IPsec Traffic Processing JN0-336 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which protocol and port are typically used by NAT-T for UDP encapsulation of IPsec packets?

   • ATCP port 4500
   • BTCP port 500
   • CUDP port 500
   • DUDP port 4500
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A network engineer is configuring an IPsec VPN between two sites. Site A has a static public IP, and Site B has a dynamic public IP behind a NAT device. The engineer wants to ensure the VPN is resilient to IP address changes at Site B. Which configuration approach should be used?

   • AConfigure both sites to initiate the VPN, using the dynamic IP as the peer.
   • BConfigure both sites to respond, using the static IP as the peer.
   • CConfigure Site A to initiate the VPN and Site B to respond, using the dynamic IP as the peer.
   • DConfigure Site B to initiate the VPN and Site A to respond, using the static IP as the peer.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In IPsec traffic processing, what is the primary role of the Security Parameter Index (SPI)?

   • AIt contains the shared secret key used for encrypting the IPsec payload.
   • BIt uniquely identifies a security association between the two IPsec peers.
   • CIt indicates the lifetime of the security association in seconds.
   • DIt identifies the encryption algorithm used by the security association.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A network architect is designing a solution to encrypt traffic between two application servers in different data centers. The servers communicate using a custom protocol that relies on the source IP address being preserved. The architect is considering IPsec transport mode. What is the primary advantage of using transport mode over tunnel mode in this scenario?

   • ATransport mode preserves the original IP header, allowing the source IP to be seen by the receiving application.
   • BTransport mode is more secure because it encrypts the entire IP packet.
   • CTransport mode is faster because it does not add an IPsec header.
   • DTransport mode provides better encryption strength than tunnel mode.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In outbound IPsec processing, what is the purpose of adding the IPsec header after encryption?

   • ATo authenticate the outer IP header.
   • BTo compress the packet to reduce its size.
   • CTo encrypt the packet a second time for additional security.
   • DTo allow the receiving peer to decrypt the packet using the SPI.
   Reveal Solution Discussion Select an answer first