A security analyst needs to detect anomalous traffic patterns within an EVPN-VXLAN fabric, such as a sudden increase in broadcast traffic or a host sending excessive unicast traffic. Which monitoring tool should they use to gain visibility into the VXLAN encapsulated traffic?

sFlow on the physical interfaces of the VTEPs

Syslog messages from the EVPN control plane

NetFlow on the VXLAN logical interfaces

SNMP polling of VTEP CPU utilization

A data center operator has deployed EVPN-VXLAN to support multi-tenant workloads. They notice that a VM in tenant A is sending frames with the MAC address of a VM in tenant B. This is causing traffic destined for tenant B's VM to be delivered to the attacker's VM. Which two actions should the operator take to mitigate this specific attack? (Choose two.)

Configure MAC move limiting on the Ethernet segment and enable duplicate MAC detection in EVPN.

Apply a firewall filter on the VXLAN tunnel interface that drops all traffic with a source MAC that is not in the local MAC table.

Enable MAC learning on the VXLAN VTEPs and rely on the EVPN control plane to detect duplicate MAC addresses.

Disable ARP learning on the VXLAN interfaces to prevent the attacker from learning the victim's MAC address.

A network operations team is using telemetry to monitor an EVPN-VXLAN fabric for security anomalies. They want to detect a DDoS attack that is generating a high volume of VXLAN encapsulated traffic from a specific VTEP. Which telemetry data should they analyze?

Flow data from the VXLAN logical interfaces

Interface counters on the physical interfaces

What is the primary purpose of using different VXLAN Network Identifiers (VNIs) in a multi-tenant data center?

To isolate tenant traffic and provide separate Layer 2 domains

To encrypt traffic between tenants

To reduce the number of MAC addresses in the forwarding table

To improve the performance of the underlay network

A security engineer is troubleshooting a BUM storm in an EVPN-VXLAN fabric. They notice that a single VM is generating a large amount of broadcast traffic, which is being replicated to all VTEPs in the segment. Which mechanism should they use to limit the impact of this traffic?

Configure storm control on the VXLAN logical interface

Use MACsec to encrypt the broadcast traffic

Disable the VXLAN segment for that VM

Increase the MTU on the VTEPs to handle more traffic

Juniper NetworksCertified Professional, Security (JNCIP-SEC)

Domain 3Objective 5

Ethernet VPN-Virtual Extensible LAN (EVPN-VXLAN) Security JN0-637 Practice Questions (Page 6)

Part of the Layer 2 Security domain, which makes up ~14% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

Questions 26–30

26application · medium
A security analyst needs to detect anomalous traffic patterns within an EVPN-VXLAN fabric, such as a sudden increase in broadcast traffic or a host sending excessive unicast traffic. Which monitoring tool should they use to gain visibility into the VXLAN encapsulated traffic?
Select an answer first
27application · medium
A data center operator has deployed EVPN-VXLAN to support multi-tenant workloads. They notice that a VM in tenant A is sending frames with the MAC address of a VM in tenant B. This is causing traffic destined for tenant B's VM to be delivered to the attacker's VM. Which two actions should the operator take to mitigate this specific attack? (Choose two.)
Select an answer first
28expert · hard
A network operations team is using telemetry to monitor an EVPN-VXLAN fabric for security anomalies. They want to detect a DDoS attack that is generating a high volume of VXLAN encapsulated traffic from a specific VTEP. Which telemetry data should they analyze?
Select an answer first
29foundation · easy
What is the primary purpose of using different VXLAN Network Identifiers (VNIs) in a multi-tenant data center?
Select an answer first
30application · medium
A security engineer is troubleshooting a BUM storm in an EVPN-VXLAN fabric. They notice that a single VM is generating a large amount of broadcast traffic, which is being replicated to all VTEPs in the segment. Which mechanism should they use to limit the impact of this traffic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-637

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-637” is a trademark of its owner, used for identification only.