Question 350 A branch's NAT gateway translates DMVPN packets, and its remote peer rejects the tunnel because the protected peer identity differs from what the configuration expects. Which technical mechanism best explains the behavior observed in this scenario? NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. NHRP authentication and policy can refuse resolution even when basic hub registration exists. Direct DMVPN peers must establish suitable security associations, not just resolve each other's NBMA endpoints. ExplanationCorrect Answer B:NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. This explains why the initial condition produces the observed failure. The direct repair is: Validate NAT traversal and peer identity handling in the IKE/IPsec design, then correct supported settings. Validate through: Inspect the negotiated peer identity, NAT detection and successful protected tunnel packets. Other Answers A:NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. C:NHRP authentication and policy can refuse resolution even when basic hub registration exists. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. D:Direct DMVPN peers must establish suitable security associations, not just resolve each other's NBMA endpoints. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities.
Question 351 A branch's NAT gateway translates DMVPN packets, and its remote peer rejects the tunnel because the protected peer identity differs from what the configuration expects. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Capture SA counters for both hub-spoke and direct spoke-spoke flows under the policy. Inspect dynamic NHRP resolution and direct spoke-to-spoke encapsulation after the change. Inspect the negotiated peer identity, NAT detection and successful protected tunnel packets. Verify tunnel neighbor establishment and advertisement of the spoke's LAN prefix. ExplanationCorrect Answer C:Inspect the negotiated peer identity, NAT detection and successful protected tunnel packets. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. Other Answers A:Capture SA counters for both hub-spoke and direct spoke-spoke flows under the policy. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. B:Inspect dynamic NHRP resolution and direct spoke-to-spoke encapsulation after the change. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. D:Verify tunnel neighbor establishment and advertisement of the spoke's LAN prefix. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities.
Question 352 A branch's NAT gateway translates DMVPN packets, and its remote peer rejects the tunnel because the protected peer identity differs from what the configuration expects. Which lasting design or operational safeguard best prevents this particular issue from recurring? Prevent duplicated tunnel identity fields in automated branch provisioning. Include overlay transport-loss detection and timer tests in resilience reviews. Enforce uniform overlay encryption policy and automated tunnel-profile compliance checks. Test DMVPN from representative NAT environments rather than assuming public-address-only spokes. ExplanationCorrect Answer D:Test DMVPN from representative NAT environments rather than assuming public-address-only spokes. This addresses the recurring cause: NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. A targeted acceptance check is: Inspect the negotiated peer identity, NAT detection and successful protected tunnel packets. Other Answers A:Prevent duplicated tunnel identity fields in automated branch provisioning. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. B:Include overlay transport-loss detection and timer tests in resilience reviews. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities. C:Enforce uniform overlay encryption policy and automated tunnel-profile compliance checks. NAT can change outer peer addressing; secure association setup must accommodate the actual reachable endpoint and negotiated identities.
Question 353 A second DMVPN hub is added for resilience, but a spoke still registers only to an obsolete NHS address after the original hub is retired. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Update the spoke's NHRP server mapping and routing policy to match the approved single-hub active design. Align supported IKE/IPsec proposals and tunnel-protection profiles on the intended peers. Configure the NHRP shortcut and redirect roles compatible with the actual DMVPN phase and software support. Correct the NHRP authorization or authentication settings to admit the approved spokes. ExplanationCorrect Answer A:Update the spoke's NHRP server mapping and routing policy to match the approved single-hub active design. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. Confirm registration to the approved active NHS and traffic forwarding after the old hub goes away. Other Answers B:Align supported IKE/IPsec proposals and tunnel-protection profiles on the intended peers. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. C:Configure the NHRP shortcut and redirect roles compatible with the actual DMVPN phase and software support. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. D:Correct the NHRP authorization or authentication settings to admit the approved spokes. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically.
Question 354 A second DMVPN hub is added for resilience, but a spoke still registers only to an obsolete NHS address after the original hub is retired. Which technical mechanism best explains the behavior observed in this scenario? GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. NHRP registers a tunnel-to-NBMA mapping; duplicate tunnel addresses cause conflicting mappings and unpredictable forwarding. ExplanationCorrect Answer B:NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. This explains why the initial condition produces the observed failure. The direct repair is: Update the spoke's NHRP server mapping and routing policy to match the approved single-hub active design. Validate through: Confirm registration to the approved active NHS and traffic forwarding after the old hub goes away. Other Answers A:GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. C:Split horizon may prevent a hub from advertising one spoke's route back onto the same multipoint interface. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. D:NHRP registers a tunnel-to-NBMA mapping; duplicate tunnel addresses cause conflicting mappings and unpredictable forwarding. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically.
