Selected Answer: D A: does not make sense B: spoke to spoke is not allowed, and this command is used for spoke to spoke c: makes no sense D: most correct answer, as this command is needed on the hub for hub and spoke communication.

I think D is right. Because Spoke-to-Spoke traffic is not allowed and wanted, so redirect is not needed. But FlexVPN uses Virtual Templates to create Virtual Access interfaces for each connected Spoke.

D. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-mt/sec-flex-vpn-15-mt-book/sec-flex-spoke.html?bookSearch=true

B - need too

"On a FlexVPN hub-and-spoke topology where spoke-to-spoke tunnels are not allowed, which command is needed for the hub"

Selected Answer: B vote for b

Can you explain it please?

Tricky question hub: interface Virtual-Template1 type tunnel ip unnumbered Loopback0 ip nhrp network-id 1 ip nhrp redirect tunnel protection ipsec profile default ! spoke: ! interface Virtual-Template1 type tunnel ip unnumbered Tunnel0 ip nhrp network-id 1 ip nhrp shortcut virtual-template 1 ip nhrp redirect tunnel protection ipsec profile default ! Not sure why the spoke has redirect there too.

here we go again....exam topic shows B which is totally a wrong answer...D is the one for this qstn...why don't the admin update this unless it's meant to create confusion...makes me wonder if this is a valid database of exam qstns

the question said that spoke-to-spoke traffic is not needed