Juniper JN0-633 Online Practice Questions and Exam Preparation

Juniper JN0-633 Online Questions & Answers

• Question 91:

  An SRX Series device is configured for inline tap mode. What will occur if Drop Packet is selected?

  A. The SRX Series device drops a matching packet before it can reach its destination but does not close the connection.
  B. The SRX Series device will ignore the action Drop Packet.
  C. The SRX Series device closes the connection and sends an RST packet to both the client and the server.
  D. The SRX Series device drops a matching packet associated with the connection, preventing traffic for the connection from reaching its destination.
  D. The SRX Series device drops a matching packet associated with the connection, preventing traffic for the connection from reaching its destination.

• Question 92:

  When configuring AutoVPN, which two actions are required for an administrator to establish communication from the hub site to the spoke sites? (Choose two.)

  A. Configure the next hop tunnel binding (NHTB).
  B. Configure static routes from the hub to the spoke.
  C. Configure a dynamic routing protocol such as BGP, OSPF, or RIP on the tunnel interfaces.
  D. Create a multipoint secure tunnel interface on the hub device.
  C. Configure a dynamic routing protocol such as BGP, OSPF, or RIP on the tunnel interfaces.
  D. Create a multipoint secure tunnel interface on the hub device.

• Question 93:

  Click the Exhibit button.

  Referring to the exhibit, you must send traffic from Host-1 to Host-2. These two hosts can only communicate with IPv4.

  Which feature would you use to permit communication between Host-1 and Host-2?

  Exhibit:

  

  A. 6rd
  B. DS-Lite
  C. NAT46
  D. NAT444
  B. DS-Lite

• Question 94:

  Click the Exhibit button.

  user@host> show security flow session extensive Session ID: 1173, Status: Normal Flag: Ox0 Policy name: two/6 Source NAT pool: interface, Application: junos-ftp/1 Dynamic application: junos:UNKNOWN, Application traffic control rule-set: INVALID, Rule: INVALID Maximum timeout: 1800, Current timeout: 1756 Session State: Valid Start time: 4859, Duration: 99 In: 172.20.103.10/56457 --> 10.210.14.130/21;tcp, Interface: vlan.103, Session token: Ox8, Flag: Ox21 Route: 0x100010, Gateway: 172.20.103.10, Tunnel: 0 Port sequence: 0, FIN sequence: 0, FIN state: 0, Pkts: 12, Bytes: 549 Out: 10.210.14.130/21 --> 10.210.14.133/18698;tcp, Interface: ge-0/0/0.0, Session token: 0x7, Flag: Ox20 Route: Oxf0010, Gateway: 10.210 14.130, Tunnel: 0 Port sequence: 0, FIN sequence: 0, FIN state: 0, Pkts: 8, Bytes: 514

  Total sessions: 1

  A user complains that they are unable to download files using FTP. They are able to connect to the remote site, but cannot download any files. You investigate and execute the show security flow session extensive command to receive the result shown in the exhibit.

  What is the cause of the problem?

  A. The NAT translation is incorrect.
  B. The FTP ALG has been disabled.
  C. Passive mode FTP is not enabled.
  D. The FTP session is using the wrong port number.
  B. The FTP ALG has been disabled.

• Question 95:

  You are asked to configure class of service (CoS) on an SRX device running in transparent mode. Which command would you use?

  A. set interfaces ge-0/0/0 unit 0 classifiers dscp priority-app
  B. set class-of-service interfaces ge-0/0/0 unit 0 classifiers dscp priority-app
  C. set class-of-service interfaces ge-0/0/0 unit 0 classifiers ieee-802.1 priority-app
  D. set interfaces ge-0/0/0 unit 0 classifiers inet-precedence priority-app
  C. set class-of-service interfaces ge-0/0/0 unit 0 classifiers ieee-802.1 priority-app

• Question 96:

  The IPsec VPN on your SRX Series device establishes both the Phase 1 and Phase 2 security associations. Users are able to pass traffic through the VPN. During peak VPN usage times, users complain about decreased performance. Network connections outside of the VPN are not seriously impacted.

  Which two actions will resolve the problem? (Choose two.)

  A. Lower the MTU size on the interface to reduce the likelihood of packet fragmentation.
  B. Verify that NAT-T is not disabled in the properties of the phase 1 gateway.
  C. Lower the MSS setting in the security flow stanza for IPsec VPNs.
  D. Verify that the PKI certificate used to establish the VPN is being properly verified using either the CPL or OCSP.
  A. Lower the MTU size on the interface to reduce the likelihood of packet fragmentation.
  C. Lower the MSS setting in the security flow stanza for IPsec VPNs.

• Question 97:

  You are asked to establish a hub-and-spoke IPsec VPN using your SRX Series device as the hub. All of your spoke devices are third-party devices.

  Which statement is correct?

  A. You must create a policy-based VPN on the hub device when peering with third-party devices.
  B. You must always peer using loopback addresses when using non-Junos devices as your spokes.
  C. You must statically configure the next-hop tunnel binding table entries for each of the third- party spoke devices.
  D. You must ensure that you are using aggressive mode when incorporating third-party devices as your spokes.
  C. You must statically configure the next-hop tunnel binding table entries for each of the third- party spoke devices.

• Question 98:

  You are deploying a standalone SRX650 in transparent mode for evaluation purposes in a potential client's network. The client will need to access the device to modify security policies and perform other various configurations. Where would you configure a Layer 3 interface to meet this requirement?

  A. fxp0.0
  B. vlan.1
  C. irb.1
  D. ge-0/0/0.0
  C. irb.1

• Question 99:

  You are working as a security administrator and must configure a solution to protect against distributed botnet attacks on your company's central SRX cluster. How would you accomplish this goal?

  A. Configure AppTrack to inspect and drop traffic from the malicious hosts.
  B. Configure AppQoS to block the malicious hosts.
  C. Configure AppDoS to rate limit connections from the malicious hosts.
  D. Configure AppID with a custom application to block traffic from the malicious hosts.
  C. Configure AppDoS to rate limit connections from the malicious hosts.

• Question 100:

  You are using destination NAT to translate the address of your HTTPS server to a private address on your SRX Series device. You have decided to implement IDP SSL decryption. Upon enabling the decryption, you notice sessions are not decrypted.

  Which action resolves the problem?

  A. Replace the server SSL certificate to use the public address.
  B. Reboot the SRX Series device.
  C. Increase the SSL session-id-cache-timeout value to any value greater than 5000 seconds.
  D. Enable the IDP sensor-configuration detector to detect address translation.
  D. Enable the IDP sensor-configuration detector to detect address translation.