Pass Your Cisco 350-401 Exam Easy!

Protecting the GRE transport with a supported IPsec security association or use an appropriate secured tunnel design would not install an underlay route to the remote GRE destination through physical transport, outside the GRE overlay.

Installing or verify a default route explicitly in the BLUE VRF routing table would not install an underlay route to the remote GRE destination through physical transport, outside the GRE overlay.

Building a supported GRE tunnel between reachable tunnel endpoints and routing the intended overlay payload through it would not install an underlay route to the remote GRE destination through physical transport, outside the GRE overlay.

This test measures a different behavior: Capture transit packets and confirm encryption/ESP handling rather than plaintext GRE. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect the FIB route to the outer tunnel destination and verify it resolves to a physical next hop.

This test measures a different behavior: Inspect tunnel source/destination underlay reachability and encapsulated packet counters. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect the FIB route to the outer tunnel destination and verify it resolves to a physical next hop.

This test measures a different behavior: Use a VRF-specific route lookup and sourced ping to check the tenant's default next hop. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect the FIB route to the outer tunnel destination and verify it resolves to a physical next hop.

That diagnosis is supported by a different symptom: Tunnel interface is up administratively but multicast flows cannot cross because remote GRE endpoint is unreachable. Here the recorded observation is: tunnel protocol repeatedly flaps with recursive route warnings. The applicable cause is: the tunnel destination resolves through the tunnel itself, producing recursive routing.

That diagnosis is supported by a different symptom: A transit observer can inspect inner routed payloads inside GRE packets. Here the recorded observation is: tunnel protocol repeatedly flaps with recursive route warnings. The applicable cause is: the tunnel destination resolves through the tunnel itself, producing recursive routing.

That diagnosis is supported by a different symptom: Hosts in VRF BLUE have no default route despite `show ip route` displaying 0.0.0.0/0 globally. Here the recorded observation is: tunnel protocol repeatedly flaps with recursive route warnings. The applicable cause is: the tunnel destination resolves through the tunnel itself, producing recursive routing.

That control reduces a separate risk: GRE encapsulates IP traffic but does not itself encrypt the payload. For the described design, the recurring risk arises from: the tunnel destination resolves through the tunnel itself, producing recursive routing. The specific required safeguard is: keep overlay and underlay route domains separate when summarizing routes.

That control reduces a separate risk: Global and VRF routing tables are distinct; the default exists in the wrong table. For the described design, the recurring risk arises from: the tunnel destination resolves through the tunnel itself, producing recursive routing. The specific required safeguard is: keep overlay and underlay route domains separate when summarizing routes.

That control reduces a separate risk: The GRE outer destination lacks routable underlay reachability. For the described design, the recurring risk arises from: the tunnel destination resolves through the tunnel itself, producing recursive routing. The specific required safeguard is: keep overlay and underlay route domains separate when summarizing routes.

Building a supported GRE tunnel between reachable tunnel endpoints and routing the intended overlay payload through it would not adjust tunnel MTU and TCP MSS as supported, or provide an underlay MTU sufficient for encapsulation overhead.

Aligning compatible IKE and IPsec transform/proposal parameters, authentication and identities on both peers would not adjust tunnel MTU and TCP MSS as supported, or provide an underlay MTU sufficient for encapsulation overhead.

Installing an underlay route to the remote GRE destination through physical transport, outside the GRE overlay would not adjust tunnel MTU and TCP MSS as supported, or provide an underlay MTU sufficient for encapsulation overhead.

This test measures a different behavior: Inspect IKE SA and child/ESP SA negotiation state to verify a common proposal. It does not establish the target outcome. For the documented fault, the direct acceptance test is: compare fragmentation-needed symptoms and large-packet PMTU tests through the tunnel.

This test measures a different behavior: Inspect the FIB route to the outer tunnel destination and verify it resolves to a physical next hop. It does not establish the target outcome. For the documented fault, the direct acceptance test is: compare fragmentation-needed symptoms and large-packet PMTU tests through the tunnel.

