IPsec Traffic Processing JN0-336 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of the DF (Don't Fragment) bit in IPsec traffic processing?

   • AIt enables anti-replay checking for the packet.
   • BIt disables encryption for the packet.
   • CIt tells the IPsec peer to fragment the packet before encryption.
   • DIt tells intermediate routers not to fragment the packet, which can trigger Path MTU Discovery.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has an IPsec VPN between two sites. The remote site is behind a NAT device. The VPN was working, but after a firewall upgrade, the VPN stopped working. The engineer checks the security associations and sees that the IKE SA is up, but the IPsec SA is not. What is the most likely cause?

   • AThe IPsec SA lifetime is too short.
   • BThe traffic selectors are incorrect.
   • CNAT-T is not enabled on the remote firewall.
   • DThe anti-replay window is too small.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   After an inbound IPsec packet is decrypted, what is the next step in the processing flow?

   • AAuthenticate the packet to verify its integrity and origin.
   • BPerform an SPI lookup to identify the SA.
   • CAdd an IPsec header to the decrypted packet.
   • DForward the packet without further checks.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of the sliding window in IPsec anti-replay checking?

   • ATo encrypt packets with different keys for each sequence number.
   • BTo select the appropriate traffic selectors for the packet.
   • CTo determine the lifetime of the security association.
   • DTo allow out-of-order packets to be accepted within a certain range.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why does IPsec encapsulation increase the size of a packet?

   • ABecause it compresses the payload, which requires extra header information.
   • BBecause it encrypts the packet, which inherently makes it larger.
   • CBecause it adds an outer IP header, an IPsec header, and possibly an ESP trailer.
   • DBecause it duplicates the entire packet for redundancy.
   Reveal Solution Discussion Select an answer first