CCIE Security
Domain 2Objective 3
2.3 FlexVPN, DMVPN, and IPsec L2L Tunnels CCIE-SECURITY Practice Questions (Page 5)
Part of the 2.0 Secure Connectivity and Segmentation domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)
37questions here
8free pages
10concepts
20%of the exam
Questions 21–25
- 21
A regional bank is deploying a new VPN architecture to connect 200 branch offices to two data centers. They need dynamic spoke-to-spoke tunnels to reduce latency between branches, but they also want to leverage IKEv2's built-in capabilities like EAP authentication and mobility. The solution must be based on a single, flexible framework that can support both hub-and-spoke and dynamic mesh topologies. Which technology should the bank choose?
Select an answer first - 22
A service provider is offering managed VPN services to multiple customers. They need a solution that supports both hub-and-spoke and spoke-to-spoke topologies, and they want to use a single technology that can be easily scaled and customized per customer. They also want to leverage IKEv2's advanced features like EAP authentication for remote access. Which technology should they standardize on?
Select an answer first - 23
A FlexVPN tunnel between two routers is intermittently dropping. The engineer notices that the IKEv2 SA is rekeying frequently, and the IPsec SA is also rekeying. The tunnel is used for VoIP traffic, and the drops are causing call quality issues. The engineer wants to minimize rekeying and ensure that the tunnel remains stable. What should the engineer do?
Select an answer first - 24
A DMVPN Phase 3 network has a hub and 100 spokes. The hub is experiencing high CPU utilization because it is processing all data traffic between spokes. The engineer wants to offload traffic to direct spoke-to-spoke tunnels. The spokes are configured with 'ip nhrp shortcut', and the hub has 'ip nhrp redirect'. However, some spokes are still sending traffic through the hub. What is the most likely reason?
Select an answer first - 25
An engineer is troubleshooting an IPsec L2L tunnel that uses IKEv2 with certificates. The tunnel was working, but after a certificate renewal on one side, the tunnel fails to establish. The engineer checks 'show crypto ikev2 sa' and sees no SAs. What is the most likely cause?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.