What is the purpose of NAT-T (NAT Traversal) in IPsec?

To encapsulate IPsec packets in UDP to allow them to pass through NAT devices.

To encrypt IPsec packets with an additional layer of encryption.

To compress IPsec packets to reduce their size.

To authenticate IPsec peers using digital certificates.

Which Junos operational command displays the active IPsec security associations?

show security ike security-associations

show security ipsec security-associations

A network engineer is troubleshooting an inbound IPsec packet drop on a Junos device. The 'show security ipsec security-associations' output shows the SA is active. The engineer runs 'show security log' and sees the packet was dropped at the 'inbound SA' stage. Which field in the packet header is used to find the correct SA?

Security Parameter Index (SPI).

What is a key characteristic of IPsec transport mode?

It protects only the payload of the original IP packet, leaving the original IP header intact.

It adds a new outer IP header with the tunnel endpoints.

It is used only for site-to-site VPNs.

It encrypts the entire IP packet including the original header.

A Junos device is receiving IPsec packets from a remote peer. The engineer notices that some packets are being dropped at the 'inbound SA' stage. The 'show security ipsec security-associations' output shows the SA is active with a valid SPI. Which condition is most likely causing the drops?

The packet's destination port is blocked by a security policy.

The packet's source IP is not in the allowed traffic selector.

The packet's sequence number is outside the anti-replay window.

The packet's SPI does not match the inbound SA's SPI.

Juniper NetworksCertified Specialist, Security (JNCIS-SEC)

Domain 2Objective 2

IPsec Traffic Processing JN0-336 Practice Questions (Page 3)

Part of the IPsec VPN domain, which makes up ~16% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

10concepts

Questions 11–15

11foundation · easy
What is the purpose of NAT-T (NAT Traversal) in IPsec?
Select an answer first
12foundation · easy
Which Junos operational command displays the active IPsec security associations?
Select an answer first
13application · medium
A network engineer is troubleshooting an inbound IPsec packet drop on a Junos device. The 'show security ipsec security-associations' output shows the SA is active. The engineer runs 'show security log' and sees the packet was dropped at the 'inbound SA' stage. Which field in the packet header is used to find the correct SA?
Select an answer first
14foundation · easy
What is a key characteristic of IPsec transport mode?
Select an answer first
15application · medium
A Junos device is receiving IPsec packets from a remote peer. The engineer notices that some packets are being dropped at the 'inbound SA' stage. The 'show security ipsec security-associations' output shows the SA is active with a valid SPI. Which condition is most likely causing the drops?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-336

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-336” is a trademark of its owner, used for identification only.