Juniper Juniper Certifications JN0-332 Questions & Answers

• Question 321:

  Which two statements are true about route-based VPNs? (Choose two.)

  A. Route-based VPNs cannot be used to configure remote access or dialup VPNs.

  B. The from-zone and to-zone, for a security policy to permit traffic over a route-based VPN, are derived from the zone in which the protected network lies and the zone in which the IKE interface lies.

  C. system services ike must be enabled on the st0.x interface.

  D. You cannot re-write the DSCP bits on the inner IP header of an ESP packet that was created or forwarded using a route-based VPN.

  Correct Answer: AD

• Question 322:

  You are required to configure a SCREEN option that enables IP source route option detection.

  Which two configurations meet this requirement? (Choose two.)

  A. [edit security screen] user@host# show ids-option protectFromFlood { ip { loose-source-route-option; strict-source-route-option; } }

  B. [edit security screen] user@host# show ids-option protectFromFlood { ip { source-route-option; } }

  C. [edit security screen] user@host# show ids-option protectFromFlood { ip { record-route-option; security-option; } }

  D. [edit security screen] user@host# show ids-option protectFromFlood { ip { strict-source-route-option; record-route-option; } }

  Correct Answer: AB

• Question 323:

  On which component is the control plane implemented?

  A. IOC

  B. PIM

  C. RE

  D. SPC

  Correct Answer: C

• Question 324:

  When an SRX series device receives an ESP packet, what happens?

  A. If the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, it will immediately decrypt the packet.

  B. If the destination IP address in the outer IP header of ESP does not match the IP address of the ingress interface, it will discard the packet.

  C. If the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, based on SPI match, it will decrypt the packet.

  D. If the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, based on SPI match and route lookup of inner header, it will decrypt the packet.

  Correct Answer: C

• Question 325:

  Which type of Web filtering by default builds a cache of server actions associated with each URL it has checked?

  A. Websense Redirect Web filtering

  B. integrated Web filtering

  C. local Web filtering

  D. enhanced Web filtering

  Correct Answer: B

• Question 326:

  Which three advanced permit actions within security policies are valid? (Choose three.)

  A. Mark permitted traffic for firewall user authentication.

  B. Mark permitted traffic for SCREEN options.

  C. Associate permitted traffic with an IPsec tunnel.

  D. Associate permitted traffic with a NAT rule.

  E. Mark permitted traffic for IDP processing.

  Correct Answer: ACE

• Question 327:

  Which command would you use to enable chassis clustering on an SRX device, setting the cluster ID to 1 and node to 0?

  A. user@host# set chassis cluster cluster-id 1 node 0 reboot

  B. user@host> set chassis cluster id 1 node 0 reboot

  C. user@host> set chassis cluster cluster-id 1 node 0 reboot

  D. user@host# set chassis cluster id 1 node 0 reboot

  Correct Answer: C

• Question 328:

  Which two statements are true for a security policy? (Choose two.)

  A. It controls inter-zone traffic.

  B. It controls intra-zone traffic.

  C. It is named with a system-defined name.

  D. It controls traffic destined to the device's ingress interface.

  Correct Answer: AB

• Question 329:

  Your task is to provision the Junos security platform to permit transit packets from the Private zone to the External zone and send them through the IPsec VPN. You must also have the device generate a log message when the session ends.

  Which configuration meets this requirement?

  A. [edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn VPN; } } log {

  session-init;

  }

  }

  }

  B. [edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn VPN; } } count { session-close; } } }

  C. [edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn VPN; } } log { session-close; } } }

  D. [edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn VPN; log; count session-close; } } } }

  Correct Answer: C

• Question 330:

  Which configuration keyword ensures that all in-progress sessions are re-evaluated upon committing a security policy change?

  A. policy-rematch

  B. policy-evaluate

  C. rematch-policy

  D. evaluate-policy

  Correct Answer: A