An enterprise network is deploying Group Encrypted Transport VPN (GET VPN) to ensure secure communication between its branch offices. The network design must meet the following requirements: 1. Minimize the latency introduced during encryption and decryption processes. 2. Ensure that the communication remains secure even if the key server is temporarily unavailable. 3. Allow seamless integration with the existing MPLS network without tunneling overhead. Which two features of GET VPN fulfill these requirements?

A. Key server failover support to maintain security during key server unavailability

D. Native packet transport without additional tunneling overhead

A. Key server failover support to maintain security during key server unavailability

B. Support for IPsec tunneling to integrate with MPLS networks

C. Scalability through the use of a group-based policy and key management

D. Native packet transport without additional tunneling overhead

E. Encryption and decryption performed on a per-packet basis to minimize latency

CiscoProfessional level300-420Page 3 of 4

300-420 exam dumps: questions 201 to 300 of 322

Page 3 of the free 300-420 question bank for the Designing Cisco Enterprise Networks exam. Questions 201 to 300 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated February 2025

Start timed practice exam Questions 201 to 300

Free 300-420 practice questions

Questions 201 to 205 of 322

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

300-420 Question 201

Single answer

An enterprise network consists of two offices connected over the public internet. The network engineer decides to implement a Generic Routing Encapsulation (GRE) tunnel between the two sites to securely exchange data. After configuring the GRE tunnel, the engineer notices that the tunnel interface remains down. What is the most likely cause of the issue?

A
The source and destination IP addresses for the tunnel are not reachable.
B
The GRE tunnel is not encrypted, and encryption is mandatory for the tunnel to come up.
C
The tunnel interface is missing a configured IP address.
D
The MTU size of the GRE tunnel is incorrectly configured.

Show answer and explanation

Correct answer: A

Explanation

A GRE tunnel depends on the underlying network to route packets between the source and destination IP addresses. If these addresses are not reachable (due to routing issues, ACLs, or other connectivity problems), the tunnel interface will not establish. Ensuring reachability between the tunnel endpoints is a critical step in GRE tunnel configuration.

A. Correct.
A GRE tunnel requires the source and destination IP addresses to be reachable over the underlying network. If they are not reachable, the tunnel interface will remain down.
B. Incorrect.
GRE itself does not provide encryption, and encryption is not mandatory for the tunnel to establish. This is incorrect in this context.
C. Incorrect.
While a tunnel interface requires an IP address for proper routing, the lack of an IP address alone will not cause the tunnel interface to remain down. It would still be administratively up but non-functional.
D. Incorrect.
An incorrect MTU size might cause packet fragmentation issues, but it will not prevent the tunnel interface from coming up.

300-420 Question 202

Select 3

A company has two branch offices that need to communicate securely over the internet. They decide to use a GRE tunnel to encapsulate traffic between the two sites. During the design phase, the network engineer must configure the tunnel to ensure proper routing and connectivity. Which of the following are design considerations for implementing GRE tunnels in this scenario?

A
Ensure that the GRE tunnel endpoints have routable IP addresses on the public internet.
B
Configure a routing protocol such as OSPF or EIGRP within the GRE tunnel to exchange routes between the two sites.
C
Enable encryption on the GRE tunnel to secure the data natively within the tunnel.
D
Verify that the GRE tunnel destination IP address is reachable via the source interface of the tunnel.
E
Use the same IP addresses for both the tunnel source and destination to simplify configuration.

Show answer and explanation

Correct answers: A, B, D

Explanation

GRE tunnels are widely used to encapsulate traffic between remote sites over public or private networks. For proper design and implementation, the endpoints must have routable IPs, the destination must be reachable, and a routing protocol can be used within the tunnel for route exchange. However, GRE does not natively provide encryption, and additional protocols like IPsec are required for securing data.

A. Correct.
Correct: GRE tunnel endpoints must have routable IP addresses on the public internet to ensure the encapsulated traffic can reach the other endpoint over the internet.
B. Correct.
Correct: To exchange routes between the two sites and ensure proper traffic forwarding, a routing protocol like OSPF or EIGRP can be configured within the tunnel.
C. Incorrect.
Incorrect: GRE does not natively provide encryption. If encryption is required, an additional protocol like IPsec must be used.
D. Correct.
Correct: The GRE tunnel destination IP address must be reachable via the source interface for the tunnel to establish connectivity.
E. Incorrect.
Incorrect: Using the same IP addresses for both the source and destination is not valid and will result in configuration errors.

300-420 Question 203

Single answer

A network engineer is tasked with connecting two remote branch offices over the internet using Generic Routing Encapsulation (GRE). The engineer notices that traffic is not passing through the GRE tunnel. Upon investigation, the engineer observes that the tunnel interface status is 'up', but the line protocol is 'down'. What is the MOST likely cause of this issue?

