Juniper Juniper Certifications JN0-541 Questions & Answers

• Question 161:

  What is the function of a compound attack object?

  A. Combines multiple signature based attack objects, or anomaly-based attack objects, into a single attack object.

  B. Allows the sensor to perform custom actions based on combinations of attacks.

  C. Combines multiple attacks in a single rule base.

  D. Looks for multiple occurrences of the same attack.

  Correct Answer: A

• Question 162:

  Which sensor utility is used to decode the contexts of a sequence of packets?

  A. scio pcap

  B. scio ccap

  C. netstat

  D. tcpreplay

  Correct Answer: B

• Question 163:

  Which sensor command will capture packets on a particular interface?

  A. sctop

  B. tcpdump

  C. tcpreplay

  D. netstat

  Correct Answer: B

• Question 164:

  When configuring a honeypot rule, which three fields must you specify? (Choose three.)

  A. Attack Object

  B. Service

  C. Source Address

  D. Destination Address

  Correct Answer: BCD

• Question 165:

  Which statement is true about packet capture in the IDP sensor?

  A. Packet capture records all packets flowing through the sensor.

  B. You can configure a particular number of packets to capture before and after an attack.

  C. The Log Viewer has no indication of whether a log message has associated packet captures.

  D. You can only log packets after an attack packet.

  Correct Answer: B

• Question 166:

  Which OSI layer(s) of a packet does the IDP sensor examine?

  A. layers 4-7

  B. layers 2-7

  C. layers 2-4

  D. layer 7 only

  Correct Answer: B

• Question 167:

  When creating a new signature-based attack object, which four components must be specified? (Choose four.)

  A. target platform

  B. IP header values

  C. time binding

  D. service binding

  E. context

  F. attack pattern

  Correct Answer: ADEF

• Question 168:

  What is the function of Terminate Match?

  A. makes a rule terminal when the source IP, destination IP, service, and attack object match

  B. makes a rule terminal when the source IP, destination IP, and service match

  C. terminates the connection if a rule is matched

  D. terminates all connections from a source if the rule is matched

  Correct Answer: B

• Question 169:

  What contains instructions on how the sensor should decode protocols?

  A. PCAP files

  B. policy.set

  C. detector.o

  D. ACM

  Correct Answer: C

• Question 170:

  Exhibit:

  

  You work as an administrator at Certkiller .com. Study the exhibit carefully. In the exhibit, which command would have produced this output?

  A. sctop "p" option

  B. scio agentstats policy list

  C. scio policy list vr0

  D. scio policy list s0

  Correct Answer: D