单选题Which statement is true regarding IPsec VPNs?（）AThere are five phases of IKE negotiation.BThere are two phases of IKE negotiation.CIPsec VPN tunnels are not supported on SRX Series devices.DIPsec VPNs require a tunnel PIC in SRX Series devices.
单选题
Which statement is true regarding IPsec VPNs?（）
A
There are five phases of IKE negotiation.
B
There are two phases of IKE negotiation.
C
IPsec VPN tunnels are not supported on SRX Series devices.
D
IPsec VPNs require a tunnel PIC in SRX Series devices.
参考解析
解析：
暂无解析
相关考题：
You are configuring an SRX210 as a firewall enforcer that will tunnel IPsec traffic from several Junos Pulse users.Which two parameters must you configure on the SRX210?() A. access profileB. IKE parametersC. tunneled interfaceD. redirect policy
Which statement is true regarding IPsec VPNs?() A. There are five phases of IKE negotiation.B. There are two phases of IKE negotiation.C. IPsec VPN tunnels are not supported on SRX Series devices.D. IPsec VPNs require a tunnel PIC in SRX Series devices.
Which statement is true regarding NAT?() A. NAT is not supported on SRX Series devices.B. NAT requires special hardware on SRX Series devices.C. NAT is processed in the control plane.D. NAT is processed in the data plane.
An IPsec tunnel is established on an SRX Series Gateway on an interface whose IP address was obtained using DHCP.Which two statements are true? ()(Choose two.) A. Only main mode can be used for IKE negotiationB. A local-identity must be definedC. It must be the initiator for IKED. A remote-identity must be defined
Which statement contains the correct parameters for a route－based IPsec VPN?() A. [edit security ipsec] user@host# show proposal ike1-proposal { protocol esp; authentication-algorithm hmac-md5-96; encryption-algorithm 3des-cbc; lifetime-seconds 3200; }policy ipsec1-policy { perfect-forward-secrecy { keys group2; } proposals ike1-proposal; } vpn VpnTunnel { interface ge-0/0/1.0; ike { gateway ike1-gateway; ipsec-policy ipsec1-policy; } establish-tunnels immediately; }B. [edit security ipsec] user@host# show proposal ike1-proposal { protocol esp; authentication-algorithm hmac-md5-96; encryption-algorithm 3des-cbc; lifetime-seconds 3200; } policy ipsec1-policy { perfect-forward-secrecy { keys group2; } proposals ike1-proposal; } vpn VpnTunnel { interface st0.0; ike { gateway ike1-gateway; ipsec-policy ipsec1-policy; } establish-tunnels immediately; }C. [edit security ipsec] user@host# show proposal ike1-proposal { protocol esp; authentication-algorithm hmac-md5-96; encryption-algorithm 3des-cbc; lifetime-seconds 3200;} policy ipsec1-policy { perfect-forward-secrecy { keys group2; } proposals ike1-proposal; } vpn VpnTunnel { bind-interface ge-0/0/1.0; ike { gateway ike1-gateway; ipsec-policy ipsec1-policy; } establish-tunnels immediately; }D. [edit security ipsec] user@host# show proposal ike1-proposal { protocol esp; authentication-algorithm hmac-md5-96; encryption-algorithm 3des-cbc; lifetime-seconds 3200; }policy ipsec1-policy { perfect-forward-secrecy { keys group2; } proposals ike1-proposal; } vpn VpnTunnel { bind-interface st0.0; ike { gateway ike1-gateway; ipsec-policy ipsec1-policy; } establish-tunnels immediately; }
IPSec VPN is a widely-acknowledged solution for enterprise network. Which three IPsec VPNstatements are true？（）A、IKE keepalives are unidirectional and sent every ten secondsB、IPsec uses the Encapsulating Security Protocol （ESP） or the Authentication Header （AH）protocol for exchanging keysC、To establish IKE SA, main mode utilizes six packets while aggressive mode utilizes only threepacketsD、IKE uses the Diffie-Hellman algorithm to generate symmetrical keys to be used by IPsec peers
Which three features are benefits of using GRE tunnels in conjunction with IPsec for building site-to-site VPNs？（）A、allows dynamic routing over the tunnelB、supports multi-protocol （non-IP） traffic over the tunnelC、reduces IPsec headers overhead since tunnel mode is usedD、simplifies the ACL used in the crypto mapE、uses Virtual Tunnel Interface （VTI） to simplify the IPsec VPN configuration
What is not a difference between VPN tunnel authentication and per-user authentication?（）A、VPN tunnel authentication is part of the IKE specification. B、VPN tunnel authentication does not control which end user can use the IPSec SA (VPN tunnel).C、User authentication is used to control access for a specific user ID, and can be used with or without a VPN tunnel for network access authorization. D、802.1X with EAP-TLS (X.509 certificates) can be used to authenticate an IPSec tunnel.
