Juniper JN0-335 Online Practice Questions and Exam Preparation

Juniper JN0-335 Online Questions & Answers

• Question 1:

  Which two functions does Juniper ATP Cloud perform to reduce delays in the inspection of files? (Choose two.)

  A. Juniper ATP Cloud allows the creation of allowlists.
  B. Juniper ATP Cloud uses a single antivirus software package to analyze files.
  C. Juniper ATP Cloud allows end users to bypass the inspection of files.
  D. Juniper ATP Cloud performs a cache lookup on files.
  A. Juniper ATP Cloud allows the creation of allowlists.
  D. Juniper ATP Cloud performs a cache lookup on files.

  ---

  Explanation

  Juniper ATP Cloud is a cloud-based service that provides advanced threat prevention and detection for your network. It integrates with SRX Series firewalls and MX Series routers to analyze files and network traffic for signs of malicious activity. Two functions that Juniper ATP Cloud performs to reduce delays in the inspection of files are: Juniper ATP Cloud allows the creation of allowlists: Allowlists are lists of trusted files or file hashes that are excluded from scanning by Juniper ATP Cloud. You can create allowlists based on file name, file type, file size, file hash, or sender domain. By using allowlists, you can reduce the number of files that need to be uploaded to Juniper ATP Cloud for analysis and improve the performance and efficiency of your network. Juniper ATP Cloud performs a cache lookup on files: Cache lookup is a process that checks if a file has been previously scanned by Juniper ATP Cloud and if there is a cached verdict for it. If there is a cached verdict, Juniper ATP Cloud returns it immediately without scanning the file again. If there is no cached verdict, Juniper ATP Cloud uploads the file for analysis. By using cache lookup, you can reduce the time and bandwidth required for scanning files by Juniper ATP Cloud.

  References: [Juniper Advanced Threat Prevention Cloud (ATP Cloud)], [Configuring Allowlists], [Understanding Cache Lookup]

• Question 2:

  You want to use IPS signatures to monitor traffic.

  Which module in the AppSecure suite will help in this task?

  A. AppTrack
  B. AppQoS
  C. AppFW
  D. APPID
  C. AppFW

  ---

  Explanation

  The AppFW module in the AppSecure suite provides IPS signatures that can be used to monitor traffic and detect malicious activities. AppFW also provides other security controls such as Web application firewall, URL filtering, and application-level visibility.

• Question 3:

  Exhibit

  

  Referring to the exhibit, which two statements are true? (Choose two.)

  A. Nancy logged in to the juniper.net Active Directory domain.
  B. The IP address of Nancy's client PC is 172.25.11.
  C. The IP address of the authenticating domain controller is 172.25.11.140.
  D. Nancy is a member of the Active Directory sales group.
  C. The IP address of the authenticating domain controller is 172.25.11.140.

  ---

  Explanation

• Question 4:

  You have implemented a vSRX in your VMware environment. You want to implement a second vSRX Series device and enable chassis clustering.

  Which two statements are correct in this scenario about the control-link settings? (Choose two.)

  A. In the vSwitch security settings, accept promiscuous mode.
  B. In the vSwitch properties settings, set the VLAN ID to None.
  C. In the vSwitch security settings, reject forged transmits.
  D. In the vSwitch security settings, reject MAC address changes.
  C. In the vSwitch security settings, reject forged transmits.
  D. In the vSwitch security settings, reject MAC address changes.

  ---

  Explanation

• Question 5:

  Which two statements are correct about AppTrack? (Choose two.)

  A. AppTrack can be configured for any defined logical system on an SRX Series device.
  B. AppTrack identifies and blocks traffic flows that might be malicious regardless of the ports being used.
  C. AppTrack collects traffic flow information including byte, packet, and duration statistics.
  D. AppTrack can only be configured in the main logical system on an SRX Series device.
  A. AppTrack can be configured for any defined logical system on an SRX Series device.
  C. AppTrack collects traffic flow information including byte, packet, and duration statistics.

  ---

  Explanation

  AppTrack is a feature that allows you to monitor and analyze the application traffic on your SRX Series device. It can be configured for any defined logical system, which is a virtual router or switch within a physical device. AppTrack collects statistics such as bytes, packets, and duration for each application flow and displays them in reports or logs. AppTrack does not identify or block malicious traffic, that is the function of AppSecure or IDP/IPS.

  References: JNCIS-SEC Certification, Open Learning - Security, Specialist (JNCIS-SEC), Application Security Theory

• Question 6:

  How does the SSL proxy detect if encryption is being used?