Question 355 A second DMVPN hub is added for resilience, but a spoke still registers only to an obsolete NHS address after the original hub is retired. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Verify route exchange between two spokes and expected split-horizon state on the hub tunnel. Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. Confirm registration to the approved active NHS and traffic forwarding after the old hub goes away. Show compatible negotiated IKE and IPsec SAs and successful encrypted traffic through the tunnel. ExplanationCorrect Answer C:Confirm registration to the approved active NHS and traffic forwarding after the old hub goes away. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. Other Answers A:Verify route exchange between two spokes and expected split-horizon state on the hub tunnel. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. B:Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. D:Show compatible negotiated IKE and IPsec SAs and successful encrypted traffic through the tunnel. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically.
Question 356 A second DMVPN hub is added for resilience, but a spoke still registers only to an obsolete NHS address after the original hub is retired. Which lasting design or operational safeguard best prevents this particular issue from recurring? Use NHRP registration monitoring and documented dynamic-address update procedures. Standardize tunnel type for the approved DMVPN phase and shortcut behavior. Keep NHRP registration and resolution authorization aligned with the branch inventory. Maintain authoritative hub addressing and decommission obsolete NHRP entries during migrations. ExplanationCorrect Answer D:Maintain authoritative hub addressing and decommission obsolete NHRP entries during migrations. This addresses the recurring cause: NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. A targeted acceptance check is: Confirm registration to the approved active NHS and traffic forwarding after the old hub goes away. Other Answers A:Use NHRP registration monitoring and documented dynamic-address update procedures. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. B:Standardize tunnel type for the approved DMVPN phase and shortcut behavior. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. C:Keep NHRP registration and resolution authorization aligned with the branch inventory. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically.
Question 357 A tunnel interface stays up while the underlying ISP path fails, leaving the hub with a stale spoke route until a much longer routing timer expires. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Use compatible routing failure detection and verify underlay-to-overlay withdrawal rather than trusting logical tunnel state. Correct routing next-hop preservation or shortcut policy for the intended DMVPN phase. Validate NAT traversal and peer identity handling in the IKE/IPsec design, then correct supported settings. Extend approved dynamic peer/profile matching to authorized spoke identities while keeping authentication restrictive. ExplanationCorrect Answer A:Use compatible routing failure detection and verify underlay-to-overlay withdrawal rather than trusting logical tunnel state. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. Fail the ISP path and observe neighbor loss, route withdrawal and recovery over the backup path. Other Answers B:Correct routing next-hop preservation or shortcut policy for the intended DMVPN phase. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. C:Validate NAT traversal and peer identity handling in the IKE/IPsec design, then correct supported settings. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. D:Extend approved dynamic peer/profile matching to authorized spoke identities while keeping authentication restrictive. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path.
Question 358 A tunnel interface stays up while the underlying ISP path fails, leaving the hub with a stale spoke route until a much longer routing timer expires. Which technical mechanism best explains the behavior observed in this scenario? Direct DMVPN peers must establish suitable security associations, not just resolve each other's NBMA endpoints. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. ExplanationCorrect Answer B:Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. This explains why the initial condition produces the observed failure. The direct repair is: Use compatible routing failure detection and verify underlay-to-overlay withdrawal rather than trusting logical tunnel state. Validate through: Fail the ISP path and observe neighbor loss, route withdrawal and recovery over the backup path. Other Answers A:Direct DMVPN peers must establish suitable security associations, not just resolve each other's NBMA endpoints. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. C:NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. D:NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path.
Question 359 A tunnel interface stays up while the underlying ISP path fails, leaving the hub with a stale spoke route until a much longer routing timer expires. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. Verify route exchange between two spokes and expected split-horizon state on the hub tunnel. Fail the ISP path and observe neighbor loss, route withdrawal and recovery over the backup path. Confirm the spoke has an NHRP registration against the correct hub tunnel address. ExplanationCorrect Answer C:Fail the ISP path and observe neighbor loss, route withdrawal and recovery over the backup path. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. Other Answers A:Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. B:Verify route exchange between two spokes and expected split-horizon state on the hub tunnel. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. D:Confirm the spoke has an NHRP registration against the correct hub tunnel address. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path.
Question 360 A tunnel interface stays up while the underlying ISP path fails, leaving the hub with a stale spoke route until a much longer routing timer expires. Which lasting design or operational safeguard best prevents this particular issue from recurring? Enforce uniform overlay encryption policy and automated tunnel-profile compliance checks. Align routing next-hop policy with the deployed DMVPN phase and topology. Standardize tunnel type for the approved DMVPN phase and shortcut behavior. Include overlay transport-loss detection and timer tests in resilience reviews. ExplanationCorrect Answer D:Include overlay transport-loss detection and timer tests in resilience reviews. This addresses the recurring cause: Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. A targeted acceptance check is: Fail the ISP path and observe neighbor loss, route withdrawal and recovery over the backup path. Other Answers A:Enforce uniform overlay encryption policy and automated tunnel-profile compliance checks. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. B:Align routing next-hop policy with the deployed DMVPN phase and topology. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. C:Standardize tunnel type for the approved DMVPN phase and shortcut behavior. Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path.