Which statement is true regarding NAT?（）A、NAT is not supported on SRX Series devices.B、NAT requires special hardware on SRX Series devices.C、NAT is processed in the control plane.D、NAT is processed in the data plane.
Which two configuration elements are required for a policy-based VPN？（）A、IKE gatewayB、secure tunnel interfaceC、security policy to permit the IKE trafficD、security policy referencing the IPsec VPN tunnel
What is true about Quality of Service （QoS） for VPNs？（）A、QoS preclassification is only supported on generic routing encapsulation （GRE） and IPsec VPNsB、QoS preclassification is not required in Layer 2 Tunneling Protocol （L2TP）， Layer2 Forwarding （L2F）， and Point-to-Point Tunneling Protocol （PPTP） VPNsC、QoS preclassification is supported on IPsec AH VPNs， but not on IPsec ESP VPNsD、the QoS-for-VPNs feature （QoS preclassification） is designed for VPN transport interfacesE、with IPsec tunnel mode， the type of service （ToS） byte value is copied automatically from the original IP header to the tunnel header
To securely transport EIGRP traffic, a network administrator will build VPNs between sites. What is the best method to accomplish the transport of EIGRP traffic?（）A、IPSec in tunnel modeB、IPSec in transport modeC、GRE with IPSec in transport modeD、GRE with IPSec in tunnel mode
You are configuring an SRX210 as a firewall enforcer that will tunnel IPsec traffic from several Junos Pulse users.Which two parameters must you configure on the SRX210?（）A、access profileB、IKE parametersC、tunneled interfaceD、redirect policy
You are installing a MAG Series device for access control using an SRX Series device as the firewall enforcer. The MAG Series device resides in the same security zone as users. However, the users reside in different subnets and use the SRX Series device as an IP gateway.Which statement is true?（）A、You must configure a security policy on the SRX Series device to allow traffic to flow from the user devices to the MAG Series device.B、No security policy is necessary on the SRX Series device to allow traffic to flow from the user devices to the MAG Series device.C、You must configure host-inbound traffic on the SRX Series device to allow SSL traffic between the MAG Series device and the user devices.D、You must configure host-inbound traffic on the SRX Series device to allow EAP traffic between the MAG Series device and the user devices.
Which statement is true regarding IPsec VPNs?（）A、There are five phases of IKE negotiation.B、There are two phases of IKE negotiation.C、IPsec VPN tunnels are not supported on SRX Series devices.D、IPsec VPNs require a tunnel PIC in SRX Series devices.
An IPsec tunnel is established on an SRX Series Gateway on an interface whose IP address was obtained using DHCP.Which two statements are true? （）(Choose two.)A、Only main mode can be used for IKE negotiationB、A local-identity must be definedC、It must be the initiator for IKED、A remote-identity must be defined
Regarding an IPsec security association （SA）， which two statements are true？（）A、IKE SA is bidirectional.B、IPsec SA is bidirectional.C、IKE SA is established during phase 2 negotiations.D、IPsec SA is established during phase 2 negotiations.
Which statement is true regarding the Junos OS for security platforms?（）A、SRX Series devices can store sessions in a session table.B、SRX Series devices accept all traffic by default.C、SRX Series devices must operate only in packet-based mode.D、SRX Series devices must operate only in flow-based mode.
