Overlapping IP Addresses JN0-637 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does overlapping IP addressing affect routing decisions in an IPsec VPN?

   • AIt has no effect on routing because IPsec encrypts the addresses.
   • BIt creates ambiguous routes because the same destination network exists on multiple VPN peers.
   • CIt forces the VPN to use dynamic routing protocols to resolve the conflict.
   • DIt causes the VPN to drop all traffic because the addresses are invalid.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A network administrator is configuring a site-to-site VPN between two offices that both use the 192.168.1.0/24 subnet. The administrator has configured NAT on the gateways to translate source addresses. However, users at one office cannot reach the other office's server. The administrator runs 'show security nat translation' and sees no translations. What is the most likely cause?

   • ANAT-T is not enabled, so the IPsec packets are being dropped.
   • BThe NAT rule is not matching the traffic because the source or destination addresses in the rule are incorrect.
   • CThe routing table is missing a route to the remote subnet.
   • DThe IPsec tunnel is down, so traffic is not being sent through the VPN.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company has a site-to-site IPsec VPN between two offices. Both offices use the same private subnet 10.10.10.0/24. They have implemented NAT on the VPN gateways to translate source addresses. However, the VPN tunnel fails to establish. The gateways are behind NAT devices. What configuration is most likely missing?

   • AChange the IPsec encapsulation from ESP to AH.
   • BConfigure a static route on each gateway pointing to the remote subnet via the tunnel interface.
   • CIncrease the IKE SA lifetime to allow more time for negotiation.
   • DEnable NAT-T on both VPN gateways to allow IPsec traffic to traverse the NAT devices.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which command would you use to verify that NAT translations are being applied correctly in an overlapping IP address VPN scenario?

   • Ashow security ike security-associations
   • Bshow security nat translations
   • Cshow route
   • Dshow security ipsec security-associations
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   Two branch offices both use 192.168.1.0/24. They connect to a central hub via IPsec VPNs. The hub needs to allow each branch to access a specific server at the other branch. The hub has a unique public IP for each VPN tunnel. What is the most scalable NAT configuration on the hub to enable branch-to-branch communication?

   • AConfigure NAT-T on the hub and use UDP encapsulation for all VPN traffic.
   • BConfigure dynamic NAT with a single pool on the hub for all branch traffic.
   • CConfigure static NAT on the hub for each branch's source addresses, translating them to unique ranges (e.g., 10.0.1.0/24 for branch A, 10.0.2.0/24 for branch B).
   • DConfigure a static route on the hub for each branch's 192.168.1.0/24 network, pointing to the respective tunnel interface.
   Reveal Solution Discussion Select an answer first