A network engineer is troubleshooting a hub-and-spoke VPN where a spoke cannot establish an IPsec tunnel to the hub. The spoke's configuration has the correct pre-shared key and IKE policies. The engineer sees that the IKE SA is established, but the IPsec SA is not. What is the most likely cause?

The spoke's tunnel interface is not assigned an IP address.

The hub's security policy does not permit IPsec traffic from the spoke.

The IPsec proposal on the spoke does not match the hub's IPsec proposal.

The IKE SA lifetime is set too short on the spoke.

In a hub-and-spoke VPN, what is the result of a successful IKE phase 2 negotiation?

The verification of the peer's identity using digital certificates

The establishment of an ISAKMP security association

The exchange of routing table information between the hub and the spoke

The creation of an IPsec security association that defines the encryption and authentication for data traffic

In a hub-and-spoke VPN, a spoke sends a packet to another spoke. The hub receives the packet, decapsulates it, and then needs to forward it to the destination spoke. What must the hub do to forward the packet correctly?

Forward the packet out the same interface it came in on, without any additional processing.

Broadcast the packet to all spokes and let the destination spoke accept it.

Decapsulate the packet and forward it as plaintext to the destination spoke's public IP.

Look up the destination IP in its routing table and then encapsulate the packet in a new IPsec tunnel to the destination spoke.

A network engineer is troubleshooting a hub-and-spoke VPN where inter-spoke traffic is failing. The engineer captures packets on the hub's external interface and sees encrypted packets arriving from spoke A. The hub decapsulates the packets and then sends them out the same interface to spoke B. What is the most likely issue?

The hub's tunnel interface is not configured with an IP address.

The hub's security policy is blocking traffic from spoke A to spoke B.

The IPsec SA between the hub and spoke B is not established.

The hub is not performing a routing lookup on the decapsulated packet's destination IP.

Juniper NetworksCertified Professional, Security (JNCIP-SEC)

Domain 5Objective 1

Hub-And-Spoke VPNs JN0-637 Practice Questions (Page 5)

Part of the Advanced IPsec VPNs domain, which makes up ~20% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

7concepts

Questions 21–24

21expert · hard
A network engineer is troubleshooting a hub-and-spoke VPN where a spoke cannot establish an IPsec tunnel to the hub. The spoke's configuration has the correct pre-shared key and IKE policies. The engineer sees that the IKE SA is established, but the IPsec SA is not. What is the most likely cause?
Select an answer first
22foundation · easy
In a hub-and-spoke VPN, what is the result of a successful IKE phase 2 negotiation?
Select an answer first
23application · medium
In a hub-and-spoke VPN, a spoke sends a packet to another spoke. The hub receives the packet, decapsulates it, and then needs to forward it to the destination spoke. What must the hub do to forward the packet correctly?
Select an answer first
24application · hard
A network engineer is troubleshooting a hub-and-spoke VPN where inter-spoke traffic is failing. The engineer captures packets on the hub's external interface and sees encrypted packets arriving from spoke A. The hub decapsulates the packets and then sends them out the same interface to spoke B. What is the most likely issue?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to JN0-637

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-637” is a trademark of its owner, used for identification only.

Hub-And-Spoke VPNs JN0-637 Practice Questions (Page 5)

Questions 21–24

A network engineer is troubleshooting a hub-and-spoke VPN where a spoke cannot establish an IPsec tunnel to the hub. The spoke's configuration has the correct pre-shared key and IKE policies. The engineer sees that the IKE SA is established, but the IPsec SA is not. What is the most likely cause?

In a hub-and-spoke VPN, what is the result of a successful IKE phase 2 negotiation?

In a hub-and-spoke VPN, a spoke sends a packet to another spoke. The hub receives the packet, decapsulates it, and then needs to forward it to the destination spoke. What must the hub do to forward the packet correctly?

Keep studying — Advanced IPsec VPNs