A network engineer is troubleshooting a site-to-site IPsec VPN between two Junos devices. Traffic from the local 10.1.0.0/16 network to the remote 10.2.0.0/16 network is not being encrypted. The security policy permitting the traffic is in place, and the IKE phase 1 and phase 2 SAs are up. The engineer checks the security association database and sees the SA with the correct SPI and traffic selectors. Which action should the engineer take next to determine why the traffic is not matching the SA?

Run 'show security flow session' for a sample packet from 10.1.0.0/16 to 10.2.0.0/16 and check if the session is associated with the IPsec SA.

Run 'show security policies' and confirm the policy action is 'permit tunnel ipsec-vpn vpn-name'.

Run 'show security ipsec security-associations' and verify the SA's 'Direction' field shows 'outbound'.

Run 'show security ipsec traffic-selectors' and verify the local and remote prefixes match the configured proxy-ids.

What is the first step in processing an outbound IPsec packet on a security device?

Encrypt the packet using the SA's encryption key.

Add the ESP header to the packet.

Perform a security association (SA) lookup based on the packet's traffic selectors.

In IPsec tunnel mode, what is encapsulated?

Only the payload of the original IP packet.

The entire original IP packet, including its header.

Only the TCP or UDP header and data.

The original IP header and the ESP trailer.

What is the first step in processing an inbound IPsec packet?

Check the packet's DF bit to determine if fragmentation is needed.

Decrypt the packet using the SA's decryption key.

Verify the packet's source IP address against the traffic selectors.

Perform an SPI lookup to find the matching security association.

During IPsec SA rekeying, how is traffic continuity maintained?

The new SA is established before the old SA expires, allowing traffic to use the new SA seamlessly.

The SPI of the old SA is reused for the new SA.

Traffic is temporarily halted until the new SA is established.

The old SA is kept indefinitely until all traffic stops.

Juniper NetworksCertified Specialist, Security (JNCIS-SEC)

Domain 2Objective 2

IPsec Traffic Processing JN0-336 Practice Questions (Page 1)

Part of the IPsec VPN domain, which makes up ~16% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

10concepts

Questions 1–5

1application · medium
A network engineer is troubleshooting a site-to-site IPsec VPN between two Junos devices. Traffic from the local 10.1.0.0/16 network to the remote 10.2.0.0/16 network is not being encrypted. The security policy permitting the traffic is in place, and the IKE phase 1 and phase 2 SAs are up. The engineer checks the security association database and sees the SA with the correct SPI and traffic selectors. Which action should the engineer take next to determine why the traffic is not matching the SA?
Select an answer first
2foundation · easy
What is the first step in processing an outbound IPsec packet on a security device?
Select an answer first
3foundation · easy
In IPsec tunnel mode, what is encapsulated?
Select an answer first
4foundation · easy
What is the first step in processing an inbound IPsec packet?
Select an answer first
5foundation · easy
During IPsec SA rekeying, how is traffic continuity maintained?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-336

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-336” is a trademark of its owner, used for identification only.