Juniper JN0-333 Online Practice Questions and Exam Preparation

Juniper JN0-333 Online Questions & Answers

• Question 21:

  Click the Exhibit button.

  You are trying to create a security policy on your SRX Series device that permits HTTP traffic from your private 172.25.11.0/24 subnet to the Internet. You create a policy named permit ?http between the trust and untrust zones that permits

  HTTP traffic.

  When you issue a commit command to apply the configuration changes, the commit fails with the error shown in the exhibit.

  Which two actions would correct the error? (Choose two.)

  

  A. Create a custom application named http at the [edit applications] hierarchy.
  B. Execute the Junos commit full command to override the error and apply the configuration.
  C. Modify the security policy to use the built-in junos-http application.
  D. Issue the rollback 1 command from the top of the configuration hierarchy and attempt the commit again.
  B. Execute the Junos commit full command to override the error and apply the configuration.
  C. Modify the security policy to use the built-in junos-http application.

• Question 22:

  Click the Exhibit button. Referring to the exhibit, what will happen if client 172.16.128.50 tries to connect to destination 192.168.150.3 using HTTP?

  

  A. The client will be permitted by policy p1.
  B. The client will be denied by policy p3.
  C. The client will be denied by policy p2.
  D. The client will be permitted by the global policy.
  D. The client will be permitted by the global policy.

• Question 23:

  You are asked to support source NAT for an application that requires that its original source port not be changed. Which configuration would satisfy the requirement?

  A. Configure a source NAT rule that references an IP address pool with interface proxy ARP enabled.
  B. Configure the egress interface to source NAT fixed-port status.
  C. Configure a source NAT rule that references an IP address pool with the port no-translation parameter enabled.
  D. Configure a source NAT rule that sets the egress interface to the overload status.
  C. Configure a source NAT rule that references an IP address pool with the port no-translation parameter enabled.

• Question 24:

  You are changing the default vCPU allocation on a vSRX.

  How are the additional vCPUs allocated in this scenario?

  A. The vCPU are allocated equally across the Junos control plane and packet forwarding engine.
  B. One dedicated vCPU is allocated for the Junos control plane and the remaining vCPUs for the packet forwarding engine.
  C. One dedicated vCPU is allocated for the packet forwarding engine, one for the Junos control plane, and the remaining vCPUs are equally balanced.
  D. One dedicated vCPU is allocated for the packet forwarding engine and the remaining vCPUs for the Junos plane.
  B. One dedicated vCPU is allocated for the Junos control plane and the remaining vCPUs for the packet forwarding engine.

• Question 25:

  Which three Encapsulating Security Payload protocols do the SRX Series devices support with IPsec? (Choose three.)

  A. DES
  B. RC6
  C. TLS
  D. AES
  E. 3DES
  A. DES
  D. AES
  E. 3DES

• Question 26:

  What are three valid virtual interface types for a vSRX? (Choose three.)

  A. SR-IOV
  B. fxp0
  C. eth0
  D. VMXNET 3
  E. virtio
  A. SR-IOV
  B. fxp0
  D. VMXNET 3

• Question 27:

  Which two statements about security policy actions are true? (Choose two.)

  A. The log action implies an accept action.
  B. The log action requires an additional terminating action.
  C. The count action implies an accept action.
  D. The count action requires an additional terminating action.
  B. The log action requires an additional terminating action.
  D. The count action requires an additional terminating action.

• Question 28:

  Click the Exhibit button.

  

  You have an IPsec tunnel between two devices. You clear the IKE security associations, but traffic continues to flow across the tunnel. Referring to the exhibit, which statement is correct in this scenario?

  A. The IPsec security association is independent from the IKE security association
  B. The traffic is no longer encrypted
  C. The IKE security association immediately reestablishes
  D. The traffic is using an alternate path
  A. The IPsec security association is independent from the IKE security association
  B. The traffic is no longer encrypted

• Question 29:

  You need to configure an IPsec tunnel between a remote site and a hub site. The SRX Series device at the remote site receives a dynamic IP address on the external interface that you will use for IPsec.

  Which feature would you need to configure in this scenario?

  A. NAT-T
  B. crypto suite B
  C. aggressive mode
  D. IKEv2
  C. aggressive mode

• Question 30:

  Which two statements are true about global security policies? (Choose two.)

  A. Global security policies are evaluated before regular security policies.
  B. Global security policies can be configured to match addresses across multiple zones.
  C. Global security policies can match traffic regardless of security zones.
  D. Global security policies do not support IPv6 traffic.
  B. Global security policies can be configured to match addresses across multiple zones.
  C. Global security policies can match traffic regardless of security zones.