Juniper Juniper Certifications JN0-541 Questions & Answers

• Question 61:

  You update your attack Object database from the IDP User Interface. What must you do before the new signature attack objects become active on your IDP Sensor?

  A. You restart the IDP Sensor.

  B. You restart the IDP Service on the IDP Sensor (IDP restart).

  C. No changes are required other than saving the policy changes.

  D. You install the updated Security policy on that IDP Sensor from the IDP User Interface.

  Correct Answer: D

• Question 62:

  When a security policy is installed on a IDP Sensor, which statement is true? (Choose two.)

  A. A Security policy must first be verified before it is installed.

  B. A policy version is created when is successfully installed.

  C. Thepolicy.set file is deleted and a new file is created.

  D. IDP Sensor stops processing traffic when policy is being installed.

  Correct Answer: AB

• Question 63:

  You implement Backdoor Detection and you notice that an alert is generated each time an SSH session is established with the protected servers. What must you do to correct the situation?

  A. You create an Exempt rule for SSH in the Exemptrulebase.

  B. You modify the Mainrulebase to include the SSH Protocol in the top Ignore rule.

  C. There is no way to disable alerting on SSH if you have Backdoor Detection enabled.

  D. You modify the Backdoor Detectionrulebase to include the SSH Protocol ports in the top Ignore rule.

  Correct Answer: D

• Question 64:

  How do ignore and None actions in the Main Rulebase differ?

  A. None actions cause IDP NOT to perform any AttackMatching on this rule.

  B. Ignore actions cause IDP NOT to perform any Attack Matching on this rule.

  C. Ignore actions cause IDP to ignore and subsequently drop all traffic matching this rule.

  D. Ignore actions will cause IDP to disregard and further attack matching when an attack object is matched.

  Correct Answer: D

• Question 65:

  What does a Drop Connection action do?

  A. drops all packets from the attacker's IP

  B. drops any packet matching thissrc/dst/protocol

  C. drops the specific session containing the attack pattern

  D. drops only the specific packet matching the attack pattern

  Correct Answer: C

• Question 66:

  Which two are IP Actions? (Choose two.)

  A. IDP Notify

  B. IDP CLOSE

  C. IDP TCP RST

  D. IDP Drop packet

  Correct Answer: AB

• Question 67:

  What is the function of Terminate Match?

  A. terminates the connection if the rule is matched

  B. terminates all connections from a source if the rule is matched

  C. makes a rule terminal when the Source IP, Destination IP and service match

  D. makes a rule terminal when the Source IP, Destination IP and Attack Object match

  Correct Answer: C

• Question 68:

  When migrating from Sniffer mode to inline mode, what changes should you make so IDP Sensor can effectively drop attacks?

  A. re-install the IDP Sensor software

  B. change the IDP Sensor mode from the ACM

  C. delete and re-add your IDP Sensor object to the Network Objects as an inline Device

  D. modify the rule action to "Drop Packet" or "Drop Connection" on rules that you want to drop attacks, and install the modified security policy

  Correct Answer: BD

• Question 69:

  Which two tasks can be performed from the ACM? (Choose two.)

  A. change the mode which IDP Sensor is operating

  B. upgrade the firmware on the IDP Sensor

  C. install a Security Policy on the IDP Sensor

  D. change the Management IP address of a IDP Sensor

  Correct Answer: AD

• Question 70:

  Exhibit:

  You work as an administrator at Certkiller .com. Study the exhibit carefully. Which three statements are true about the capabilities of IDP when deployed as shown in the exhibit? (Choose three.)

  Exhibit:

  

  A. IDP Sensor can detect attacks between Client A and Server A in this mode.

  B. IDP Sensor can detect attacks between Server A and Server B in this mode.

  C. IDP Sensor can only drop offending TCP traffic by sending TCP Resets in this mode.

  D. IDP can drop any offending traffic between internal and DMZ networks in this mode.

  Correct Answer: ABC