An IPsec tunnel is established on an SRX Series Gateway on an interface whose IP address was obtained using DHCP.Which two statements are true? ()(Choose two.)A. Only main mode can be used for IKE negotiationB. A local-identity must be definedC. It must b

题目
An IPsec tunnel is established on an SRX Series Gateway on an interface whose IP address was obtained using DHCP.Which two statements are true? ()(Choose two.)

A. Only main mode can be used for IKE negotiation

B. A local-identity must be defined

C. It must be the initiator for IKE

D. A remote-identity must be defined

相似考题

1.以下程序段的输出结果为 ( )int j=2；switch(j){case 2：System.out.print("two.")；case 2+1：System.out.println("three.")；breakdefault：System.out.println("value is"+j)；break；}A．two.three.B．two.C．three.D．value is 2

2.Which configuration shows the correct application of a security policy scheduler?()A. [edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn myTunnel; } scheduler-name now; } } }B. [edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn myTunnel; } } } scheduler-name now; }C. [edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn scheduler-name now; } } } }D. [edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; scheduler-name now; } then { permit { tunnel { ipsec-vpn myTunnel; } } } scheduler-name now; }myTunnel;

3.Your task is to provision the Junos security platform to permit transit packets from the Private zone to the External zone by using an IPsec VPN and log information at the time of session close.Which configuration meets this requirement?（）A. [edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts;destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn VPN; } } log { session-init; } } }B. [edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn VPN; } } count { session-close; } } }C. [edit security policies from-zone Private to-zone External] user@host# showpolicy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn VPN;} } log { session-close; } } }D. [edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn VPN; log; count session-close; } } } }

4.在路由器配置参数中,()指明为黑洞路由。A.blackholeB.rejectC.preference-valueD.gateway-address

参考答案和解析
参考答案：B, C
更多“An IPsec tunnel is established on an SRX Series Gateway on an interface whose IP address was obtained using DHCP.Which two statements are true? ()(Choose two.) ”相关问题

  • 第1题：

    In which two ways can the router ID selection be controlled?()

    A. Manually assign rid.

    B. configure local-address.

    C. enable the fxp0 interface.

    D. Assign nonmartian address to lo0.


    参考答案：A, D

  • 第2题：

    试题四（共15分）

    阅读以下说明，回答问题1至问题5，将解答填入答题纸对应的解答栏内。

    【说明】

    某公司两分支机构之间的网络配置如图4-1所示，为保护通信安全，在路由器router-a和router-b上配置IPSec安全策略，对192．168．8．0/24网段和 192．168．9．0/24网段之间的数据进行加密处理。

    【问题1】（3分）

    为建立两分支机构之间的通信，请完成下面的路由配置命令。

    router-a (config) iproute 0．0．0．0 0．0．0．0 (1)

    router-b(config)iproute 0．0．0．0 0．0．0．0 (2)

    【问题2】（3分）

    下面的命令是在路由器router-a中配置IPSec隧道。请完成下面的隧道配置命令。

    router-a(config) crypto tunnel tun1 （设置IPSec隧道名称为tunl)

