Dynamic Gateways JN0-637 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A network engineer is configuring a route-based dynamic VPN on a Junos device. The remote peer has a dynamic IP and will initiate the connection. The engineer has configured the dynamic gateway and the st0 interface. What else is required to ensure that traffic from the local network to the remote network is sent through the tunnel?

   • AA NAT rule to translate the local traffic before sending it through the tunnel.
   • BA traffic selector in the IKE configuration that matches the remote network.
   • CA static route on the local device pointing to the remote network via the st0 interface.
   • DA security policy that permits traffic from the local network to the remote network.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which Junos CLI command can be used to view the status of dynamic IPsec VPN tunnels?

   • Ashow security ike security-associations
   • Bshow interfaces st0
   • Cshow security ipsec security-associations
   • Dshow security policies
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is setting up a dynamic VPN for a remote site that uses a preshared key. The remote site's IP is dynamic. The hub has a dynamic gateway configured. During troubleshooting, the engineer finds that the IKE SA is not establishing. The 'show security ike security-associations' command shows no SA. Which configuration is most likely the cause?

   • AThe security policy is not configured to permit IKE traffic.
   • BThe remote site's IP is not in the hub's static route.
   • CThe preshared key is not configured on the hub's dynamic gateway.
   • DThe st0 interface is not configured with an IP address.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A network engineer is troubleshooting a dynamic route-based VPN where the tunnel is up but traffic is not passing. The 'show security ipsec security-associations' command shows an active SA. The engineer checks the security policy and finds that it permits the traffic. What is the next most likely cause to investigate?

   • AThe st0 interface is not configured with an IP address.
   • BThe routing table does not have a route to the remote network via the st0 interface.
   • CThe preshared key is incorrect.
   • DThe IKE SA has expired.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In a route-based VPN using a dynamic gateway, how is traffic typically directed into the tunnel?

   • ABy a dynamic routing protocol that automatically installs routes to the tunnel.
   • BBy an IKE policy that defines the traffic selectors.
   • CBy a security policy that matches the tunnel's traffic selectors.
   • DBy a static route that points to the st0 interface.
   Reveal Solution Discussion Select an answer first