Juniper JN0-1331 Online Practice Questions and Exam Preparation

Juniper JN0-1331 Online Questions & Answers

• Question 41:

  What are two reasons for using cSRX over vSRX? (Choose two.)

  A. cSRX loads faster
  B. cSRX uses less memory
  C. cSRX supports the BGP protocol
  D. cSRX supports IPsec
  A. cSRX loads faster
  B. cSRX uses less memory

  ---

  Reference: https://www.juniper.net/documentation/en_US/csrx/information-products/pathway-pages/security-csrx-linux-bm-guide-pwp.pdf

• Question 42:

  You are designing a DDoS solution for an ISP using BGP FlowSpec. You want to ensure that BGP FlowSpec does not overwhelm the ISP's edge routers. Which two requirements should be included in your design? (Choose two.)

  A. Specify a maximum number BGP FlowSpec prefixes per neighbor
  B. Implement a route policy to limit advertised routes to /24 subnets
  C. Implement a route policy to limit advertised routes to any public IP space
  D. Specify a maximum number of BGP FlowSpec prefixes per device
  C. Implement a route policy to limit advertised routes to any public IP space
  D. Specify a maximum number of BGP FlowSpec prefixes per device

  ---

  Reference: https://www.juniper.net/documentation/en_US/day-one-books/DO_BGP_FLowspec.pdf

• Question 43:

  You are asked to provide a design proposal for a campus network. As part of the design, the customer requires that all end user devices must be authenticated before being granted access to their Layer 2 network. Which feature meets this requirement?

  A. IPsec
  B. 802.1X
  C. NAT
  D. ALGs
  B. 802.1X

  ---

  Reference: https://www.juniper.net/documentation/en_US/junos/topics/topic-map/802-1x- authentication- switching-devices.html

• Question 44:

  You are designing a data center security architecture. The design requires automated scaling of security services according to real-time traffic flows. Which two design components will accomplish this task? (Choose two.)

  A. telemetry with an SDN controller
  B. JFlow traffic monitoring with event scripts
  C. VNF security devices deployed on x86 servers
  D. VRF segmentation on high-capacity physical security appliances
  B. JFlow traffic monitoring with event scripts
  C. VNF security devices deployed on x86 servers

  ---

  Reference: https://www.juniper.net/documentation/en_US/learn-about/LearnAbout_NFV.pdf

• Question 45:

  You want to deploy a VPN that will connect branch locations to the main office. You will eventually add additional branch locations to the topology, and you must avoid additional configuration on the hub when those sites are added. In this scenario, which VPN solution would you recommend?

  A. Site-to-Site VPN
  B. Hub-and-Spoke VPN
  C. AutoVPN
  D. Group VPN
  C. AutoVPN

  ---

  Reference: https://www.juniper.net/assets/us/en/local/pdf/solutionbriefs/3510477-en.pdf

• Question 46:

  You have a site that has two Internet connections but no switch on the outside of the firewall. You want to use ISP-A over ISP-B during normal operations. Which type of chassis cluster design would you propose to satisfy this requirement?

  A. Propose active/active cluster deployment with separate redundancy groups
  B. Propose active/passive cluster deployment with separate redundancy groups
  C. Propose active/active cluster deployment without separate redundancy groups
  D. Propose active/passive cluster deployment without separate redundancy groups
  A. Propose active/active cluster deployment with separate redundancy groups

  ---

  Reference: https://www.juniper.net/documentation/en_US/release-independent/nce/topics/example/chassis-cluster-srx-active-active-configuring.html

• Question 47:

  You are concerned about users downloading malicious attachments at work while using encrypted Web mail. You want to block these malicious files using your SRX Series device. In this scenario, which two features should you use? (Choose two.)

  A. SSL reverse proxy
  B. SSL forward proxy
  C. Sky ATP SMTP scanning
  D. Sky ATP HTTP scanning
  B. SSL forward proxy
  C. Sky ATP SMTP scanning

• Question 48:

  You are asked to design a security solution for your client's new two-tier data center. The client has a need for some flows to bypass firewall inspection entirely. Where should the firewall be deployed in this data center?

  A. inline, between the core switches and the access switches
  B. inline, between the core switches and the edge routers
  C. one-arm configuration, connected to the core switches
  D. one-arm configuration, connected to each access switch
  C. one-arm configuration, connected to the core switches

  ---

  Reference: https://www.juniper.net/us/en/local/pdf/implementation-guides/8010046-en.pdf

• Question 49:

  Your company has 500 branch sites and the CIO is concerned about minimizing the potential impact of a VPN router being stolen from an enterprise branch site. You want the ability to quickly disable a stolen VPN router while minimizing administrative overhead.

  Which solution accomplishes this task?

  A. Implement a certificate-based VPN using a public key infrastructure (PKI)
  B. Modify your IKE proposals to use Diffie-Hellman group 14 or higher
  C. Use firewall filters to block traffic from the stolen VPN router
  D. Rotate VPN pre-shared keys every month
  C. Use firewall filters to block traffic from the stolen VPN router

• Question 50:

  You will be managing 1000 SRX Series devices. Each SRX Series device requires basic source NAT to access the Internet. Which product should you use to manage these NAT rules on the SRX Series devices?

  A. Security Director
  B. CSO
  C. Contrail
  D. JSA
  A. Security Director