.png&w=3840&q=75)
Question bank
Cisco Enterprise Advanced Routing and Services (ENARSI)
40 Cisco Enterprise Advanced Routing and Services (ENARSI) questions with the correct answer and a written explanation, organised across 4 exam domains.
- 40 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Infrastructure Security
8 questions in this domain
- Question 1Single Choice
Which protocol in a DMVPN network provides the dynamic address resolution that maps public addresses to private tunnel addresses?
- ANext Hop Resolution Protocol (NHRP)Correct answer
- BGeneric Routing Encapsulation (GRE)
- CIP Security (IPsec)
- DDynamic Host Configuration Protocol (DHCP)
Why this is the answer
NHRP acts as an ARP-like resolution protocol for DMVPN, mapping public NBMA addresses to private tunnel addresses so spokes can reach destinations dynamically.
- Question 2Multiple Select
Which three technology components does Cisco DMVPN integrate to create a dynamic, secure VPN solution?
- AGeneric Routing Encapsulation (GRE)Correct answer
- BIPsecCorrect answer
- CNext Hop Resolution Protocol (NHRP)Correct answer
- DMultiprotocol Label Switching (MPLS)
Why this is the answer
DMVPN is created by combining GRE, IPsec, and NHRP. MPLS is not one of the three component technologies in the Cisco DMVPN definition.
- Question 3Interactive
Refer to the code block. What does the displayed configuration enable on the router interface?
- AIt allows a single GRE interface to accept multiple dynamically initiated GRE tunnels from different source IP addresses.Correct answer
- BIt only supports static point-to-point GRE tunnel configurations.
- CIt disables IPsec encryption on the GRE tunnel interface.
- DIt sets up an IPsec site-to-site tunnel without a GRE wrapper.
Why this is the answer
The code configures an mGRE interface with tunnel mode gre multipoint, which allows one router interface to receive multiple GRE tunnels from dynamic spoke addresses.
- Question 4Single Choice
NHRP serves as the DMVPN equivalent of which LAN resolution protocol on NBMA networks?
- AAddress Resolution Protocol (ARP)Correct answer
- BDynamic Host Configuration Protocol (DHCP)
- CDomain Name System (DNS)
- DBorder Gateway Protocol (BGP)
Why this is the answer
NHRP is described as an ARP equivalent for NBMA networks because it resolves public NBMA addresses to private tunnel addresses.
- Question 5Multiple Select
According to the ENARSI exam blueprint, which operational phases of DMVPN should be understood?
- APhase 1Correct answer
- BPhase 2Correct answer
- CPhase 3Correct answer
- DPhase 4
Why this is the answer
The ENARSI blueprint identifies DMVPN Phase 1, Phase 2, and Phase 3 operational models. Phase 4 is not listed as part of this standard DMVPN model.
- Question 6Interactive
Refer to the code block. Which two statements are true about the NHRP interface configuration shown?
- AThe interface is configured to communicate with a next-hop server.Correct answer
- BNHRP is activated by using the network identifier 7.Correct answer
- CThe mGRE interface will not accept incoming GRE tunnels once NHRP is enabled.
- DThe NHS address must be the same as the tunnel source address.
Why this is the answer
The configuration enables NHRP with network id 7 and defines 10.1.1.2 as the NHS, allowing the spoke to register and resolve tunnel addresses dynamically.
- Question 7Single Choice
When a spoke comes online in a DMVPN, what initial NHRP action does it perform?
- AIt registers its public NBMA address with the hub or next-hop server.Correct answer
- BIt broadcasts its entire routing table to every other spoke.
- CIt requests a new public IP address from the hub.
- DIt forces all other spokes to re-authenticate.
Why this is the answer
NHRP registration allows a spoke to dynamically report its public NBMA address to the hub or NHS, enabling reachability across the DMVPN.
- Question 8Multiple Select
Which two statements accurately describe DMVPN's tunnel establishment and security?
