Question 380 A DMVPN tunnel encrypts traffic to the hub but new direct spoke traffic passes without the required encryption profile after a template update. Which lasting design or operational safeguard best prevents this particular issue from recurring? Align routing next-hop policy with the deployed DMVPN phase and topology. Standardize tunnel type for the approved DMVPN phase and shortcut behavior. Include hub interface routing policies in DMVPN baseline validation. Enforce uniform overlay encryption policy and automated tunnel-profile compliance checks. ExplanationCorrect Answer D:Enforce uniform overlay encryption policy and automated tunnel-profile compliance checks. This addresses the recurring cause: NHRP direct forwarding does not imply IPsec protection unless the relevant tunnel-protection design covers it. A targeted acceptance check is: Capture SA counters for both hub-spoke and direct spoke-spoke flows under the policy. Other Answers A:Align routing next-hop policy with the deployed DMVPN phase and topology. NHRP direct forwarding does not imply IPsec protection unless the relevant tunnel-protection design covers it. B:Standardize tunnel type for the approved DMVPN phase and shortcut behavior. NHRP direct forwarding does not imply IPsec protection unless the relevant tunnel-protection design covers it. C:Include hub interface routing policies in DMVPN baseline validation. NHRP direct forwarding does not imply IPsec protection unless the relevant tunnel-protection design covers it.
Question 381 Two spokes are registered and use distinct NBMA endpoints, but one peer's NHRP authorization policy rejects a legitimate mapping request. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Correct the NHRP authorization or authentication settings to admit the approved spokes. Align supported IKE/IPsec proposals and tunnel-protection profiles on the intended peers. Update the spoke's NHRP server mapping and routing policy to match the approved single-hub active design. Use compatible routing failure detection and verify underlay-to-overlay withdrawal rather than trusting logical tunnel state. ExplanationCorrect Answer A:Correct the NHRP authorization or authentication settings to admit the approved spokes. NHRP authentication and policy can refuse resolution even when basic hub registration exists. Confirm accepted NHRP mapping replies and successful targeted spoke-to-spoke data exchange. Other Answers B:Align supported IKE/IPsec proposals and tunnel-protection profiles on the intended peers. NHRP authentication and policy can refuse resolution even when basic hub registration exists. C:Update the spoke's NHRP server mapping and routing policy to match the approved single-hub active design. NHRP authentication and policy can refuse resolution even when basic hub registration exists. D:Use compatible routing failure detection and verify underlay-to-overlay withdrawal rather than trusting logical tunnel state. NHRP authentication and policy can refuse resolution even when basic hub registration exists.
Question 382 Two spokes are registered and use distinct NBMA endpoints, but one peer's NHRP authorization policy rejects a legitimate mapping request. Which technical mechanism best explains the behavior observed in this scenario? GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. NHRP authentication and policy can refuse resolution even when basic hub registration exists. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. ExplanationCorrect Answer B:NHRP authentication and policy can refuse resolution even when basic hub registration exists. This explains why the initial condition produces the observed failure. The direct repair is: Correct the NHRP authorization or authentication settings to admit the approved spokes. Validate through: Confirm accepted NHRP mapping replies and successful targeted spoke-to-spoke data exchange. Other Answers A:GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. NHRP authentication and policy can refuse resolution even when basic hub registration exists. C:GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. NHRP authentication and policy can refuse resolution even when basic hub registration exists. D:NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. NHRP authentication and policy can refuse resolution even when basic hub registration exists.
