An engineer is configuring dual-hub DMVPN. Spokes are configured with NHRP mappings for both hubs. However, when one hub fails, spokes are not failing over to the other hub. What is the most likely missing configuration?

Spokes are not configured with a backup NHRP server

Routing protocol is not configured to prefer the backup hub

IPsec tunnels are not configured for redundancy

NHRP redirect and shortcut are not enabled

In a dual-hub DMVPN network, a spoke is sending traffic to another spoke via the hub, even though a direct spoke-to-spoke tunnel is available. The engineer wants to optimize the path to use the direct tunnel. Which feature should be enabled?

Routing protocol with unequal-cost load balancing

A company is expanding its remote-access VPN capacity. They currently have two standalone ASAs with Active/Standby failover. They want to increase throughput and provide load balancing without purchasing new hardware. What is the most effective solution?

Upgrade the active ASA to a higher model

Keep Active/Standby and add a load balancer

Convert the two ASAs into a two-member cluster

Use VPN load balancing (VLB) on the two ASAs

An engineer is setting up an ASA cluster in a data center with two core switches. Each ASA has two interfaces connected to each switch. The engineer wants to use all available bandwidth and provide redundancy. Which interface configuration should be used?

Configure each ASA interface as a separate port-channel to each switch

Create a single EtherChannel that includes interfaces from all cluster members

Use individual interfaces without EtherChannel

Use Active/Standby failover with separate interfaces

A company is deploying a new remote-access VPN on a pair of ASA firewalls. They require that if one firewall fails, existing VPN sessions remain active without re-authentication, and new sessions are distributed across both devices. Which solution meets these requirements?

Implement a DMVPN with dual hubs

Configure ASA clustering with stateful failover and load balancing

Use Active/Standby failover with stateful replication

Deploy two independent ASAs with DNS round-robin

CCIE Security

Domain 2Objective 4

2.4 VPN High Availability Methods CCIE-SECURITY Practice Questions (Page 7)

Part of the 2.0 Secure Connectivity and Segmentation domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

7concepts

20%of the exam

Questions 31–35

31application · medium
An engineer is configuring dual-hub DMVPN. Spokes are configured with NHRP mappings for both hubs. However, when one hub fails, spokes are not failing over to the other hub. What is the most likely missing configuration?
Select an answer first
32application · medium
In a dual-hub DMVPN network, a spoke is sending traffic to another spoke via the hub, even though a direct spoke-to-spoke tunnel is available. The engineer wants to optimize the path to use the direct tunnel. Which feature should be enabled?
Select an answer first
33application · medium
A company is expanding its remote-access VPN capacity. They currently have two standalone ASAs with Active/Standby failover. They want to increase throughput and provide load balancing without purchasing new hardware. What is the most effective solution?
Select an answer first
34application · medium
An engineer is setting up an ASA cluster in a data center with two core switches. Each ASA has two interfaces connected to each switch. The engineer wants to use all available bandwidth and provide redundancy. Which interface configuration should be used?
Select an answer first
35application · medium
A company is deploying a new remote-access VPN on a pair of ASA firewalls. They require that if one firewall fails, existing VPN sessions remain active without re-authentication, and new sessions are distributed across both devices. Which solution meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.