A Junos device is configured with an IPsec VPN to a remote site. The tunnel is not coming up. The administrator runs 'show security ike security-associations' and sees no IKE SA. Which next step is most appropriate to identify the cause of the IKE negotiation failure?

Run 'show security flow session' to check for active sessions.

Run 'show log iked' to review IKE negotiation logs.

Run 'show security ipsec security-associations' to check the IPsec SA status.

Run 'show route protocol bgp' to verify BGP routes.

An administrator is troubleshooting an IPsec VPN that is not passing traffic. The tunnel is up, but pings from the local network to the remote network fail. The administrator runs 'show security ipsec security-associations' and sees the SA is active. What should the administrator check next?

Check the IKE proposal configuration on both devices.

Change the pre-shared key on both devices.

Reboot the remote device to reset the tunnel.

Verify that the routing table has a route to the remote network via the tunnel interface.

A network engineer is configuring a site-to-site IPsec VPN between two Junos devices. The remote device is a third-party firewall that supports only IKEv1 with main mode and requires the authentication method to be pre-shared keys. The engineer wants to ensure the IKE negotiation completes successfully. Which configuration change is necessary on the Junos device?

Set the IKE proposal to use IKEv2 with pre-shared keys.

Set the IKE policy to use aggressive mode with pre-shared keys.

Configure the IKE policy with version ikev1 and a pre-shared-key authentication method.

Use certificate-based authentication in the IKE policy.

Which Junos operational command is used to verify that traffic is flowing through an established IPsec tunnel by displaying packet counts for encrypted and decrypted traffic?

show security ipsec security-associations

Juniper NetworksCertified Specialist, Security (JNCIS-SEC)

Domain 2Objective 5

Configure, Monitor, or Troubleshoot IPsec VPNs JN0-336 Practice Questions (Page 2)

Part of the IPsec VPN domain, which makes up ~16% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 11 practice questions to prepare you well beyond it. (estimate)

11questions here

3free pages

3concepts

Questions 6–10

6foundation · easy
Which Junos OS configuration statement is used to define the security association lifetime for an IPsec security association?
Select an answer first
7application · medium
A Junos device is configured with an IPsec VPN to a remote site. The tunnel is not coming up. The administrator runs 'show security ike security-associations' and sees no IKE SA. Which next step is most appropriate to identify the cause of the IKE negotiation failure?
Select an answer first
8application · medium
An administrator is troubleshooting an IPsec VPN that is not passing traffic. The tunnel is up, but pings from the local network to the remote network fail. The administrator runs 'show security ipsec security-associations' and sees the SA is active. What should the administrator check next?
Select an answer first
9application · medium
A network engineer is configuring a site-to-site IPsec VPN between two Junos devices. The remote device is a third-party firewall that supports only IKEv1 with main mode and requires the authentication method to be pre-shared keys. The engineer wants to ensure the IKE negotiation completes successfully. Which configuration change is necessary on the Junos device?
Select an answer first
10foundation · easy
Which Junos operational command is used to verify that traffic is flowing through an established IPsec tunnel by displaying packet counts for encrypted and decrypted traffic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-336

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-336” is a trademark of its owner, used for identification only.

Configure, Monitor, or Troubleshoot IPsec VPNs JN0-336 Practice Questions (Page 2)

Questions 6–10

Which Junos OS configuration statement is used to define the security association lifetime for an IPsec security association?

A Junos device is configured with an IPsec VPN to a remote site. The tunnel is not coming up. The administrator runs 'show security ike security-associations' and sees no IKE SA. Which next step is most appropriate to identify the cause of the IKE negotiation failure?

An administrator is troubleshooting an IPsec VPN that is not passing traffic. The tunnel is up, but pings from the local network to the remote network fail. The administrator runs 'show security ipsec security-associations' and sees the SA is active. What should the administrator check next?

Which Junos operational command is used to verify that traffic is flowing through an established IPsec tunnel by displaying packet counts for encrypted and decrypted traffic?

Keep studying — IPsec VPN