-hop policy with the deployed DMVPN phase and topology. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. C:Use NHRP registration monitoring and documented dynamic-address update procedures. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface.
Question 349 A branch's NAT gateway translates DMVPN packets, and its remote peer rejects the tunnel because the protected peer identity differs from what the configuration expects. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Validate NAT traversal and peer identity handling in the IKE/IPsec design, then correct supported settings. Update the spoke's NHRP server mapping and routing policy to match the approved single-hub active design. Correct the NHRP authorization or authentication settings to admit the approved spokes. Enable the intended routing process or address-family interface participation on that spoke tunnel. ExplanationCorrect Answer A:Validate NAT traversal and peer identity handling in the IKE/IPsec design, then correct supported settings. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. Inspect the negotiated peer identity, NAT detection and successful protected tunnel packets. Other Answers B:Update the spoke's NHRP server mapping and routing policy to match the approved single-hub active design. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. C:Correct the NHRP authorization or authentication settings to admit the approved spokes. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. D:Enable the intended routing process or address-family interface participation on that spoke tunnel. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities.
Question 350 A branch's NAT gateway translates DMVPN packets, and its remote peer rejects the tunnel because the protected peer identity differs from what the configuration expects. Which technical mechanism best explains the behavior observed in this scenario? NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. NHRP authentication and policy can refuse resolution even when basic hub registration exists. Direct DMVPN peers must establish suitable security associations, not just resolve each other's NBMA endpoints. ExplanationCorrect Answer B:NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. This explains why the initial condition produces the observed failure. The direct repair is: Validate NAT traversal and peer identity handling in the IKE/IPsec design, then correct supported settings. Validate through: Inspect the negotiated peer identity, NAT detection and successful protected tunnel packets. Other Answers A:NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. C:NHRP authentication and policy can refuse resolution even when basic hub registration exists. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. D:Direct DMVPN peers must establish suitable security associations, not just resolve each other's NBMA endpoints. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities.