A
The GRE tunnel source or destination IP address is unreachable.
B
The GRE tunnel is missing an IP address on the tunnel interface.
C
The internet service provider (ISP) is blocking GRE traffic.
D
The MTU size on the tunnel interface is set incorrectly.

Show answer and explanation

Correct answer: A

Explanation

In GRE tunnels, the 'up' status of the tunnel interface indicates that the interface is configured correctly. However, the line protocol being 'down' typically indicates that the GRE tunnel source or destination IP address is not reachable. GRE relies on the underlying connectivity between the source and destination IP addresses to establish the tunnel. Ensuring IP reachability resolves the issue in most cases.

A. Correct.
The GRE tunnel requires the source and destination IP addresses to be reachable for the tunnel to function. If either address is unreachable, the line protocol will remain 'down', even if the tunnel interface itself is 'up'.
B. Incorrect.
While assigning an IP address to the GRE tunnel interface is necessary for proper routing, the absence of an IP address would not cause the line protocol to show 'down'. Instead, routing would fail, but the tunnel's protocol state would remain 'up'.
C. Incorrect.
ISPs typically do not block GRE traffic by default. While this could theoretically cause issues, it is not the most likely cause in this scenario.
D. Incorrect.
An incorrect MTU size could lead to packet fragmentation or drops, but it would not cause the line protocol to show 'down'. The tunnel would still establish connectivity.

300-420 Question 204

Select 2

An enterprise network is deploying Group Encrypted Transport VPN (GET VPN) to ensure secure communication between its branch offices. The network design must meet the following requirements:

Minimize the latency introduced during encryption and decryption processes.
Ensure that the communication remains secure even if the key server is temporarily unavailable.
Allow seamless integration with the existing MPLS network without tunneling overhead.

Which two features of GET VPN fulfill these requirements?

A
Key server failover support to maintain security during key server unavailability
B
Support for IPsec tunneling to integrate with MPLS networks
C
Scalability through the use of a group-based policy and key management
D
Native packet transport without additional tunneling overhead
E
Encryption and decryption performed on a per-packet basis to minimize latency

Show answer and explanation

Correct answers: A, D

Explanation

GET VPN is designed to provide secure communication for enterprises without relying on tunneling, making it ideal for use with MPLS networks by preserving the original IP header. Additionally, its key server failover mechanism ensures uninterrupted secure communication even during key server outages. These features align perfectly with the requirements mentioned in the scenario.

A. Correct.
GET VPN supports key server failover, ensuring that even if the primary key server becomes unavailable, the group members can continue secure communication using the previously shared keys.
B. Incorrect.
GET VPN does not use IPsec tunneling; instead, it encrypts traffic natively. This makes it unsuitable for scenarios requiring traditional IPsec tunneling.
C. Incorrect.
While GET VPN is scalable due to group-based policy and key management, this feature does not directly address the requirements in the scenario.
D. Correct.
GET VPN encrypts packets natively without adding tunneling overhead, which allows seamless integration with MPLS networks and meets the requirement for no additional overhead.
E. Incorrect.
Encryption and decryption in GET VPN do not occur on a per-packet basis to minimize latency. Instead, it uses session keys for group communication.

300-420 Question 205

Select 2

An enterprise is deploying Group Encrypted Transport VPN (GET VPN) to secure communication between branch locations over a private MPLS network. They need to ensure proper key management and scalability while maintaining a seamless failover mechanism in case of key server failure. Which of the following design considerations should they implement for a reliable GET VPN deployment?

A
Deploy redundant key servers with automatic failover configuration.
B
Use spoke-to-spoke encryption to minimize latency between branch locations.
C
Ensure the private MPLS network supports multicast traffic for key dissemination.
D
Configure GET VPN to use IKEv2 for initial peer authentication.
E
Deploy a secondary key server in passive mode with manual failover.

Show answer and explanation

Correct answers: A, C

Explanation

GET VPN is designed to secure group communications over private networks like MPLS by using group encryption. Multicast support is essential for efficient key distribution to all group members. Redundant key servers with automatic failover are critical for high availability and preventing any disruption in secure communication. These design considerations ensure a reliable and scalable GET VPN deployment.

A. Correct.
Deploying redundant key servers with automatic failover ensures high availability and prevents communication disruption in case of a key server failure.
B. Incorrect.
GET VPN does not rely on spoke-to-spoke encryption; instead, it uses a group-based encryption model for all traffic in the group. This option is incorrect.
C. Correct.
GET VPN requires multicast for efficient key distribution to group members over the private MPLS network. Without multicast support, key dissemination may fail.
D. Incorrect.
GET VPN does not mandate the use of IKEv2 for peer authentication. While IKEv2 can be used, it is not a specific requirement for GET VPN deployment.
E. Incorrect.
A secondary key server in passive mode with manual failover is not ideal for scalability and reliability, as it introduces operational delays during failover situations.

Timed practice exam

Take a 300-420 practice test under exam conditions

75 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

300-420 practice questions 201 to 300 of 322

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 4 pages of up to 100 questions.