Hub-And-Spoke VPNs JN0-637 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network engineer is troubleshooting a hub-and-spoke VPN where a new spoke cannot establish an IPsec tunnel to the hub. The hub's IKE policy requires pre-shared keys, and the spoke is configured with a pre-shared key. The engineer sees IKE SA negotiation failing at the authentication phase. What is the most likely cause?

   • AThe IPsec SA lifetime is set too short on the spoke.
   • BThe hub's tunnel interface is not assigned an IP address.
   • CThe pre-shared key on the spoke does not match the hub's key.
   • DThe spoke's security policy does not permit traffic to the hub's public IP.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is designing a hub-and-spoke VPN with two hubs for redundancy. Each hub is a physical appliance with limited CPU. The network team expects high traffic volumes between spokes. They are considering using a full mesh of IPsec tunnels between spokes to offload traffic from the hubs. What is the primary trade-off of this approach?

   • AReduced security because traffic does not pass through the hub's security policies.
   • BIncreased latency because traffic must traverse more hops.
   • CIncreased complexity and number of tunnels, but reduced load on the hubs.
   • DSimplified routing because each spoke only needs a route to the hub.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which factor is a primary scalability bottleneck in a hub-and-spoke VPN architecture?

   • AThe routing protocol convergence time
   • BThe bandwidth of the WAN links at the spoke sites
   • CThe number of security policies configured on the spokes
   • DThe number of IPsec tunnels the hub can terminate and process
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is expanding its hub-and-spoke VPN from 50 to 200 spokes. The hub is a single device with moderate CPU and memory. The network team is concerned about the hub's ability to handle the increased number of tunnels and the associated processing. Which factor is most likely to become a bottleneck?

   • AThe spokes' WAN bandwidth, as each spoke must send all traffic to the hub.
   • BThe IKE SA lifetime, as shorter lifetimes increase rekeying overhead on the hub.
   • CThe routing protocol's convergence time, as more spokes mean more routes to propagate.
   • DThe hub's CPU and memory, as it must process encryption/decryption and routing for all inter-spoke traffic.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A network engineer is troubleshooting a hub-and-spoke VPN where spoke A can ping the hub, but cannot ping spoke B. Both spokes have IPsec tunnels to the hub that are up. The engineer checks the routing table on the hub and sees routes for both spoke A and spoke B. What is the most likely cause of the issue?

   • AThe hub is not configured to forward traffic between the two tunnels.
   • BThe IKE SA between spoke A and the hub has expired.
   • CThe IPsec SA between the hub and spoke B is not established.
   • DThe security policy on spoke B does not permit traffic from spoke A's subnet.
   Reveal Solution Discussion Select an answer first