CCIE Security
Domain 2Objective 3
2.3 FlexVPN, DMVPN, and IPsec L2L Tunnels CCIE-SECURITY Practice Questions (Page 7)
Part of the 2.0 Secure Connectivity and Segmentation domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)
37questions here
8free pages
10concepts
20%of the exam
Questions 31–35
- 31
A FlexVPN tunnel between two sites is not establishing. The engineer runs 'show crypto ikev2 sa' and sees no active IKEv2 security associations. The tunnel interface is up/up, and the IPsec profile is correctly applied. What is the most likely cause of the failure?
Select an answer first - 32
A company is deploying DMVPN Phase 3 to connect 500 remote sites to a central hub. They want to minimize hub traffic by allowing spokes to communicate directly after an initial data flow. Which feature is essential for this to work efficiently?
Select an answer first - 33
A network engineer is configuring a DMVPN Phase 2 hub router. The hub has a public IP address of 203.0.113.1 and will serve as the NHRP server. Which configuration is required on the hub's tunnel interface to allow spokes to register and resolve each other's addresses?
Select an answer first - 34
A DMVPN spoke is unable to establish a direct tunnel to another spoke. The engineer runs 'show dmvpn' and sees that the spoke has registered with the hub, but the NHRP cache does not show the remote spoke's public address. What is the most likely reason for this?
Select an answer first - 35
A small company with two sites needs a simple site-to-site VPN. They have static public IP addresses on both ends and only need to encrypt traffic between two specific subnets. They want to use IKEv2 for better security and support for modern encryption algorithms. Which configuration approach is most appropriate?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.