JNCIE-SEC Practice Questions - Juniper Networks Certified Expert, Security (JNCIE-SEC) Exam

Access More Questions

In a multi-SRX deployment scenario, you need to configure AutoVPN hub-and-spoke with IKEv2 where spokes use dynamic IP addresses. The hub SRX must identify each spoke and install spoke-specific routes. Which configuration approach correctly achieves this on the hub?

Configure a single IKE gateway with 'dynamic hostname' and a wildcard pre-shared key; use traffic-selector-based routing so the hub installs a /32 host route per spoke based on spoke subnet announcements Configure the hub with 'set security ike gateway dynamic distinguished-name' using certificate-based authentication; use a routing protocol (OSPF or BGP) over st0 interfaces with 'point-to-multipoint' mode so spokes advertise their subnets to the hub dynamically Configure a separate IKE gateway and IPsec VPN for each spoke; use numbered st0 sub-interfaces (st0.1, st0.2, etc.) with static routes per spoke — AutoVPN requires pre-defined per-spoke configurations Configure AutoVPN with 'set security ike gateway dynamic connections-limit' and use GRE over IPsec so GRE handles the spoke identification independently of IKE

Correct Answer:

Configure the hub with 'set security ike gateway dynamic distinguished-name' using certificate-based authentication; use a routing protocol (OSPF or BGP) over st0 interfaces with 'point-to-multipoint' mode so spokes advertise their subnets to the hub dynamically

Access more questions from this quiz

Continue to JNCIE-SEC Practice Questions - Juniper Networks Certified Expert, Security (JNCIE-SEC) Exam for more practice questions and the full quiz experience.

Access More Questions