Juniper JNCDS-SEC JN0-1332 Questions & Answers

• Question 41:

  Your customer needs help designing a single solution to protect their combination of various Junos network devices from unauthorized management access.

  Which Junos OS feature will provide this protection?

  A. Use a firewall filter applied to the fxp0 interface

  B. Use a security policy with the destination of the junos-host zone

  C. Use the management zone host-inbound-traffic feature

  D. Use a firewall filter applied to the lo0 interface

  Correct Answer: A

  Reference: https://www.juniper.net/documentation/en_US/junos/topics/concept/junos-software-routersecurity-supported-features.html

• Question 42:

  A hosting company is migrating to cloud-based solutions. Their customers share a physical firewall cluster, subdivided into individual logical firewalls for each customer. Projection data shows that the cloud service will soon deplete all the resources within the physical firewall. As a consultant, you must propose a scalable solution that continues to protect all the cloud customers while still securing the existing physical network.

  In this scenario, which solution would you propose?

  A. Deploy a vSRX cluster in front of each customer's servers while keeping the physical firewall cluster

  B. Deploy a software-defined networking solution

  C. Remove the physical firewall cluster and deploy vSRX clusters dedicated to each customer's servers

  D. Replace the physical firewall cluster with a higher-performance firewall

  Correct Answer: C

• Question 43:

  You must allow applications to connect to external servers. The session has embedded IP address information to enable the remote system to establish a return session.

  In your design, which function should be implemented?

  A. source NAT

  B. application layer gateway

  C. destination NAT

  D. HTTP redirect

  Correct Answer: A

• Question 44:

  You are asked to virtualize numerous stateful firewalls in your customer's data center. The customer wants the solution to use the existing Kubernetes-orchestrated architecture.

  Which Juniper Networks product would satisfy this requirement?

  A. vMX

  B. vSRX

  C. cSRX

  D. CTP Series

  Correct Answer: C

  Reference: https://www.juniper.net/documentation/en_US/csrx/topics/concept/security-csrx-kubernetesoverview.html

• Question 45:

  What are two reasons for using cSRX over vSRX? (Choose two.)

  A. cSRX loads faster

  B. cSRX uses less memory

  C. cSRX supports the BGP protocol

  D. cSRX supports IPsec

  Correct Answer: AB

  Reference: https://www.juniper.net/documentation/en_US/csrx/information-products/pathway-pages/ security-csrx-linux-bm-guide-pwp.pdf

• Question 46:

  You are concerned about malicious attachments being transferred to your e-mail server at work through encrypted channels. You want to block these malicious files using your SRX Series device.

  Which two features should you use in this scenario? (Choose two.)

  A. Sky ATP SMTP scanning

  B. Sky ATP HTTP scanning

  C. SSL forward proxy

  D. SSL reverse proxy

  Correct Answer: AC

  Reference: https://www.juniper.net/documentation/en_US/release-independent/sky-atp/help/informationproducts/pathway-pages/email-scanning-sky-atp.html

• Question 47:

  You have multiple SRX chassis clusters on a single broadcast domain. Why must you assign different cluster IDs in this scenario?

  A. to avoid MAC address conflicts

  B. to avoid control link conflicts

  C. to avoid node numbering conflicts

  D. to avoid redundancy group conflicts

  Correct Answer: A

  Reference: https://www.juniper.net/documentation/en_US/release-independent/nce/topics/example/ chassis-cluster-srx-full-mesh-configuring.html#:~:text=If%20you%20have%20multiple%20SRX,other% 20device%20is%2 0node%201.

• Question 48:

  You are designing a data center security solution for a customer. The customer asks that you provide a DDoS solution. Several IPsec tunnels will be terminated at the data center gateway.

  Which type of security is your customer asking you to implement?

  A. segmentation

  B. intra-data center policy enforcement

  C. perimeter protection

  D. compliance

  Correct Answer: C

• Question 49:

  You are designing an SDSN security solution for a new campus network. The network will consist of Juniper Networks Policy Enforcer, Juniper Networks switches, third-party switches, and SRX Series devices. The switches and the SRX Series devices will be used as security enforcement points. The design must be able to change the VLAN mapping of the switch port of a user that is already authenticated to the network in the event that the end user device becomes compromised.

  Which component satisfies this requirement?

  A. certificate server

  B. RADIUS server

  C. Security Director

  D. DHCP server

  Correct Answer: C

• Question 50:

  You want to deploy JATP in your network that uses SRX Series devices.

  In this scenario, which feature must you enable on the SRX Series devices?

  A. SSL forward proxy

  B. AppSecure

  C. UTM antivirus

  D. IPS

  Correct Answer: A

  Reference: https://www.juniper.net/documentation/en_US/release-independent/jatp/topics/concept/jatpsrx-integration-getting-started.html