Juniper JN0-633 Online Practice Questions and Exam Preparation

Juniper JN0-633 Online Questions & Answers

• Question 1:

  Click the Exhibit button.

  user@host> show log message

  Feb 4 00:04:17 host rpd[4516]: EVENT st0.0 index 76 Feb 4 00:04:17 host-kmd[1391]: KMD_PM_SA ESTABLISHED: Local gateway:

  192.168.10.1, Remote gateway: 192.168.10.3, Local ID: ipv4_subnet(any:0, [0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x8d5816fd, AUX-SPI: 0, Mode: Tunnel, Type:

  dynamic, Traffic-selector:

  Feb 4 00:04:17 host rpd[4516]: EVENT UpDown st0.0 index 76 10.10.10.1/24 > (null)

  Feb 4 00:04:17 host kmd[1391]: KMD_PM_SA_ESTABLISHED: Local gateway:

  192.168.10.1, Remote gateway: 192.168.10.3, Local ID: ipv4_subnet(any:0, [0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0x77f07d5c, AUX-SPI: 0, Mode: Tunnel, Type:

  dynamic, Traffic-selector:

  Feb 4 00:04:17 host kmd[1391]: KMD_VPN_UP_ALARM_USER: VPN to-spoke-1 from 192.168.10.3 is up. Local-ip: 192.168.10.1, gateway name: spoke-1, vpn name:

  to-spoke-1, tunnel-id: 131073, local tunnel-if: st0.0, remote tunnel-ip:

  10.10.10.3, Local IKE-ID: 192.168.10.1, Remote IKE-ID: 192.168.10.3, XAUTH username: Not-Applicable, VR id: 0, Traffic-selector: , Traffic-selector local ID: ipv4_subnet,(any:0,[0..7]=0.0.0.0/0), Traffic-selector remote ID:

  ipv4_subnet(any:11,[0..7]=0.0.0.0/0)

  Feb 4 00:04:17 host mib2d[1385]: SNMP_TRAP_LINK_UP: ifIndex 539, ifAdminSiLatus up(1), ifOperStatus up(1), ifName st0.0

  Feb 4 00:04:17 host kmd[1391]: KMD_PM_SA_ESTABLTSHED: Local gateway:

  192.168.10.1, Remote gateway: 192.168.10.5, Local ID: ipv4 subnet(any:0, [0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x2790a42c, AUX-SPI: 0, Mode: Tunnel, Type:

  dynamic, Traffic-selector:

  Feb 4 00:04:17 host kmd[1391]: KMD_PM_SA_ESTABLISHED: Local gateway:

  192.168.10.1, Remote gateway: 192.168.10.5, Local ID: ipv4_subnet(any:0, [0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0x2df17ea8, AUX-SPI: 0, Mode: Tunnel, Type:

  dynamic, Traffic-selector:

  Feb 4 00:04:17 host kmd[1391]: KMD_VPN_UP_ALARM_USER: VPN to-spoke-3 from 192.168.10.5 is up. Local-ip: 192.168.10.1, gateway name: spoke-3, vpn name:

  to-spoke-3, tunnel-id: 131076, local tunnel-if: st0.0, remote tunnel-ip:

  Not-Available, Local IKE-ID: 192.168.10.1, Remote IKE-ID: 192.168.10.5, XAUTH username: Not-Applicable, VR id: 0, Traffic-selector: , Traffic- selector local TD: ipv4_subnet (any:0,[0..7]=0.0.0.0/0), Traffic-selector remote ID: ipv4_subnet

  (any:0,[0._7]=0.0.0.0/0) Feb 4 00:04:17 host kmd[1391]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1, VPN: to-spoke-2 Gateway: spoke-2, Local:

  192.168.10.1/500, Remote: 192.168.10.4/500, Local IKE-ID: Not-Available, Remote Not-Available, VR-ID:

  Referring to the exhibit, which statement is correct?

  to-spoke-3 VPN is failing.

  A. The phase 1 security association for the to-spoke-3 VPN is failing.
  B. The phase 2 security association for the to-spoke-1 VPN is failing.
  C. The phase 2 security association for the to-spoke-3 VPN is failing.
  D. The phase 1 security association for the to-spoke-2 VPN is failing.
  B. The phase 2 security association for the to-spoke-1 VPN is failing.

