Routing with IPsec JN0-637 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which Junos traceoptions statement is used to enable logging for routing protocol events that may affect IPsec tunnel routing?

   • Aset interfaces st0.0 traceoptions file st0-log
   • Bset system syslog file routing-log
   • Cset security ipsec traceoptions file ipsec-log
   • Dset routing-options traceoptions file routing-log
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   You are troubleshooting an IPsec tunnel that is up, but traffic from the local LAN is not being encrypted. You have verified that the security policy is correct. Which command would you use to verify that the traffic is being routed into the tunnel?

   • Ashow route
   • Bshow interfaces terse
   • Cshow security ipsec security-associations
   • Dshow security flow session
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which Junos feature allows you to selectively steer traffic into an IPsec tunnel based on source or destination address?

   • ANAT rule with a 'then route' action
   • BFirewall filter applied to the st0 interface
   • CIPsec security association (SA) configuration
   • DRouting policy with a 'then next-hop' action
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   You have two IPsec tunnels to a remote site: one over a primary MPLS link and one over a backup Internet link. You have configured static routes for the remote LAN (10.10.0.0/16) with the primary route having a preference of 5 and the backup route having a preference of 10. The primary tunnel goes down, but traffic is not failing over to the backup tunnel. What is the most likely reason?

   • AThe backup route is not configured with a valid next hop.
   • BThe backup tunnel is not in the same routing instance.
   • CThe backup route has a higher preference, so it is not preferred.
   • DThe primary route is still in the routing table because the tunnel interface is still up.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   You have an IPsec tunnel between two sites, and you want to send traffic from a specific subnet (192.168.10.0/24) to the remote site through the tunnel. You have configured a static route for the remote network via the tunnel interface. However, traffic from other subnets is also being sent through the tunnel. What is the most likely reason?

   • AThe static route is too broad and matches traffic from all subnets.
   • BThe security policy permits all traffic to the remote network.
   • CThe routing table has a default route that sends all traffic to the tunnel.
   • DThe tunnel interface is in the same zone as the other subnets.
   Reveal Solution Discussion Select an answer first