- ADMVPN can establish hub-and-spoke and direct spoke-to-spoke paths on demand.Correct answer
- BDMVPN supports IPsec authentication using either pre-shared keys or PKI certificates.Correct answer
- CA separate GRE tunnel interface is required for every possible spoke in the network.
- DNHRP is used only for encrypting user data between spokes.
Why this is the answer
DMVPN creates scalable secure tunnels between hub and spokes and between spokes on demand. DMVPN uses IPsec with PSK or PKI-based authentication.
Infrastructure Services
10 questions in this domain
- Question 9Single Choice
Which group of technologies does Dynamic Multipoint VPN (DMVPN) combine in the Cisco ENARSI foundation model?
- AGRE, IPsec, and NHRPCorrect answer
- BGRE, L2TP, and PPP
- CIPsec, IKEv2, and EIGRP
- DNHRP, MPLS, and BGP
Why this is the answer
DMVPN combines GRE, IPsec, and NHRP as stated in the ENARSI blueprint. This creates secure, scalable VPNs without static point-to-point tunnel provisioning.
- Question 10Multiple Select
Which two statements accurately describe the characteristics of DMVPN as presented in the foundation document?
- AIt is designed to support hub-and-spoke and spoke-to-spoke VPNs.Correct answer
- BIt is a Cisco-proprietary solution.Correct answer
- CIt requires permanent static tunnels between all sites.
- DIt is defined by an open IETF standard.
Why this is the answer
The document identifies DMVPN as a Cisco-proprietary solution supporting both hub-and-spoke and spoke-to-spoke VPN architectures.
- Question 11Interactive
Review the output in the code block. It lists peer mappings from NBMA addresses to tunnel addresses. Which protocol is responsible for this mapping table?
- ANHRPCorrect answer
- BGRE
- CIPsec
- DOSPF
Why this is the answer
NHRP acts as an ARP equivalent for NBMA networks by mapping outer public addresses to inner private tunnel addresses.
- Question 12Single Choice
What is the main role of NHRP inside a DMVPN NBMA network?
- AIt maps public NBMA addresses to private tunnel addresses.Correct answer
- BIt encrypts packets between DMVPN spokes.
- CIt replaces the GRE header in tunnel packets.
- DIt assigns inside tunnel IP addresses to spoke routers.
Why this is the answer
NHRP dynamically maps outer public NBMA addresses to inner private tunnel destination addresses in a DMVPN environment.
- Question 13Multiple Select
According to the ENARSI blueprint, which two mechanisms can be used to authenticate DMVPN tunnels?
- APre-Shared Keys (PSKs)Correct answer
- BPublic Key Infrastructure (PKI) certificatesCorrect answer
- COne-time passwords generated by RADIUS
- DTACACS+ per-command authorization
Why this is the answer
DMVPN supports robust authentication using Pre-Shared Keys or PKI certificates, as described in the ENARSI foundation material.
- Question 14Interactive
Inspect the interface configuration in the code block. Which tunnel mode does this configuration define?
- AMultipoint GRE (mGRE)Correct answer
- BPoint-to-point GRE
- CCisco HDLC over GRE
- DPPPoE over GRE
Why this is the answer
The tunnel mode gre multipoint command enables multipoint GRE, allowing a single interface to accept multiple GRE tunnels from dynamic spoke addresses.
- Question 15Single Choice
How many operational phases of DMVPN does the ENARSI blueprint describe?
- AOne
- BTwo
- CThreeCorrect answer
- DFour
Why this is the answer
The ENARSI foundation material defines DMVPN using Phase 1, Phase 2, and Phase 3 operational models, so there are three phases.
- Question 16Multiple Select
Which two operational benefits of DMVPN are highlighted in the foundation document?
- AIt removes the administrative work of creating static point-to-point tunnels.Correct answer
- BIt permanently forms direct spoke-to-spoke paths regardless of traffic.