• Question 2:

  Click the Exhibit button.

  In the exhibit, the SRX device has hosts connected to interface ge-0/0/1 and ge-0/0/6. The devices are not able to ping each other. What is causing this behavior?

  Exhibit:

  

  A. The interfaces must be in trunk mode.
  B. The interfaces need to be configured for Ethernet switching.
  C. The default security policy does not apply to transparent mode.
  D. A bridge domain has not been defined.
  D. A bridge domain has not been defined.

• Question 3:

  Click the Exhibit button. user @host> show bgp summary logical-system LSYS1 Groups : 11 Peers : 10 Down peers: 1 Table Tot. Paths Act Paths Suppressed History Damp State Pending inet.0 141 129 0 0 0 Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...

  192.168.64.12 65008 11153 11459 0 26 3d

  3:10:43 9/10/10/0 0/0/0/0

  192.168.72.12 65009 11171 11457 0 26 3d

  3:10:39 11/12/12/0 0/0/0/0

  192.168.80.12 65010 9480 9729 0 27 3d

  3:10:42 11/12/12/0 0/0/0/0

  192.168.88.12 65011 11171 11457 0 25 3d

  3:10:31 12/13/13/0 0/0/0/0

  192.168.96.12 65012 9479 9729 0 26 3d

  3:10:34 12/13/13/0 0/0/0/0

  192.168.10.12 65013 111689 11460 0 27 3d

  3:10:46 9/10/10/0 0/0/0/0

  192.168.11.12 65014 111688 11458 0 25 3d

  3:10:42 9/10/10/0 0/0/0/0

  192.168.12.12 65015 111687 11457 0 25 3d

  3:10:38 9/10/10/0 0/0/0/0

  192.68.11.12 650168 9478 9729 0 25 3d

  3:10:42 9/10/10/0 0/0/0/0

  192.168.13.12 65017 111687 11457 0 27 3d

  3:10:30 9/10/10/0 0/0/0/0

  192.168.16.12 65017 111687 11457 0 27 1w3d2h

  Connect

  user@host> show interfaces ge-0/0/7.0 extensive

  Logical interface ge-0/0/7.0 (Index 76) (SNMP ifIndex 548) (Generation 141) ...

  Security: Zone: log

  Allowed host-inbound traffic : bootp dns dhcp finger ftp tftp ident-reset http https ike netconf ping reverse-telnet reverse-ssh rloqin rpm rsh snmp

  snmp-trap ssh telnet traceroute xnm-clear-text xnm-ssl lsping ntp sip r2cp

  Flow Statistics:

  Flow Input statistics:

  Self packets: 0

  ICMP packets: 0

  VPN packets: 0

  Multicast packets: 0

  Bytes permitted by policy: 0

  Connections established: 0

  Flow Output statistics:

  Multicast packets: 0

  Bytes permitted by policy: 0

  Flow error statistics (Packets dropped due to):

  Address spoofing: 0

  Authentication failed: 0

  Incoming NAT errors: 0

  Invalid zone received packet: 0

  Multiple user authentications: 0

  Multiple incoming NAT: 0

  No parent for a gate: 0

  No one interested in self pakets: 0

  No minor session: 0

  No more sessions: 589723

  No NAT gate: 0

  No route present: 0

  No SA for incoming SPI: 0

  No tunnel found: 0

  No session for a gate: 0

  No zone or NULL zone binding 0

  Policy denied: 0

  Security association not active: 0

  TCP sequence number out of window: 0

  Syn-attack protection: 0

  User authentication errors: 0

  Protocol inet, MTU: 1500, Generation: 1685, Route table: 0 Flags: Sendbcast-pkt-to-re

  Addresses, F1ags: Is-Preferred Is-Primary

  Destination: 10.5.123/24, Local: 10.5.123.3, Broadcast:

  10.5.123.255, Generation: 156

  Protocol multiservice, MTU: Unlimited, Generation: 1686, Route table: 0 Policer: Input: __default_arp_policer__

  ...

  ...

  An SRX Series device has been configured with a logical system LSYS1. One of the BGP peers is down.

  Referring to the exhibit, which statement explains this problem?

  A. The LSYS license only allows up to ten BGP peerings.
  B. The maximum number of allowed flows is set to low.
  C. The allocated memory is not sufficient for this LSYS.
  D. The minimum number of flows is set to high.
  B. The maximum number of allowed flows is set to low.

