1.6 Describe Site-To-Site and Remote Access VPN Deployment Types Such as Virtual Tunnel Interfaces, Standards-Based IPsec, SSL VPN, DMVPN, FlexVPN, and GETVPN 350-701 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is replacing a legacy site-to-site VPN that uses crypto maps. The new VPN must support dynamic routing protocols and allow the tunnel to be monitored like a physical interface. Which configuration approach should be used?

   • ADeploy GETVPN with a group key server
   • BConfigure a VTI and include it in the routing protocol
   • CUse a crypto map with an ACL for all traffic
   • DUse clientless SSL VPN for site-to-site
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is migrating from a legacy site-to-site VPN using crypto maps to a DMVPN deployment. The network team wants to maintain dynamic routing and simplify the configuration on the hub. Which configuration approach should be used on the hub?

   • AUse clientless SSL VPN for site-to-site
   • BConfigure an mGRE tunnel interface with NHRP and a routing protocol
   • CDeploy GETVPN with a group key server
   • DUse a VTI with static crypto maps
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is GETVPN particularly suitable for preserving IPsec headers in multicast and dynamic environments?

   • AIt requires a full mesh of tunnels to support multicast.
   • BIt uses a single SA for the entire group, allowing multicast traffic to be encrypted without per-tunnel SAs.
   • CIt creates a separate tunnel for each multicast receiver.
   • DIt relies on the multicast routing protocol to encrypt the packets.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A retail chain has 200 stores that connect to a central hub. The stores frequently need to communicate directly with each other for inventory transfers. The network team wants to minimize latency by allowing direct store-to-store traffic, but also wants to keep configuration simple. Which DMVPN feature enables this?

   • AGETVPN with a group key server
   • BStatic spoke-to-spoke tunnels configured on each router
   • CHub-and-spoke only with all traffic through the hub
   • DSpoke-to-spoke tunnels established dynamically via NHRP
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is deploying a site-to-site VPN between two routers. The security team requires authentication of both peers and encryption of all traffic, but does not need data integrity checking beyond what encryption provides. The team also wants to simplify configuration by using a tunnel interface. Which combination should they use?

   • AIKEv2 with ESP and a VTI
   • BIKEv1 with ESP and a crypto map
   • CIKEv2 with AH and a VTI
   • DIKEv1 with AH and a crypto map
   Reveal Solution Discussion Select an answer first