- CIt dynamically secures direct spoke-to-spoke data paths on demand.Correct answer
- DIt requires a separate routing protocol for every spoke.
Why this is the answer
DMVPN avoids static point-to-point tunnel overhead and dynamically establishes secure direct data paths between spokes when required.
- Question 17Interactive
The code block contains part of the router security configuration for a DMVPN deployment. Which authentication method is being defined?
- APre-shared key (PSK)Correct answer
- BPKI certificate
- CLocal AAA login password
- DKerberos ticket
Why this is the answer
The keyring configuration uses the pre-shared-key directive, indicating that Pre-Shared Key authentication is configured.
- Question 18Single Choice
NHRP is considered the equivalent of which common protocol when operating over NBMA networks?
- AARPCorrect answer
- BDNS
- CDHCP
- DICMP
Why this is the answer
NHRP is described as an Address Resolution Protocol equivalent for non-broadcast multi-access networks.
Layer 3 Technologies
14 questions in this domain
- Question 19Single Choice
In an NBMA network, which protocol acts as the equivalent of ARP for address resolution in DMVPN?
- ANHRPCorrect answer
- BIPsec
- CDHCP
- DDNS
Why this is the answer
NHRP maps outer public IP addresses to inner private tunnel addresses, serving as the NBMA address-resolution equivalent to ARP.
- Question 20Multiple Select
Which technologies are combined in a DMVPN solution? (Choose all that apply.)
- AGRECorrect answer
- BIPsecCorrect answer
- CNHRPCorrect answer
- DOSPF
Why this is the answer
DMVPN combines GRE, IPsec, and NHRP. GRE and IPsec provide transport and encryption, while NHRP enables dynamic peer discovery.
- Question 21Interactive
Refer to the code block. What characteristic does this tunnel configuration provide in a DMVPN deployment?
- AThe interface can receive multiple GRE tunnels from dynamic spoke addressesCorrect answer
- BThe interface can only form one permanent tunnel with the hub
- CThe interface automatically encrypts all GRE traffic
- DThe interface disables NHRP routing updates
Why this is the answer
The tunnel mode shown creates an mGRE interface, allowing a single interface to accept multiple GRE tunnels from dynamic spoke IP addresses.
- Question 22Single Choice
Which description best matches Cisco's definition of DMVPN in the ENARSI 300-410 blueprint?
- AA Cisco-proprietary software solution that combines GRE, IPsec, and NHRP to create scalable secure VPNsCorrect answer
- BAn open-standard routing protocol used to connect remote sites over the internet
- CA hardware module that encrypts traffic across cloud networks
- DA clientless SSL VPN service for remote workers
Why this is the answer
DMVPN is defined as a Cisco-proprietary solution that uses GRE, IPsec, and NHRP for scalable hub-and-spoke and spoke-to-spoke site connectivity.
- Question 23Multiple Select
Which network topologies does DMVPN explicitly support according to the ENARSI material? (Choose two.)
- AHub-and-spoke VPNsCorrect answer
- BSpoke-to-spoke direct tunnelsCorrect answer
- CRemote-access SSL dial-in VPNs
- DStatic point-to-point T1 links
Why this is the answer
The source states that DMVPN builds scalable, secure hub-and-spoke and spoke-to-spoke VPNs.
- Question 24Interactive
Refer to the code block. Which DMVPN component is being configured by the displayed IPsec profile?
- AIPsecCorrect answer
- BmGRE
- CNHRP
- D802.1Q trunking
Why this is the answer
IPsec profiles provide encryption and authentication services to protect data-plane traffic inside DMVPN tunnels.
- Question 25Single Choice
According to the ENARSI DMVPN overview, which network requirement becomes unnecessary because DMVPN builds tunnels dynamically?
