Dynamic Gateways JN0-637 Practice Questions (Page 5)

Questions 21–22

1. 21application · medium

   A network engineer is troubleshooting a dynamic route-based VPN. The tunnel is up, but traffic is not passing. The 'show security ipsec security-associations' command shows an active SA. Which command should the engineer use to check if the security policy is permitting the traffic?

   • Ashow security policies
   • Bshow security ike security-associations
   • Cshow security ipsec statistics
   • Dshow security flow session
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A regional bank is deploying a route-based IPsec VPN to connect 120 branch offices to the headquarters. Each branch has a dynamic public IP address from its local ISP. The security team wants to minimize configuration on the hub and avoid reconfiguring the hub whenever a branch's IP changes. Which configuration approach should the security engineer use on the hub?

   • AConfigure a static route-based VPN with a fixed peer IP and a static route to the branch subnet.
   • BConfigure a static VPN with the branch's current IP and a script to update the configuration nightly.
   • CConfigure a policy-based VPN with a dynamic gateway and a single traffic selector covering all branch subnets.
   • DConfigure a dynamic IKE gateway with a wildcard peer address and a route-based VPN, using a unique IKE ID per branch.
   Reveal Solution Discussion Select an answer first