A security analyst is investigating a potential ARP spoofing attack in an EVPN-VXLAN fabric. They notice that a VM is sending ARP replies claiming to be the default gateway. The VTEPs are configured with EVPN, but ARP suppression is not enabled. Which mitigation should they implement?

Use MACsec to encrypt ARP traffic

Disable ARP on the VXLAN interfaces

Increase the ARP cache timeout on the VMs

Enable ARP suppression on the VTEPs

Which protocol is commonly used for IPsec key management and tunnel establishment in an EVPN-VXLAN deployment?

Open Shortest Path First (OSPF)

Link Layer Discovery Protocol (LLDP)

A financial services company is deploying EVPN-VXLAN in a data center. They require that traffic between two VTEPs be encrypted and authenticated at the Ethernet layer to protect against eavesdropping and tampering on the underlay network. Which technology should they implement on the VTEP-to-VTEP links?

VXLAN with a VNI-specific encryption profile

IPsec in tunnel mode between the VTEPs

MACsec on the physical interfaces connecting the VTEPs

Secure Shell (SSH) tunneling for VXLAN traffic

A service provider is deploying EVPN-VXLAN to provide multi-tenant hosting. They need to filter east-west traffic between VMs in different tenants, but they want to avoid hair-pinning traffic to a central firewall. Which architecture should they use?

Use ACLs on the core switches to block inter-VNI traffic

Place a firewall in the underlay and filter based on VXLAN VNI

Use distributed firewall policies on the VTEPs to filter traffic between VXLAN segments

Deploy a firewall as a service behind a service VRF and route all inter-tenant traffic through it

A large enterprise is deploying EVPN-VXLAN with multiple tenants. They need to enforce security policies for both north-south and east-west traffic. The security team wants to use a centralized firewall for north-south traffic, but they are concerned about the performance impact of hair-pinning east-west traffic. Which architecture should they implement?

Place a firewall in each tenant's VRF and route all traffic through it

Deploy distributed firewall policies on VTEPs for east-west traffic and a centralized firewall for north-south traffic

Use a firewall in the underlay to filter all VXLAN traffic based on VNI

Use a centralized firewall for all traffic, including east-west, to ensure consistent policy enforcement

Juniper NetworksCertified Professional, Security (JNCIP-SEC)

Domain 3Objective 5

Ethernet VPN-Virtual Extensible LAN (EVPN-VXLAN) Security JN0-637 Practice Questions (Page 2)

Part of the Layer 2 Security domain, which makes up ~14% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

Questions 6–10

6expert · hard
A security analyst is investigating a potential ARP spoofing attack in an EVPN-VXLAN fabric. They notice that a VM is sending ARP replies claiming to be the default gateway. The VTEPs are configured with EVPN, but ARP suppression is not enabled. Which mitigation should they implement?
Select an answer first
7foundation · easy
Which protocol is commonly used for IPsec key management and tunnel establishment in an EVPN-VXLAN deployment?
Select an answer first
8application · medium
A financial services company is deploying EVPN-VXLAN in a data center. They require that traffic between two VTEPs be encrypted and authenticated at the Ethernet layer to protect against eavesdropping and tampering on the underlay network. Which technology should they implement on the VTEP-to-VTEP links?
Select an answer first
9application · medium
A service provider is deploying EVPN-VXLAN to provide multi-tenant hosting. They need to filter east-west traffic between VMs in different tenants, but they want to avoid hair-pinning traffic to a central firewall. Which architecture should they use?
Select an answer first
10expert · hard
A large enterprise is deploying EVPN-VXLAN with multiple tenants. They need to enforce security policies for both north-south and east-west traffic. The security team wants to use a centralized firewall for north-south traffic, but they are concerned about the performance impact of hair-pinning east-west traffic. Which architecture should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-637

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-637” is a trademark of its owner, used for identification only.

Ethernet VPN-Virtual Extensible LAN (EVPN-VXLAN) Security JN0-637 Practice Questions (Page 2)

Questions 6–10

A security analyst is investigating a potential ARP spoofing attack in an EVPN-VXLAN fabric. They notice that a VM is sending ARP replies claiming to be the default gateway. The VTEPs are configured with EVPN, but ARP suppression is not enabled. Which mitigation should they implement?

Which protocol is commonly used for IPsec key management and tunnel establishment in an EVPN-VXLAN deployment?

A service provider is deploying EVPN-VXLAN to provide multi-tenant hosting. They need to filter east-west traffic between VMs in different tenants, but they want to avoid hair-pinning traffic to a central firewall. Which architecture should they use?

Keep studying — Layer 2 Security