• Question 4:

  A branch SRX Series device in flow mode is forwarding between two virtual routers using a paired set of logical tunnel interfaces. You have a server connected to one virtual router and the client is on the other virtual router.

  How many security policies are needed to connect from the client to the server across the logical tunnel link?

  B. 2
  C. 3
  D. 1
  D. 1

• Question 5:

  Click the Exhibit button.

  You must configure two SRX devices to enable bidirectional communications between the two networks shown in the exhibit. You have been allocated the 172.16.1.0/24 and 172.16.2.0/24 networks to use for this purpose.

  Which configuration will accomplish this task?

  Exhibit:

  

  A. Use an IPsec VPN to connect the two networks and hide the addresses from the Internet.
  B. Using destination NAT, translate traffic destined to 172.16.1.0/24 to Site1's addresses, and translate traffic destined to 172.16.2.0/24 to Site2's addresses.
  C. Using source NAT, translate traffic from Site1's addresses to 172.16.1.0/24, and translate traffic from Site2's addresses to 172.16.2.0/24.
  D. Using static NAT, translate traffic destined to 172.16.1.0/24 to Site1's addresses, and translate traffic destined to 172.16.2.0/24 to Site2's addresses.
  D. Using static NAT, translate traffic destined to 172.16.1.0/24 to Site1's addresses, and translate traffic destined to 172.16.2.0/24 to Site2's addresses.

• Question 6:

  Somebody has inadvertently configured several security policies with application firewall rule sets on an SRX device. These security policies are now dropping traffic that should be allowed. You must find and remove the application firewall rule sets that are associated with these policies. Which two commands allow you to view these associations? (Choose two.)

  A. show security policies
  B. show services application-identification application-system-cache
  C. show security application-firewall rule-set all
  D. show security policies application-firewall
  A. show security policies
  D. show security policies application-firewall

• Question 7:

  You want to route traffic between two newly created virtual routers without the use of logical systems using the configuration options on the SRX5800.

  Which two methods of forwarding, between virtual routers, would you recommend? (Choose two.)

  A. Use a static route to forward traffic across virtual routers using the next-table option. Enable the return route by using a RIB group. next-table command.
  B. Create static routes in each virtual router using the
  C. Use a RIB group to share the internal routing protocol routes from the master routing instance.
  D. Connect a direct cable between boo physical interfaces, one in each virtual router and use next-hop command. static routes with the
  B. Create static routes in each virtual router using the
  D. Connect a direct cable between boo physical interfaces, one in each virtual router and use next-hop command. static routes with the

• Question 8:

  You are asked to ensure that your IPS engine blocks attacks. You must ensure that your system continues to drop additional malicious traffic without additional IPS processing for up to 30 minutes. You must ensure that the SRX Series device does send a notification packet when the traffic is dropped.

  Which statement is correct?

  A. Use the IP-Block action.
  B. Use the Drop Packet action.
  C. Use the Drop Connection action.
  D. Use the IP-Close action.
  D. Use the IP-Close action.

• Question 9:

  Your company is providing multi-tenant security services on an SRX5800 cluster. You have been asked to create a new logical system (LSYS) for a customer. The customer must be able to access and manage new resources within their

  LSYS.

  How do you accomplish this goal?

  A. Create the new LSYS, allocate resources, and then create the user administrator role so that the customer can manage their allocated resources.
  B. Create the new LSYS, and then create the user administrator role so that the customer can allocate and manage resources.
  C. Create the new LSYS, and then create the master adminstrator role for the LSYS so that the customer can allocate and manage resources.
  D. Create the new LSYS, then request the required resources from the customer, and create the required resources.
  A. Create the new LSYS, allocate resources, and then create the user administrator role so that the customer can manage their allocated resources.

• Question 10:

  You are asked to change the configuration of your company's SRX device so that you can block nested traffic from certain Web sites, but the main pages of these Web sites must remain available to users. Which two methods will accomplish this goal? (Choose two.)

  A. Enable the HTTP ALG.
  B. Implement a firewall filter for Web traffic.
  C. Use an IDP policy to inspect the Web traffic.
  D. Configure an application firewall rule set.
  B. Implement a firewall filter for Web traffic.
  D. Configure an application firewall rule set.