    router-a(config-tunnel) peer address （3） （设置隧道对端IP地址，

    router-a(config-tunnel)local address （4） 设置隧道本端IP地址）

    router-a(config-tunnel) set auto-up （设置为自动协商）

    router-a(config-tunnel) exit （退出隧道设置）

    【问题3】（3分）

    router-a 与 router-b之间采用预共享密钥“12345678”建立IPSec关联，请完成下面

    配置router-a(config) cryptike key 12345678 address

    router_a(config)cryt ike key 12345678 addresS （5）

    router-b(config) crypt ike key 12345678 address （6）

    【问题4】（3分）

    下面的命令在路由器router-a中配置了相应的IPSec策略，请说明该策略的含义。

    router-a(config) crypto policypl

    router-a(config-policy) flow

    192．168．8．0255．255．255．0192．168．9．0．255．255．255．255．0

    ip tunnel tunl

    router-a(config-policy)exit

    【问题5】（3分）

    下面的命令在路由器router-a中配置了相应的IPSec提议。

    router-a(config) crypto ipsec proposal secpl

    router-a(config-ipsec-prop) esp 3des shal

    router-a(config-ipsecprop)exit

    该提议表明：IPSec采用ESP报文，加密算法 (7) ，认证算法采用 (8) 。


    正确答案：
    试题四分析
    本题考查考生在路由器上配置IPSec安全策略的实际操作能力。
    【问题1】
    本问题考查如何在两个路由器上配置默认路由，从图4-1中可以得到router-a的默认路由是203.25.25.254，router-b的默认路由是201.18.8.254。
    【问题2】
    本问题考查如何在router-a上配置IPSec隧道，对端IP地址应该是router-b的f1口地址201.18.8.1，本地地址是router-b的fl口地址203.25.25.1。
    【问题3】
    本问题考查如何在router-a与router-b之间预设共享密钥，address后面是对端的id，默认是对端的IP地址。
    【问题4】
    本问题考查如何配置相应的IPSec策略，该策略说明从192.168.8.0/24子网到
    1 92.168.9.0/24子网的所有IP报文经由IPSec隧道到达。
    【问题5】
    本问题考查如何配置IPSec提议，提议表明IPSec采用ESP报文，加密算法采用
    3DES，认证算法采用SHA-1。
    参考答案
    【问题1】
    (1) 203.25.25.254(2) 201.18.8.254
    【问题2】
    (3) 201.18.8.1(4) 203.25.25.1
    【问题3]
    (5) 201.18.8.1(6) 203.25.25.1
    【问题4]
    从192.168.8.0/24子网到192.168.9.0/24子网的所有IP报文经由IPSec隧道到达。
    【问题5】
    (7) 3DES(8) SHA-1

  • 第3题：

    ACompanyisusing6to4tunnelsintheirIPv6network.Whichtwostatementsaretrueaboutthesetunnels?()

    A.Ina6to4tunnel，thefirsttwobytesoftheIPv6addresswillbe0x2002andthenextfourbyteswillbethehexadecimalequivalentoftheIPv4address

    B.Ina6to4tunnel，theIPv4address192.168.99.1wouldbeconvertedtothe2002：1315：4463：1：：/64IPv6address

    C.Ina6to4tunnel，theIPv4address192.168.99.1wouldbeconvertedtothe2002：c0a8：6301：：/48IPv6address

    D.Ina6to4tunnel，thefirsttwobytesoftheIPv6addresswillbelocallyderivedandthenexttwobyteswillbethehexadecimalequivalentoftheIPv4address

    E.Ina6to4tunnel，theIPv4address192.168.99.1wouldbeconvertedtothe2002：c0a8：6301：：/16IPv6address


    参考答案：A, C

  • 第4题：

    以下程序段的输出结果为( )。 int j=2 switch (j){ Case 2： system.out.print("two.")： Case 2+1： System.out.println("three.")； break： default: System.out.println (“value is”+j): Break }A.B.two

    A．two.three.

    B．two

    C．three

    D．value is 2


    正确答案：A

  • 第5题：

    Whichofthefollowingcommandsprovidesdataplaneinformationrequiredtoforwardapackettoaspecificipaddress?()

    A.shiproute

    B.shipcef〈ip_address〉

    C.shadjacency〈ip_address〉

    D.shiproute〈ip_addres$〉

    E.shipadjacency〈/p_address〉

    F.shipcef〈mac_addrQss〉〈ip_address〉


    参考答案：B

  • 第6题：

    WhichofthefollowingareassociatedwiththeapplicationlayeroftheOSImodel?(two.)()

    A.ping

    B.Telnet

    C.FTP

    D.TCP

    E.IP


    参考答案：B, C

相关内容