What is the role of a traffic selector in IPsec?

It specifies the lifetime of the SA.

It defines which packets are protected by a specific security association.

It determines the encryption algorithm used for the SA.

It provides the SPI value for the SA.

A junior engineer is learning about IPsec traffic processing on Junos devices. The engineer asks: 'When a packet arrives on the security device and is destined for a remote network via an IPsec VPN, what is the correct sequence of operations for outbound processing?'

Policy lookup, SA lookup, encryption, encapsulation, transmit.

Policy lookup, encapsulation, encryption, SA lookup, transmit.

SA lookup, policy lookup, encapsulation, encryption, transmit.

Encryption, policy lookup, SA lookup, encapsulation, transmit.

A security engineer is investigating a potential replay attack on an IPsec VPN. The engineer wants to verify that anti-replay is working correctly on the Junos device. Which command and output field should the engineer check?

'show security ipsec security-associations' and check the 'Sequence number' field.

'show security ipsec security-associations' and check the 'Anti-replay' field for 'enabled'.

'show security ipsec statistics' and check the 'Anti-replay failures' counter.

'show security flow session' and check the 'Anti-replay' field for each session.

What triggers the rekeying of an IPsec security association?

A change in the traffic selectors.

The SPI value reaching a certain threshold.

Expiration of the SA lifetime, either by time or byte count.

A packet loss event on the tunnel.

A Junos device has two IPsec VPNs configured to the same remote peer. VPN1 has traffic selectors 10.1.0.0/16 to 10.2.0.0/16, and VPN2 has traffic selectors 10.1.0.0/24 to 10.2.0.0/24. A packet from 10.1.0.5 to 10.2.0.5 is sent. Which SA will be used for this packet?

VPN2, because it has a more specific traffic selector.

Both VPNs will be used, and the packet will be duplicated.

The packet will be dropped because of an ambiguous match.

VPN1, because it has a broader traffic selector.

Juniper NetworksCertified Specialist, Security (JNCIS-SEC)

Domain 2Objective 2

IPsec Traffic Processing JN0-336 Practice Questions (Page 5)

Part of the IPsec VPN domain, which makes up ~16% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

10concepts

Questions 21–25

21foundation · easy
What is the role of a traffic selector in IPsec?
Select an answer first
22application · medium
A junior engineer is learning about IPsec traffic processing on Junos devices. The engineer asks: 'When a packet arrives on the security device and is destined for a remote network via an IPsec VPN, what is the correct sequence of operations for outbound processing?'
Select an answer first
23application · medium
A security engineer is investigating a potential replay attack on an IPsec VPN. The engineer wants to verify that anti-replay is working correctly on the Junos device. Which command and output field should the engineer check?
Select an answer first
24foundation · easy
What triggers the rekeying of an IPsec security association?
Select an answer first
25application · medium
A Junos device has two IPsec VPNs configured to the same remote peer. VPN1 has traffic selectors 10.1.0.0/16 to 10.2.0.0/16, and VPN2 has traffic selectors 10.1.0.0/24 to 10.2.0.0/24. A packet from 10.1.0.5 to 10.2.0.5 is sent. Which SA will be used for this packet?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-336

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-336” is a trademark of its owner, used for identification only.