This test measures a different behavior: Inspect tunnel source/destination underlay reachability and encapsulated packet counters. It does not establish the target outcome. For the documented fault, the direct acceptance test is: compare fragmentation-needed symptoms and large-packet PMTU tests through the tunnel.

That diagnosis is supported by a different symptom: IKE authentication succeeds but no child security association is installed. Here the recorded observation is: small packets succeed while full-sized DF TCP segments blackhole. The applicable cause is: encapsulation overhead reduced effective payload MTU without PMTU/MSS accommodation.

That diagnosis is supported by a different symptom: Tunnel protocol repeatedly flaps with recursive route warnings. Here the recorded observation is: small packets succeed while full-sized DF TCP segments blackhole. The applicable cause is: encapsulation overhead reduced effective payload MTU without PMTU/MSS accommodation.

That diagnosis is supported by a different symptom: Tunnel interface is up administratively but multicast flows cannot cross because remote GRE endpoint is unreachable. Here the recorded observation is: small packets succeed while full-sized DF TCP segments blackhole. The applicable cause is: encapsulation overhead reduced effective payload MTU without PMTU/MSS accommodation.

That control reduces a separate risk: The peers have no common supported child-SA encryption/integrity proposal. For the described design, the recurring risk arises from: encapsulation overhead reduced effective payload MTU without PMTU/MSS accommodation. The specific required safeguard is: test maximum packet sizes and path-MTU after tunnel or encryption changes.

That control reduces a separate risk: The tunnel destination resolves through the tunnel itself, producing recursive routing. For the described design, the recurring risk arises from: encapsulation overhead reduced effective payload MTU without PMTU/MSS accommodation. The specific required safeguard is: test maximum packet sizes and path-MTU after tunnel or encryption changes.

That control reduces a separate risk: The GRE outer destination lacks routable underlay reachability. For the described design, the recurring risk arises from: encapsulation overhead reduced effective payload MTU without PMTU/MSS accommodation. The specific required safeguard is: test maximum packet sizes and path-MTU after tunnel or encryption changes.

Protecting the GRE transport with a supported IPsec security association or use an appropriate secured tunnel design would not align compatible IKE and IPsec transform/proposal parameters, authentication and identities on both peers.

Installing an underlay route to the remote GRE destination through physical transport, outside the GRE overlay would not align compatible IKE and IPsec transform/proposal parameters, authentication and identities on both peers.

Adjusting tunnel MTU and TCP MSS as supported, or provide an underlay MTU sufficient for encapsulation overhead would not align compatible IKE and IPsec transform/proposal parameters, authentication and identities on both peers.

This test measures a different behavior: Compare fragmentation-needed symptoms and large-packet PMTU tests through the tunnel. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect IKE SA and child/ESP SA negotiation state to verify a common proposal.

This test measures a different behavior: Capture transit packets and confirm encryption/ESP handling rather than plaintext GRE. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect IKE SA and child/ESP SA negotiation state to verify a common proposal.

This test measures a different behavior: Inspect the FIB route to the outer tunnel destination and verify it resolves to a physical next hop. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect IKE SA and child/ESP SA negotiation state to verify a common proposal.

That diagnosis is supported by a different symptom: Small packets succeed while full-sized DF TCP segments blackhole. Here the recorded observation is: iKE authentication succeeds but no child security association is installed. The applicable cause is: the peers have no common supported child-SA encryption/integrity proposal.

That diagnosis is supported by a different symptom: A transit observer can inspect inner routed payloads inside GRE packets. Here the recorded observation is: iKE authentication succeeds but no child security association is installed. The applicable cause is: the peers have no common supported child-SA encryption/integrity proposal.

That diagnosis is supported by a different symptom: Tunnel protocol repeatedly flaps with recursive route warnings. Here the recorded observation is: iKE authentication succeeds but no child security association is installed. The applicable cause is: the peers have no common supported child-SA encryption/integrity proposal.