- AThe need to configure many static point-to-point tunnel linksCorrect answer
- BThe need to use a routing protocol
- CThe need to assign IPv4 addresses to tunnel interfaces
- DThe need to secure the WAN transport
Why this is the answer
DMVPN avoids configuring individual static point-to-point tunnels between every pair of DMVPN routers.
- Question 26Multiple Select
Which DMVPN deployment phases are discussed in the ENARSI 300-410 source? (Choose all that apply.)
- APhase 1Correct answer
- BPhase 2Correct answer
- CPhase 3Correct answer
- DPhase 4
Why this is the answer
The source mentions Phase 1, Phase 2, and Phase 3 DMVPN operational models.
- Question 27Interactive
Refer to the code block. Which configured value is responsible for enabling NHRP operation on the tunnel?
- AThe NHRP network identifier on the tunnel interfaceCorrect answer
- BThe IP address defined on the tunnel
- CThe physical interface used as the tunnel source
- DThe multipoint GRE tunnel mode
Why this is the answer
The NHRP network identifier enables NHRP on the tunnel interface and is required for a router to participate in DMVPN.
- Question 28Single Choice
What is the primary function of Multipoint GRE in a DMVPN architecture?
- AA single interface accepts multiple GRE tunnels from spokes with different public IP addressesCorrect answer
- BA single interface is limited to one tunnel destination
- CIt replaces NHRP for address resolution
- DIt encrypts traffic without using ISAKMP
Why this is the answer
mGRE allows a single router interface to accept multiple GRE tunnels from dynamic spoke addresses, eliminating the need for multiple fixed GRE tunnels.
- Question 29Multiple Select
Which two authentication methods does Cisco list for DMVPN in the ENARSI curriculum? (Choose two.)
- APre-Shared KeysCorrect answer
- BPKI certificatesCorrect answer
- CTACACS+
- DRADIUS accounting
Why this is the answer
The ENARSI source identifies Pre-Shared Keys and Public Key Infrastructure certificates as DMVPN authentication mechanisms.
- Question 30Interactive
Refer to the code block. Which authentication method is configured for this DMVPN deployment?
- APre-Shared Key authenticationCorrect answer
- BPKI certificate authentication
- CKerberos ticket authentication
- DSigned RADIUS response authentication
Why this is the answer
A pre-shared key uses a shared secret configured on the peers and is one of the two supported DMVPN authentication methods in the source.
- Question 31Single Choice
What is the role of NHRP in a DMVPN network?
- AIt dynamically maps outer public IP addresses to inner private tunnel addressesCorrect answer
- BIt encrypts the GRE payload
- CIt assigns tunnel IP addresses
- DIt eliminates the need for IP routing
Why this is the answer
NHRP dynamically resolves the public NBMA address associated with a private tunnel address, enabling dynamic peer discovery.
- Question 32Multiple Select
Which of the following are characteristics of DMVPN as described in the ENARSI source? (Choose all that apply.)
- ADMVPN is Cisco-proprietaryCorrect answer
- BDMVPN is intended for scalable large-scale enterprise WAN architecturesCorrect answer
- CSpokes can dynamically establish secure direct data paths on demandCorrect answer
- DAll tunnel destinations must be manually mapped before traffic is sent
Why this is the answer
DMVPN is Cisco-proprietary, designed for scalable enterprise WANs, and dynamically creates secure spoke-to-spoke paths without static mappings.
VPN Technologies
8 questions in this domain
- Question 33Single Choice
In the context of Cisco enterprise VPNs, what does the acronym DMVPN stand for?
- ADynamic Multipoint VPNCorrect answer
- BDistributed Multipath Virtual Network
- CDirect Media VPN
- DDestination-Mapped Virtual Protocol
Why this is the answer
DMVPN is a Cisco-proprietary software solution abbreviated as Dynamic Multipoint VPN. It combines GRE, IPsec, and NHRP to build scalable secure VPNs.
- Question 34Multiple Select
Which three technologies are integrated by Cisco DMVPN? Select all that apply.
