Dynamic Gateways JN0-637 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a primary benefit of using a dynamic IPsec VPN gateway in Junos OS?

   • AIt allows the gateway to accept connections from remote peers whose IP addresses are not known in advance.
   • BIt eliminates the need for security policies because the gateway automatically permits all traffic.
   • CIt automatically configures routing protocols over the VPN tunnel.
   • DIt provides a static IP address for the remote peer to connect to.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A hub-and-spoke VPN uses a dynamic gateway on the hub. The spokes have dynamic IPs and initiate the tunnels. The hub uses a single st0 interface. Recently, a new spoke was added, and its traffic is not being routed correctly. The engineer suspects that the hub's routing table does not have a route to the new spoke's subnet. Which configuration change is needed on the hub to ensure that return traffic reaches the new spoke?

   • AAdd a static route on the hub for the new spoke's subnet, pointing to the st0 interface.
   • BAdd a security policy on the hub that permits traffic to the new spoke's subnet.
   • CChange the dynamic gateway to use a static peer IP for the new spoke.
   • DAdd a traffic selector on the hub for the new spoke's subnet.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When troubleshooting a dynamic gateway that is not establishing an IKE phase 1, which log file should you examine first?

   • AThe messages log file.
   • BThe security log file.
   • CThe IKE log file.
   • DThe routing log file.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a policy-based VPN using a dynamic gateway, what defines which traffic is protected by the tunnel?

   • AThe st0 interface configuration.
   • BThe security policy that references the VPN.
   • CThe IKE policy's encryption algorithm.
   • DThe dynamic gateway's preshared key.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company uses a policy-based dynamic VPN to connect a small remote office to the main site. The remote office has a dynamic IP. The VPN must only carry traffic between the remote office's 192.168.10.0/24 subnet and the main site's 10.0.0.0/16 subnet. Which configuration is required on the hub to enforce this traffic restriction?

   • AA static route on the hub pointing to the remote office's subnet via the dynamic gateway.
   • BA security policy that permits traffic from 192.168.10.0/24 to 10.0.0.0/16 and denies all other traffic.
   • CA firewall filter applied to the st0 interface that limits traffic to the two subnets.
   • DA traffic selector in the IKE/IPsec configuration that matches source 192.168.10.0/24 and destination 10.0.0.0/16.
   Reveal Solution Discussion Select an answer first