Which two configuration elements are required for a route-based VPN？（）A、secure tunnel interfaceB、security policy to permit the IKE trafficC、a route for the tunneled transit trafficD、tunnel policy for transit traffic referencing the IPsec VPN
单选题Which statement contains the correct parameters for a route-based IPsec VPN?（）A[edit security ipsec] user@host# show proposal ike1-proposal { protocol esp; authentication-algorithm hmac-md5-96; encryption-algorithm 3des-cbc; lifetime-seconds 3200; }policy ipsec1-policy { perfect-forward-secrecy { keys group2; } proposals ike1-proposal; } vpn VpnTunnel { interface ge-0/0/1.0; ike { gateway ike1-gateway; ipsec-policy ipsec1-policy; } establish-tunnels immediately; }B[edit security ipsec] user@host# show proposal ike1-proposal { protocol esp; authentication-algorithm hmac-md5-96; encryption-algorithm 3des-cbc; lifetime-seconds 3200; } policy ipsec1-policy { perfect-forward-secrecy { keys group2; } proposals ike1-proposal; } vpn VpnTunnel { interface st0.0; ike { gateway ike1-gateway; ipsec-policy ipsec1-policy; } establish-tunnels immediately; }C[edit security ipsec] user@host# show proposal ike1-proposal { protocol esp; authentication-algorithm hmac-md5-96; encryption-algorithm 3des-cbc; lifetime-seconds 3200;} policy ipsec1-policy { perfect-forward-secrecy { keys group2; } proposals ike1-proposal; } vpn VpnTunnel { bind-interface ge-0/0/1.0; ike { gateway ike1-gateway; ipsec-policy ipsec1-policy; } establish-tunnels immediately; }D[edit security ipsec] user@host# show proposal ike1-proposal { protocol esp; authentication-algorithm hmac-md5-96; encryption-algorithm 3des-cbc; lifetime-seconds 3200; }policy ipsec1-policy { perfect-forward-secrecy { keys group2; } proposals ike1-proposal; } vpn VpnTunnel { bind-interface st0.0; ike { gateway ike1-gateway; ipsec-policy ipsec1-policy; } establish-tunnels immediately; }
单选题Which statement is true regarding NAT?（）ANAT is not supported on SRX Series devices.BNAT requires special hardware on SRX Series devices.CNAT is processed in the control plane.DNAT is processed in the data plane.
单选题You are installing a MAG Series device for access control using an SRX Series device as the firewall enforcer. The MAG Series device resides in the same security zone as users. However, the users reside in different subnets and use the SRX Series device as an IP gateway.Which statement is true?（）AYou must configure a security policy on the SRX Series device to allow traffic to flow from the user devices to the MAG Series device.BNo security policy is necessary on the SRX Series device to allow traffic to flow from the user devices to the MAG Series device.CYou must configure host-inbound traffic on the SRX Series device to allow SSL traffic between the MAG Series device and the user devices.DYou must configure host-inbound traffic on the SRX Series device to allow EAP traffic between the MAG Series device and the user devices.
多选题Which two configuration elements are required for a policy-based VPN？（）AIKE gatewayBsecure tunnel interfaceCsecurity policy to permit the IKE trafficDsecurity policy referencing the IPsec VPN tunnel
多选题You are configuring an SRX210 as a firewall enforcer that will tunnel IPsec traffic from several Junos Pulse users.Which two parameters must you configure on the SRX210?（）Aaccess profileBIKE parametersCtunneled interfaceDredirect policy
单选题What is true about Quality of Service （QoS） for VPNs？（）AQoS preclassification is only supported on generic routing encapsulation （GRE） and IPsec VPNsBQoS preclassification is not required in Layer 2 Tunneling Protocol （L2TP）， Layer2 Forwarding （L2F）， and Point-to-Point Tunneling Protocol （PPTP） VPNsCQoS preclassification is supported on IPsec AH VPNs， but not on IPsec ESP VPNsDthe QoS-for-VPNs feature （QoS preclassification） is designed for VPN transport interfacesEwith IPsec tunnel mode， the type of service （ToS） byte value is copied automatically from the original IP header to the tunnel header
多选题Which two configuration elements are required for a route-based VPN？（）Asecure tunnel interfaceBsecurity policy to permit the IKE trafficCa route for the tunneled transit trafficDtunnel policy for transit traffic referencing the IPsec VPN
单选题To securely transport EIGRP traffic， a network administrator will build VPNs between sites. Whatis the best method to accomplish the transport of EIGRP traffic？（）A IPSec in tunnel modeB IPSec in transport modeC GRE with IPSec in transport modeD GRE with IPSec in tunnel mode