Security, Professional (JNCIP-SEC)

How does the SRX5800, in transparent mode, signal failover to the connected switches?

Your manager asks you to show which attacks have been detected on your SRX Series device using the
IPS feature.

Which command would you use to accomplish this task?

Which two are required for the SRX device to perform DNS doctoring? (Choose two.)

What is the default action for an SRX device in transparent mode to determine the outgoing interface for an unknown destination MAC address?

Click the Exhibit button.

[edit security idp-policy test]
user@host# show
rulebase-ips {
rule R3 {
match {
source-address any;
destination-address any;
attacks {
predefined-attacks FTP:USER:ROOT;
}
}
then {
action {
recommended;
}
}
terminal;
}
rule R4 {
match {
source-address any;
destination-address any;
attacks {
predefined-attacks HTTP:HOTMAIL:FILE-UPLOAD;
}
}
then {
action {
recommended;
}
}
}
}

You have just committed the new IDP policy shown in the exhibit. However, you notice no action is taken on traffic matching the R4 IDP rule.

Which two actions will resolve the problem? (Choose two.)

-- Exhibit --
security {
nat {
destination {
pool Web-Server {
address 10.0.1.5/32;
}
rule-set From-Internet {
from zone Untrust;
rule To-Web-Server {
match {
source-address 0.0.0.0/0;
destination-address 172.16.1.7/32;
}
then {
destination-nat pool Web-Server;
}
}
}
}
}
zones {

security-zone Untrust {
address-book {
address Web-Server-External 172.16.1.7/32;
address Web-Server-Internal 10.0.1.5/32;
}
interfaces {
ge-0/0/0.0;
}
}
security-zone DMZ {
address-book {
address Web-Server-External 172.16.1.7/32;
address Web-Server-Internal 10.0.1.5/32;
}
interfaces {
ge-0/0/1.0;
}
}
}
}
-- Exhibit --

You are migrating from one external address block to a different external address block. You want to enable a smooth transition to the new address block. You temporarily want to allow external users to contact the Web server using both the existing external address as well as the new external address
192.168.1.1.

How do you accomplish this goal?

You are asked to deploy dynamic VPNs between the corporate office and remote employees that work from home. The gateway device at the corporate office consists of a pair of SRX650s in a chassis cluster.

Which two statements about the deployment are true? (Choose two.)

Click the Exhibit button.

user@host> show security ike security-associations
Index State Initiator cookie Responder cookie Mode Remote Address
3271043 UP 7f42284089404673 95fd8408940438d8 Main 172.31.50.2

user@host> show security ipsec security-associations
Total active tunnels: 0

user@host> show log phase2
Feb 2 14:21:18 host kmd[1088]: IKE negotiation failed with error: TS unacceptable. IKE Version: 1, VPN:
vpn-1 Gateway: gate-1, Local: 172.31.50.1/500, Remote: 172.31.50.2/500, Local IKE-ID: 172.31.50.1,
Remote IKE-ID: 172.31.50.2, VR-ID: 0
Feb 2 14:21:18 host kmd[1088]: KMD_VPN_TS_MISMATCH: Traffic-selector mismatch, vpn name: vpn-1,
Peer Proposed traffic-selector local-ip: ipv4(2.2.2.2), Peer Proposed traffic-selector remote-ip: ipv4
(1.1.1.1)
Feb 2 14:21:54 host kmd[1088]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1,
VPN: vpn-1 Gateway: gate-1, Local:
172.31.50.1/500, Remote: 172.31.50.2/500, Local IKE-ID: 172.31.50.1, Remote IKE-ID: 172.31.50.2, VR-
ID: 0
Feb 2 14:22:19 host kmd[1088]: KMD_VPN_TS_MISMATCH: Traffic-selector mismatch, vpn name: vpn-1,
Peer Proposed traffic-selector local-ip:
ipv4 (2.2.
2.2), Peer Proposed traffic-selector remote-ip: ipv4(1.1.1.1)

You have recently configured an IPsec VPN between an SRX Series device and another non-Junos security device. The phase one tunnel is up but the phase two tunnel is not present.

Referring to the exhibit, what is the cause of this problem?

Click the Exhibit button.

IPv6 to IPv4 addresses are not being translated as shown in the exhibit.

Which two configurations would resolve the problem? (Choose two.)

Exhibit:

You are asked to implement the AppFW feature on an SRX Series device.

Which three tasks must be performed to make the feature work? (Choose three.)