A network engineer is troubleshooting a hub-and-spoke VPN where OSPF is used. The hub and spokes are in the same area. The engineer notices that the hub is not advertising routes from one spoke to another. The OSPF adjacencies are up, and the spokes can ping the hub. What is the most likely cause?

The spokes are in different OSPF areas, and the hub is not an ABR.

The hub's OSPF cost to the destination spoke is higher than the cost to the source spoke.

The hub's OSPF interface is configured as passive, preventing it from sending or receiving OSPF updates.

The hub's route to the destination spoke is not in its routing table.

When troubleshooting a hub-and-spoke VPN, which command is most useful for verifying the state of the IPsec security associations on a Junos device?

show security ipsec security-associations

show configuration security policies

A company is deploying a hub-and-spoke IPsec VPN to connect 50 branch offices. Each branch has a single WAN link and needs to reach resources in other branches. The security team wants to minimize the number of IPsec tunnels and simplify routing. Which design should the network engineer implement?

Create a full mesh of IPsec tunnels between all branches.

Establish IPsec tunnels from each branch to a central hub and route inter-branch traffic through the hub.

Configure each branch to use a dynamic routing protocol directly with every other branch.

Use a single IPsec tunnel that all branches share by using the same tunnel identifier.

What is the purpose of configuring a backup tunnel in a hub-and-spoke VPN?

To increase the bandwidth available between the hub and a spoke

To allow the hub to monitor the health of the spoke

To encrypt traffic with a stronger algorithm than the primary tunnel

To provide a secondary path for traffic if the primary tunnel fails

A company has a hub-and-spoke VPN with a single hub. To provide high availability, the network team wants to add a second hub. The spokes should use the primary hub normally and fail over to the secondary hub if the primary becomes unreachable. What is the most effective way to implement this?

Configure a single IPsec tunnel from each spoke to a virtual IP address that is shared between the two hubs.

Use a single IPsec tunnel from each spoke to the primary hub, and rely on the hub's routing protocol to redirect traffic to the secondary hub.

Configure each spoke with two IPsec tunnels, one to each hub, and use a routing protocol to prefer the primary hub.

Configure the spokes to use the secondary hub only for management traffic.

Juniper NetworksCertified Professional, Security (JNCIP-SEC)

Domain 5Objective 1

Hub-And-Spoke VPNs JN0-637 Practice Questions (Page 2)

Part of the Advanced IPsec VPNs domain, which makes up ~20% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

7concepts

Questions 6–10

6expert · hard
A network engineer is troubleshooting a hub-and-spoke VPN where OSPF is used. The hub and spokes are in the same area. The engineer notices that the hub is not advertising routes from one spoke to another. The OSPF adjacencies are up, and the spokes can ping the hub. What is the most likely cause?
Select an answer first
7foundation · easy
When troubleshooting a hub-and-spoke VPN, which command is most useful for verifying the state of the IPsec security associations on a Junos device?
Select an answer first
8application · medium
A company is deploying a hub-and-spoke IPsec VPN to connect 50 branch offices. Each branch has a single WAN link and needs to reach resources in other branches. The security team wants to minimize the number of IPsec tunnels and simplify routing. Which design should the network engineer implement?
Select an answer first
9foundation · easy
What is the purpose of configuring a backup tunnel in a hub-and-spoke VPN?
Select an answer first
10application · hard
A company has a hub-and-spoke VPN with a single hub. To provide high availability, the network team wants to add a second hub. The spokes should use the primary hub normally and fail over to the secondary hub if the primary becomes unreachable. What is the most effective way to implement this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-637

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-637” is a trademark of its owner, used for identification only.