Juniper Juniper Certifications JN0-332 Questions & Answers

• Question 21:

  A packet that does not belong to an existing session enters your SRX Series device. Your SRX Series

  device is operating in its default mode.

  Which two statements are true? (Choose two.)

  A. The packet is processed through the fast path.

  B. The packet is subject to policer operations.

  C. Thepacketissubjecttostatelessfilters.

  D. The packet is not processed because no session ID exists.

  Correct Answer: BC

• Question 22:

  Click the Exhibit button.

  

  You want to keep your SRX Series device from being overloaded by ICMP echo request messages on

  interface ge- 0/0/3.

  Referringto the exhibit, which configurationresolves this problem?

  A. Apply the configuredscreento theUNTRUST zone.

  B. ConfigureICMP floodundertheconfiguredscreenandapplyittotheTRUSTzone.

  C. ConfigureICMP floodundertheconfiguredscreenandapplyittotheUNTRUSTzone.

  D. Apply the configuredscreento theTRUSTzone.

  Correct Answer: C

• Question 23:

  Which statement is correct regarding interface-based source NAT on an SRX Series device?

  A. PAT is always performed.

  B. Proxy ARP is enabled by default.

  C. PAT is never performed.

  D. ProxyARPmustbeconfigured.

  Correct Answer: A

• Question 24:

  You are asked to implement a chassis cluster on high-end SRX Series devices. What are two requirements? (Choose two.)

  A. There can be up to two redundancy groups per chassis cluster.

  B. The chassis models must be the same.

  C. The data plane can use SPC ports.

  D. SPCs must be placed in identical slots in all chassis.

  Correct Answer: BD

• Question 25:

  A packet from the untrust zone is sourced with a prefix that is associated with an interface in the trust zone. Which screen security parameter would be configured to block this type of attack on an SRX Series device?

  A. IP sweep

  B. port sweep

  C. ping of death

  D. IP spoofing

  Correct Answer: D

• Question 26:

  Click the Exhibit button.

  

  You are testing the IP spoofing screen on your SRX Series device. The ids-option IDS1 is shown in the

  exhibit, but no IP spoofingmessagesareseeninthelogs.

  What is happening?

  A. The IP block fragment must be disabled for IP spoofing to be detected.

  B. IDS is not applied to the correct security policy.

  C. IDS1 is not applied to the correct security zone.

  D. The TCP sweep threshold must be lowered to l000 to allow enough time for the spoof attack.

  Correct Answer: B

• Question 27:

  Click the Exhibit button.

  Youhave configured a new security policy as shown in the exhibit. Which method would ensure that the

  security policy AllowSIP will match the SIP traffic between host1 and host2?

  A. Add a firewall filter to the egress interface to control the burstrate of the traffic.

  B. Use the insert command to place the All policy after the AllowSIP policy.

  C. Change the policy to be a global policy.

  D. Adda firewall filter totheingress interfaceandset theloss-priority tolow.

  Correct Answer: B

• Question 28:

  Click the Exhibit button.

  

  Thephaseltunnelofasite-to-siteIPsecVPNisnotestablishingasshownintheexhibit. WhatwouldyoudotoresolvetheproblemonanSRXSeriesdevice?

  A. Change the phase l proposals to match on both sides of the VPN.

  B. Change the remote side of the VPN to use the correct peering address.

  C. Change the local side of the VPN to use the correct external interface.

  D. Change the preshared key to match on both sides of the VPN.

  Correct Answer: A

• Question 29:

  Click the Exhibit button.

  

  Serverl, in the trust zone, is attempting to send HTTP traffic to another server which is located in the

  untrust zone.

  Referring to the exhibit, what would happen?

  A. The traffic will be permitted by the All policy.

  B. The traffic will be permitted by the Allowl policy.

  C. The traffic will be permitted by the Allow2 policy.

  D. The traffic will be dropped.

  Correct Answer: A

• Question 30:

  Which SRX5400 component is responsible for forwarding a packet?

  A. IOC

  B. SPC

  C. RE

  D. SCB

  Correct Answer: A