Juniper JN0-333 Online Practice Questions and Exam Preparation

Juniper JN0-333 Online Questions & Answers

• Question 11:

  You recently configured an IPsec VPN between two SRX Series devices. You notice that the Phase 1 negotiation succeeds and the Phase 2 negotiation fails. Which two configuration parameters should you verify are correct? (Choose two.)

  A. Verify that the IKE gateway proposals on the initiator and responder are the same.
  B. Verify that the VPN tunnel configuration references the correct IKE gateway.
  C. Verify that the IPsec policy references the correct IKE proposals.
  D. Verify that the IKE initiator is configured for main mode.
  A. Verify that the IKE gateway proposals on the initiator and responder are the same.
  C. Verify that the IPsec policy references the correct IKE proposals.

• Question 12:

  Click the Exhibit button.

  

  The inside server must communicate with the external DNS server. The internal DNS server address is 10.100.75.75. The external DNS server address is 75.75.76.76. Traffic from the inside server to the DNS server fails. Referring to the exhibit, what is causing the problem?

  A. The security policy must match the translated destination address.
  B. Source and static NAT cannot be configured at the same time.
  C. The static NAT rule must use the global address book entry name for the DNS server.
  D. The security policy must match the translated source and translated destination address.
  A. The security policy must match the translated destination address.

• Question 13:

  You have recently configured an IPsec tunnel between two SRX Series devices. One of the devices is assigned an IP address using DHCP with an IP address that changes frequently. Initial testing indicates that the IPsec tunnel is not working. Troubleshooting has revealed that Phase 1 negotiations are failing.

  Which two actions would solve the problem? (Choose two.)

  A. Verify that the device with the IP address assigned by DHCP is the traffic initiator.
  B. Verify that VPN monitoring is enabled.
  C. Verify that the IKE policy is configured for aggressive mode.
  D. Verify that PKI is properly configured.
  A. Verify that the device with the IP address assigned by DHCP is the traffic initiator.
  C. Verify that the IKE policy is configured for aggressive mode.

• Question 14:

  Click the Exhibit button.

  

  Referring to the exhibit, which action will be taken for traffic coming from the untrust zone going to the trust zone?

  A. Source address 2001:db8::8 will be translated to 10.1.1.5.
  B. Source address 2001:db8::8 will be translated to 10.1.1.8.
  C. Source address 10.1.1.8 will be translated to 2001:db8::8.
  D. Source address 10.1.1.5 will be translated to 2001:db8::8.
  B. Source address 2001:db8::8 will be translated to 10.1.1.8.

• Question 15:

  Click the Exhibit button.

  

  Referring to the exhibit, what will happen if client 172.16.128.50 tries to connect to destination 192.168.150.3 using HTTP?

  A. The client will be denied by policy p2.
  B. The client will be permitted by the global policy.
  C. The client will be permitted by policy p1.
  D. The client will be denied by policy p3.
  C. The client will be permitted by policy p1.

• Question 16:

  Click the Exhibit button.

  

  Which feature is enabled with destination NAT as shown in the exhibit?

  A. NAT overload
  B. block allocation
  C. port translation
  D. NAT hairpinning
  D. NAT hairpinning

• Question 17:

  Click to the Exhibit button.

  

  Referring to the exhibit, what does proxy ARP allow?

  A. the internal network to ARP for the internal address of the server
  B. the external network to ARP for the internal address of the server
  C. the internal network to ARP for the public address of the server
  D. the external network to ARP for the public address of the server
  A. the internal network to ARP for the internal address of the server

• Question 18:

  Click the Exhibit button.

  

  You notice that your SRX Series device is not blocking HTTP traffic as expected. Referring to the exhibit, what should you do to solve the problem?

  A. Commit the configuration.
  B. Reboot the SRX Series device.
  C. Configure the SRX Series device to operate in packet-based mode.
  D. Move the deny-http policy to the bottom of the policy list.
  B. Reboot the SRX Series device.

• Question 19:

  Which host-inbound-traffic security zone parameter would allow access to the REST API configured to listen on custom TCP port 5080?

  A. http
  B. all
  C. xnm-clear-text
  D. any-service
  D. any-service

• Question 20:

  Which interface is used exclusively to forward Ethernet-switching traffic between two chassis cluster nodes?

  A. swfab0
  B. fxp0
  C. fab0
  D. me0
  A. swfab0