A school district wants remote library branches to reach HQ over Internet circuits with dynamic tunnels and minimal per-spoke static crypto endpoints. Which single-hub design matches that ENARSI use case?
Select an answer to reveal the explanation.
Short Explanation
One HQ hub, many Internet spokes that phone home and register—that’s classic single-hub DMVPN. Dynamic tunnels beat carving a static crypto peer for every library.
Full Explanation
A school district that must connect remote library branches to HQ over Internet circuits with dynamic tunnels and minimal per-spoke static crypto endpoints matches classic single-hub DMVPN: one HQ hub, mGRE for multipoint tunnels, NHRP for dynamic NBMA registration/resolution, and usually IPsec for encryption. Spokes register to the hub NHS and bring up tunnels without the hub provisioning a unique static tunnel destination for every library. That is the ENARSI use case for scalable Internet-based spoke connectivity to a civic HQ.
Provider MPLS L3VPN with PE VRF tables on every branch CE confuses a carrier VPN service with a customer-operated DMVPN overlay and incorrectly implies CEs host provider PE VRFs. Declaring dual-hub Phase 3 DMVPN with mandatory dual NHS pairs as the only ENARSI pattern overstates redundancy options; single-hub is a valid and common design when the stem asks for one HQ hub. FlexVPN concentrator fabric managed only through vManage OMP policies mixes FlexVPN/SD-WAN concepts into a stem that is asking for DMVPN.
Exam caveat: Phase 1/2/3 behaviors affect spoke-to-spoke shortcuts, but the stem’s core ask is single-hub dynamic registration—not mandatory dual hub. Operational check: configure hub mGRE + NHRP NHS, point spokes at the hub, confirm show dmvpn registrations, validate overlay routing over tunnel interfaces, and ensure IPsec tunnel protection is up if the underlay is the public Internet.