Juniper JN0-333 Online Practice Questions and Exam Preparation

Juniper JN0-333 Online Questions & Answers

• Question 51:

  After an SRX Series device processes the first packet of a session, how are subsequent packets for the same session processed?

  A. They are processed using fast-path processing.
  B. They are forwarded to the control plane for deep packet inspection.
  C. All packets are processed in the same manner.
  D. They are queued on the outbound interface until a matching security policy is found.
  A. They are processed using fast-path processing.

• Question 52:

  You are asked to change when your SRX high availability failover occurs. One network interface is considered more important than others in the high availability configuration. You want to prioritize failover based on the state of that interface. Which configuration would accomplish this task?

  A. Create a VRRP group configuration that lists the reth's IP address as the VIP while using each physical interface that make up the reth definition of each SRX HA pair.
  B. Configure IP monitoring of the important interface's IP address and adjust the heartbeat interval and heartbeat threshold to the shortest settings.
  C. Create a separate redundancy group to isolate the important interface; set the priority of the new redundancy group to 255.
  D. Configure interface monitor inside the redundancy group that contains the important physical interface; adjust the weight associated with the monitored interface to 255.
  D. Configure interface monitor inside the redundancy group that contains the important physical interface; adjust the weight associated with the monitored interface to 255.

• Question 53:

  What are two fields that an SRX Series device examines to determine if a packet is associated with an existing flow? (Choose two.)

  A. protocol
  B. source IP address
  C. source MAC address
  D. type of service
  A. protocol
  B. source IP address

• Question 54:

  Which SRX5400 component is responsible for performing first pass security policy inspection?

  A. Routing Engine
  B. Switch Control Board
  C. Services Processing Unit
  D. Modular Port Concentrator
  C. Services Processing Unit

• Question 55:

  You want to implement IPsec on your SRX Series devices, but you do not want to use a preshared key. Which IPsec implementation should you use?

  A. public key infrastructure
  B. next-hop tunnel binding
  C. tunnel mode
  D. aggressive mode
  A. public key infrastructure

• Question 56:

  What is the correct ordering of Junos policy evaluation from first to last?

  A. global policy > zone-based policy > default policy
  B. default policy > zone-based policy > global policy
  C. global policy > default policy > zone-based policy
  D. zone-based policy > global policy > default policy
  D. zone-based policy > global policy > default policy

• Question 57:

  You recently configured an IPsec VPN between two SRX Series devices. You notice that the Phase1 negotiation succeeds and the Phase 2 negotiation fails. Which two configuration parameters should you verify are correct? (Choose two.)

  A. Verify that the IKE gateway proposals on the initiator and responder are the same.
  B. Verify that the VPN tunnel configuration references the correct IKE gateway.
  C. Verify that the IKE initiator is configured for main mode.
  D. Verify that the IPsec policy references the correct IKE proposals.
  A. Verify that the IKE gateway proposals on the initiator and responder are the same.
  B. Verify that the VPN tunnel configuration references the correct IKE gateway.

• Question 58:

  Your internal webserver uses port 8088 for inbound connections. You want to allow external HTTP traffic to connect to the webserver. Which two actions would accomplish this task? (Choose two.)

  A. Create a custom application for port 8088 and create a security policy that permits the custom-http application.
  B. Remap port 80 to port 8088 in the junos-http application and create a security policy that permits the junos-http application.
  C. Use destination NAT to remap incoming traffic from port 80 to port 8088.
  D. Create an Application Layer Gateway to permit HTTP traffic on port 8088.
  A. Create a custom application for port 8088 and create a security policy that permits the custom-http application.
  C. Use destination NAT to remap incoming traffic from port 80 to port 8088.

• Question 59:

  You have configured source NAT with port address translation. You also need to guarantee that the same IP address is assigned from the source NAT pool to a specific host for multiple concurrent sessions. Which NAT parameter would meet this requirement?

  A. port block-allocation
  B. port range twin-port
  C. address-persistent
  D. address-pooling paired
  D. address-pooling paired

• Question 60:

  Click the Exhibit button.

  

  Host A is attempting to connect to Host B using the domain name, which is tied to a public IP address. All attempts to connect to Host B have failed. You have examined the configuration on your SRX340 and determined that a NAT policy is required.

  Referring to the exhibit, which two NAT types will allow Host A to connect to Host B? (Choose two.)

  A. source NAT
  B. NAT-T
  C. destination NAT
  D. static NAT
  C. destination NAT
  D. static NAT