- AGeneric Routing Encapsulation (GRE)Correct answer
- BIPsecCorrect answer
- CNext Hop Resolution Protocol (NHRP)Correct answer
- DResource Reservation Protocol (RSVP)
Why this is the answer
DMVPN combines GRE, IPsec, and NHRP. GRE provides tunnel encapsulation, IPsec provides security, and NHRP provides dynamic address resolution.
- Question 35Interactive
Refer to the provided interface configuration. What capability will this DMVPN interface have?
- AA single tunnel interface can accept multiple GRE tunnels from dynamically addressed spokes.Correct answer
- BThe tunnel interface will accept only one static spoke address.
- CThe tunnel interface creates an IPsec tunnel without using GRE.
- DThe tunnel interface performs stateful NAT for remote DMVPN sites.
Why this is the answer
The configuration uses multipoint GRE, which allows one tunnel interface to receive multiple GRE tunnels from dynamic spoke addresses without a separate tunnel for each remote site.
- Question 36Single Choice
Which statement best describes the function of NHRP within a DMVPN network?
- AIt acts as an ARP equivalent on NBMA networks by dynamically mapping outer public IP addresses to inner private tunnel destinations.Correct answer
- BIt encrypts the GRE payload before transmission across the WAN.
- CIt computes the best routing path across the provider MPLS cloud.
- DIt assigns private IP addresses to spoke LAN hosts.
Why this is the answer
NHRP behaves like an ARP protocol for NBMA networks. It allows spokes to dynamically map their public outer addresses to private inner tunnel destination addresses.
- Question 37Multiple Select
Which statements about DMVPN architecture are true? Select all that apply.
- ADMVPN can create hub-and-spoke and direct spoke-to-spoke VPN paths.Correct answer
- BDMVPN is a Cisco-proprietary software solution combining GRE, IPsec, and NHRP.Correct answer
- CDMVPN requires an MPLS service provider backbone.
- DDMVPN relies on statically configured tunnels between every pair of spokes.
Why this is the answer
DMVPN is a Cisco-proprietary solution using GRE, IPsec, and NHRP. It supports secure hub-and-spoke and direct spoke-to-spoke tunnels without static point-to-point configurations.
- Question 38Interactive
Refer to the NHRP table entry shown. Which conclusions about the dynamic registration are correct?
- ANHRP has mapped the private tunnel address to the displayed NBMA public address.Correct answer
- BThe mapping was learned dynamically rather than configured statically.Correct answer
- CThe NBMA address is the outer public destination used to reach the spoke.Correct answer
- DThe entry represents a multicast route for GRE broadcasts.
Why this is the answer
The output shows a dynamic NHRP entry. NHRP maps the outer NBMA public address to the inner private tunnel address, allowing dynamic DMVPN tunnel establishment.
- Question 39Single Choice
Which characteristic of Multipoint GRE (mGRE) makes DMVPN scalable?
- AA single tunnel interface can accept multiple incoming GRE tunnels from dynamic spoke addresses.Correct answer
- BEach remote spoke requires a dedicated mGRE tunnel interface.
- CmGRE uses the same tunnel destination address for every remote site connection.
- DmGRE works only over MPLS Layer 3 VPN backbones.
Why this is the answer
Multipoint GRE enables one interface to accept multiple GRE tunnels from dynamic spoke addresses. This is the foundation for DMVPN scalability.
- Question 40Multiple Select
Which DMVPN operational phases are identified in the ENARSI blueprint? Select all that apply.
- APhase 1Correct answer
- BPhase 2Correct answer
- CPhase 3Correct answer
- DPhase 4
Why this is the answer
The ENARSI DMVPN content references Phase 1, Phase 2, and Phase 3 operational models. Phase 4 is not part of the standard list.
Frequently asked questions
Everything about the Cisco Enterprise Advanced Routing and Services (ENARSI) question bank and how to use it.