nerdexam
Cisco

350-701 · Question #232

When planning a VPN deployment, for which reason does an engineer opt for an active/active FlexVPN configuration as opposed to DMVPN?

The correct answer is B. Traffic is distributed statically by default.. An active/active FlexVPN deployment allows for static traffic distribution across multiple tunnels by default, which is a distinguishing factor when compared to DMVPN.

Submitted by lars.no· Mar 30, 2026

Question

When planning a VPN deployment, for which reason does an engineer opt for an active/active FlexVPN configuration as opposed to DMVPN?

Options

  • AMultiple routers or VRFs are required.
  • BTraffic is distributed statically by default.
  • CFloating static routes are required.
  • DHSRP is used for fallover.

How the community answered

(35 responses)
  • A
    11% (4)
  • B
    60% (21)
  • C
    23% (8)
  • D
    6% (2)

Why each option

An active/active FlexVPN deployment allows for static traffic distribution across multiple tunnels by default, which is a distinguishing factor when compared to DMVPN.

AMultiple routers or VRFs are required.

Both DMVPN and FlexVPN can be configured with multiple routers or VRFs, so this is not a distinguishing reason to choose FlexVPN over DMVPN.

BTraffic is distributed statically by default.Correct

In an active/active FlexVPN setup with multiple tunnels, traffic distribution is typically managed through routing or policy where it can be statically distributed across the available paths. DMVPN, especially Phase 2 and 3, is optimized for dynamic spoke-to-spoke tunnels and generally relies on routing protocols to determine paths rather than static distribution across multiple active tunnels to the same hub.

CFloating static routes are required.

Floating static routes are a general routing mechanism for backup paths and are not exclusive to or a primary differentiator for choosing active/active FlexVPN over DMVPN.

DHSRP is used for fallover.

HSRP (Hot Standby Router Protocol) is a First Hop Redundancy Protocol (FHRP) used for local gateway redundancy and is not directly related to the core VPN architecture decision between FlexVPN and DMVPN for active/active scenarios.

Concept tested: FlexVPN active/active traffic distribution vs DMVPN

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpn/configuration/xe-16/sec-conn-vpn-xe-16-book/sec-cfg-flex-vpn-active-active.html

Topics

#FlexVPN#DMVPN#VPN design#Active/Active VPN

Community Discussion

No community discussion yet for this question.

Full 350-701 Practice