  A. It uses application identity services.
  B. It verifies the length of the packet
  C. It queries the client device.
  D. It looks at the destination port number.
  D. It looks at the destination port number.

  ---

  Explanation

  The SSL proxy can detect if encryption is being used by looking at the destination port number of the packet. If the port number is 443, then the proxy can assume that the packet is being sent over an encrypted connection. If the port number

  is different, then the proxy can assume that the packet is not encrypted. For more information, please refer to the Juniper Networks JNCIS-SEC Study Guide.

  Juniper Networks Security, Specialist (JNCIS-SEC) Study Guide,

  Chapter 6:

  SSL Proxy, page 6-9.

  The SSL proxy is a security feature that provides visibility and control over SSL/TLS encrypted traffic. When SSL proxy is enabled, it intercepts SSL/TLS traffic and decrypts it to allow visibility into the content of the encrypted traffic. However,

  before decrypting the traffic, the SSL proxy must first determine if the traffic is encrypted.

  To detect if encryption is being used, the SSL proxy looks at the destination port number. If the destination port number is a known SSL/TLS port (e.g., TCP port 443), the SSL proxy assumes that encryption is being used and intercepts the

  traffic. If the destination port is not a known SSL/TLS port, the SSL proxy does not intercept the traffic and allows it to pass through the device unmodified.

• Question 7:

  Which two statements are true about mixing traditional and unified security policies? (Choose two.)

  A. When a packet matches a unified security policy, the evaluation process terminates
  B. Traditional security policies must come before unified security policies
  C. Unified security policies must come before traditional security policies
  D. When a packet matches a traditional security policy, the evaluation process terminates
  A. When a packet matches a unified security policy, the evaluation process terminates
  D. When a packet matches a traditional security policy, the evaluation process terminates

  ---

  Explanation

• Question 8:

  You need to deploy an SRX Series device in your virtual environment.

  In this scenario, what are two benefits of using a CSRX? (Choose two.)

  A. The cSRX supports Layer 2 and Layer 3 deployments.
  B. The cSRX default configuration contains three default zones: trust, untrust, and management.
  C. The cSRX supports firewall, NAT, IPS, and UTM services.
  D. The cSRX has low memory requirements.
  C. The cSRX supports firewall, NAT, IPS, and UTM services.
  D. The cSRX has low memory requirements.

  ---

  Explanation

  Two benefits of using a cSRX in your virtual environment are: The cSRX supports firewall, NAT, IPS, and UTM services: The cSRX is a containerized version of the SRX Series firewall that runs as a Docker container on Linux hosts. It provides the same features and functionality as the SRX Series physical firewalls, such as firewall, NAT, IPS, and UTM services. The cSRX can protect your virtual workloads and applications from various threats and attacks. The cSRX has low memory requirements: The cSRX is designed to be lightweight and efficient, with low memory and CPU requirements. The cSRX can run on as little as 1 GB of RAM and 1 vCPU, making it suitable for resource-constrained environments.

  References: cSRX Overview, cSRX Container Firewall Datasheet

• Question 9:

  You are experiencing excessive packet loss on one of your two WAN links route traffic from the degraded link to the working link

  Which AppSecure component would you use to accomplish this task?

  A. AppFW
  B. AppQoE
  C. AppQoS
  D. APBR
  D. APBR

  ---

  Explanation

  APBR (Application Path-Based Routing) is an AppSecure component which can be used to route traffic from the degraded link to the working link in order to reduce packet loss. APBR is a policy-based routing solution that allows you to configure rules to direct traffic to the most appropriate path, based on application, user, or network metrics.

• Question 10:

  Which two statements are correct about Juniper ATP Cloud? (Choose two.)

  A. Once the target threshold is met, Juniper ATP Cloud continues looking for threats from 0 to 5 minutes.
  B. Once the target threshold is met, Juniper ATP Cloud continues looking for threats levels range from 0 to 10 minutes.
  C. The threat levels range from 0-10.
  D. The threat levels range from 0-100.
  A. Once the target threshold is met, Juniper ATP Cloud continues looking for threats from 0 to 5 minutes.
  C. The threat levels range from 0-10.

  ---

  Explanation

  According to the Juniper Networks JNCIS-SEC Study Guide, Juniper ATP Cloud sets target thresholds for security events and then continuously scans the environment for any activity that exceeds this threshold. Once the threshold is met, Juniper ATP Cloud continues looking for threats for a period of 0 to 5 minutes. The threat levels range from 0 to 10, with 0 being the lowest and 10 being the highest.