Question 383 Two spokes are registered and use distinct NBMA endpoints, but one peer's NHRP authorization policy rejects a legitimate mapping request. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Inspect private-prefix routes and observe packets encapsulated into the tunnel rather than sent directly to WAN. Inspect dynamic NHRP resolution and direct spoke-to-spoke encapsulation after the change. Confirm accepted NHRP mapping replies and successful targeted spoke-to-spoke data exchange. Show compatible negotiated IKE and IPsec SAs and successful encrypted traffic through the tunnel. ExplanationCorrect Answer C:Confirm accepted NHRP mapping replies and successful targeted spoke-to-spoke data exchange. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: NHRP authentication and policy can refuse resolution even when basic hub registration exists. Other Answers A:Inspect private-prefix routes and observe packets encapsulated into the tunnel rather than sent directly to WAN. NHRP authentication and policy can refuse resolution even when basic hub registration exists. B:Inspect dynamic NHRP resolution and direct spoke-to-spoke encapsulation after the change. NHRP authentication and policy can refuse resolution even when basic hub registration exists. D:Show compatible negotiated IKE and IPsec SAs and successful encrypted traffic through the tunnel. NHRP authentication and policy can refuse resolution even when basic hub registration exists.
Question 384 Two spokes are registered and use distinct NBMA endpoints, but one peer's NHRP authorization policy rejects a legitimate mapping request. Which lasting design or operational safeguard best prevents this particular issue from recurring? Align routing next-hop policy with the deployed DMVPN phase and topology. Standardize tunnel type for the approved DMVPN phase and shortcut behavior. Validate overlay registration and routing-protocol adjacency as separate acceptance gates. Keep NHRP registration and resolution authorization aligned with the branch inventory. ExplanationCorrect Answer D:Keep NHRP registration and resolution authorization aligned with the branch inventory. This addresses the recurring cause: NHRP authentication and policy can refuse resolution even when basic hub registration exists. A targeted acceptance check is: Confirm accepted NHRP mapping replies and successful targeted spoke-to-spoke data exchange. Other Answers A:Align routing next-hop policy with the deployed DMVPN phase and topology. NHRP authentication and policy can refuse resolution even when basic hub registration exists. B:Standardize tunnel type for the approved DMVPN phase and shortcut behavior. NHRP authentication and policy can refuse resolution even when basic hub registration exists. C:Validate overlay registration and routing-protocol adjacency as separate acceptance gates. NHRP authentication and policy can refuse resolution even when basic hub registration exists.
Question 385 After a routing change, a DMVPN spoke sends traffic for remote private subnets to its normal internet default instead of the tunnel. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Correct overlay route origination or route selection for the affected private prefixes. Repair the tunnel MTU and TCP MSS/path-MTU handling based on actual encapsulation overhead. Align the tunnel and NHRP identity parameters with the hub's registered network design. Correct the NHRP NHS tunnel address and its associated NBMA mapping. ExplanationCorrect Answer A:Correct overlay route origination or route selection for the affected private prefixes. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. Inspect private-prefix routes and observe packets encapsulated into the tunnel rather than sent directly to WAN. Other Answers B:Repair the tunnel MTU and TCP MSS/path-MTU handling based on actual encapsulation overhead. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. C:Align the tunnel and NHRP identity parameters with the hub's registered network design. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. D:Correct the NHRP NHS tunnel address and its associated NBMA mapping. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy.
Question 386 After a routing change, a DMVPN spoke sends traffic for remote private subnets to its normal internet default instead of the tunnel. Which technical mechanism best explains the behavior observed in this scenario? GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. ExplanationCorrect Answer B:GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. This explains why the initial condition produces the observed failure. The direct repair is: Correct overlay route origination or route selection for the affected private prefixes. Validate through: Inspect private-prefix routes and observe packets encapsulated into the tunnel rather than sent directly to WAN. Other Answers A:GRE and IPsec headers reduce available payload MTU; fragmented or dropped packets can break large sessions. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. C:GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. D:NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy.
Question 387 After a routing change, a DMVPN spoke sends traffic for remote private subnets to its normal internet default instead of the tunnel. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. Verify tunnel neighbor establishment and advertisement of the spoke's LAN prefix. Inspect private-prefix routes and observe packets encapsulated into the tunnel rather than sent directly to WAN. Inspect the negotiated peer identity, NAT detection and successful protected tunnel packets. ExplanationCorrect Answer C:Inspect private-prefix routes and observe packets encapsulated into the tunnel rather than sent directly to WAN. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. Other Answers A:Inspect the registered NBMA address and verify direct delivery to the new underlay endpoint. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. B:Verify tunnel neighbor establishment and advertisement of the spoke's LAN prefix. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. D:Inspect the negotiated peer identity, NAT detection and successful protected tunnel packets. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy.
