In an EVPN-VXLAN data center, what is the typical role of a firewall in the architecture?

To manage the EVPN control plane and distribute MAC routes

To encrypt VXLAN tunnels between VTEPs

To provide routing between VTEPs in the underlay

To filter traffic between workloads (east-west) and between the data center and external networks (north-south)

Which of the following is a best practice for securing the EVPN control plane in an EVPN-VXLAN deployment?

Disabling all routing protocols to prevent attacks

Using the same password for all VTEPs to simplify management

Allowing all BGP peers to connect to the route reflector

Enabling BGP authentication (e.g., TCP MD5 or BGP TTL security) on EVPN sessions

An enterprise is extending an EVPN-VXLAN fabric across two data centers connected by a service provider MPLS network. They need to encrypt the VXLAN overlay traffic between the VTEPs in each data center. The solution must support dynamic key management and be able to scale to many VTEPs. Which approach should they choose?

Use VXLAN with a built-in encryption feature

Use IPsec with IKEv2 and certificates for authentication between VTEPs

Configure static IPsec security associations (SAs) between each pair of VTEPs

Enable MACsec on the WAN interfaces of the edge routers

What is a recommended best practice for securing VXLAN VTEP configuration?

Using loopback interfaces for VTEP source addresses and restricting which IP addresses can be used as VXLAN source addresses

Configuring VTEPs with the same IP address for redundancy

Using VNI 0 for all tenants to simplify configuration

Disabling all firewall filters on VTEP interfaces to avoid performance impact

A network administrator is configuring access control on an EVPN-VXLAN fabric. They need to block traffic from a specific VM to another VM within the same VXLAN segment, but allow all other traffic. Which configuration should they apply?

Use a MACsec policy to block traffic from the specific VM

Apply an ACL on the physical interface of the VTEP that matches the inner source and destination IP addresses

Apply a firewall filter on the VXLAN logical interface that matches the inner source and destination IP addresses

Configure a route policy on the EVPN control plane to drop routes for the specific VM

Juniper NetworksCertified Professional, Security (JNCIP-SEC)

Domain 3Objective 5

Ethernet VPN-Virtual Extensible LAN (EVPN-VXLAN) Security JN0-637 Practice Questions (Page 4)

Part of the Layer 2 Security domain, which makes up ~14% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

Questions 16–20

16foundation · easy
In an EVPN-VXLAN data center, what is the typical role of a firewall in the architecture?
Select an answer first
17foundation · easy
Which of the following is a best practice for securing the EVPN control plane in an EVPN-VXLAN deployment?
Select an answer first
18application · medium
An enterprise is extending an EVPN-VXLAN fabric across two data centers connected by a service provider MPLS network. They need to encrypt the VXLAN overlay traffic between the VTEPs in each data center. The solution must support dynamic key management and be able to scale to many VTEPs. Which approach should they choose?
Select an answer first
19foundation · easy
What is a recommended best practice for securing VXLAN VTEP configuration?
Select an answer first
20application · medium
A network administrator is configuring access control on an EVPN-VXLAN fabric. They need to block traffic from a specific VM to another VM within the same VXLAN segment, but allow all other traffic. Which configuration should they apply?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-637

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-637” is a trademark of its owner, used for identification only.