An administrator is troubleshooting an IPsec VPN that is not establishing. The command 'show security ike security-associations' shows an IKE SA with a status of 'DOWN'. The administrator checks the IKE gateway configuration and sees that the local address is set to the loopback interface. What is a likely cause of the problem?

The IPsec proposal is misconfigured.

The IPsec SA lifetime is too short.

The loopback interface is not reachable from the remote peer.

The security policy is blocking IKE traffic.

An administrator is troubleshooting an IPsec site-to-site VPN that is not passing traffic. The command 'show security ipsec security-associations' shows an SA with a status of 'UP' but the traffic is not traversing the tunnel. The administrator checks the routing table and sees that the remote subnet route is present. What should the administrator check next?

The MTU size on the physical interface

The security policy allowing traffic from the local zone to the VPN zone

The IPsec proposal authentication algorithm

When is transport mode typically used in IPsec?

When the VPN gateway is behind a NAT device

When using AH without encryption

When connecting two branch offices through the internet

When protecting traffic between two hosts directly, such as a client and a server

Juniper NetworksCertified Specialist, Security (JNCIS-SEC)

Domain 2Objective 3

IPsec Site-To-Site VPNs JN0-336 Practice Questions (Page 5)

Part of the IPsec VPN domain, which makes up ~16% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

Questions 21–25

21application · medium
An administrator is troubleshooting an IPsec VPN that is not establishing. The command 'show security ike security-associations' shows an IKE SA with a status of 'DOWN'. The administrator checks the IKE gateway configuration and sees that the local address is set to the loopback interface. What is a likely cause of the problem?
Select an answer first
22application · medium
An administrator is troubleshooting an IPsec site-to-site VPN that is not passing traffic. The command 'show security ipsec security-associations' shows an SA with a status of 'UP' but the traffic is not traversing the tunnel. The administrator checks the routing table and sees that the remote subnet route is present. What should the administrator check next?
Select an answer first
23foundation · easy
In which IPsec mode is the entire original IP packet encapsulated in a new IP packet with a new header?
Select an answer first
24application · medium
A company is configuring an IPsec VPN between two sites. The security team requires that the VPN provide encryption and integrity, but they do not want to encapsulate the original IP header. Which mode and protocol should be used?
Select an answer first
25foundation · easy
When is transport mode typically used in IPsec?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-336

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-336” is a trademark of its owner, used for identification only.

IPsec Site-To-Site VPNs JN0-336 Practice Questions (Page 5)

Questions 21–25

In which IPsec mode is the entire original IP packet encapsulated in a new IP packet with a new header?

A company is configuring an IPsec VPN between two sites. The security team requires that the VPN provide encryption and integrity, but they do not want to encapsulate the original IP header. Which mode and protocol should be used?

When is transport mode typically used in IPsec?

Keep studying — IPsec VPN