Question 388 After a routing change, a DMVPN spoke sends traffic for remote private subnets to its normal internet default instead of the tunnel. Which lasting design or operational safeguard best prevents this particular issue from recurring? Maintain approved interoperable cryptographic policy across hub and spoke firmware versions. Keep NHRP registration and resolution authorization aligned with the branch inventory. Test hub and dynamic spoke peer coverage in cryptographic profile changes. Add underlay-versus-overlay route-selection tests when changing branch defaults. ExplanationCorrect Answer D:Add underlay-versus-overlay route-selection tests when changing branch defaults. This addresses the recurring cause: GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. A targeted acceptance check is: Inspect private-prefix routes and observe packets encapsulated into the tunnel rather than sent directly to WAN. Other Answers A:Maintain approved interoperable cryptographic policy across hub and spoke firmware versions. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. B:Keep NHRP registration and resolution authorization aligned with the branch inventory. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy. C:Test hub and dynamic spoke peer coverage in cryptographic profile changes. GRE tunnel reachability alone does not install destination routes; forwarding follows the active RIB or policy.
Question 389 A router's VTY authentication method list tries a TACACS+ group before local users; during a TACACS+ outage administrators cannot log in because the local username was never provisioned. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Create and test a suitably privileged break-glass local account with an explicitly ordered fallback method list. Configure the intended `aaa authorization exec` behavior and validate privilege assignment separately from authentication. Attach an existing login authentication method list to VTY and verify its methods and server group. Correct the rejected credentials or policy instead of treating a negative server response as server unavailability. ExplanationCorrect Answer A:Create and test a suitably privileged break-glass local account with an explicitly ordered fallback method list. AAA method-list fallback depends on configured methods and usable local credentials when the remote server is unavailable. Simulate remote AAA unavailability and confirm a controlled local login without bypassing normal authentication when servers work. Other Answers B:Configure the intended `aaa authorization exec` behavior and validate privilege assignment separately from authentication. AAA method-list fallback depends on configured methods and usable local credentials when the remote server is unavailable. C:Attach an existing login authentication method list to VTY and verify its methods and server group. AAA method-list fallback depends on configured methods and usable local credentials when the remote server is unavailable. D:Correct the rejected credentials or policy instead of treating a negative server response as server unavailability. AAA method-list fallback depends on configured methods and usable local credentials when the remote server is unavailable.
Question 390 A router's VTY authentication method list tries a TACACS+ group before local users; during a TACACS+ outage administrators cannot log in because the local username was never provisioned. Which technical mechanism best explains the behavior observed in this scenario? AAA authentication and EXEC authorization are distinct decisions; a successful login need not imply the desired session privilege. AAA method-list fallback depends on configured methods and usable local credentials when the remote server is unavailable. AAA named method lists affect only access lines or services to which they are actually applied. Authentication verifies identity, whereas TACACS+ authorization can decide whether a requested CLI command is permitted. ExplanationCorrect Answer B:AAA method-list fallback depends on configured methods and usable local credentials when the remote server is unavailable. This explains why the initial condition produces the observed failure. The direct repair is: Create and test a suitably privileged break-glass local account with an explicitly ordered fallback method list. Validate through: Simulate remote AAA unavailability and confirm a controlled local login without bypassing normal authentication when servers work. Other Answers A:AAA authentication and EXEC authorization are distinct decisions; a successful login need not imply the desired session privilege. AAA method-list fallback depends on configured methods and usable local credentials when the remote server is unavailable. C:AAA named method lists affect only access lines or services to which they are actually applied. AAA method-list fallback depends on configured methods and usable local credentials when the remote server is unavailable. D:Authentication verifies identity, whereas TACACS+ authorization can decide whether a requested CLI command is permitted. AAA method-list fallback depends on configured methods and usable local credentials when the remote server is unavailable.
