Juniper JN0-633 Online Practice Questions and Exam Preparation

Juniper JN0-633 Online Questions & Answers

• Question 101:

  Click the Exhibit button.

  Traffic is being sent from Host-1 to Host-2 through an IPsec VPN. In this process, SRX-2 is using NAT to change the destination address of Host-2 from 192.168.1.1 to 10.60.60.1 SRX-1 uses the 172.31.50.1 address for its tunnel endpoint

  and SRX-2 uses the 10.10.50.1 address for its tunnel endpoint.

  Referring to the exhibit, which statement is true?

  Exhibit:

  

  A. The security policy on SRX-2 must permit traffic from the 172.31.50.1 destination address.
  B. The security policy on SRX-2 must permit traffic from the 10.10.50.1destination address.
  C. The security policy on SRX-2 must permit traffic from the 10.60.60.1 destination address.
  D. The security policy on SRX-2 must permit traffic from the 192.168.1.1destination address.
  C. The security policy on SRX-2 must permit traffic from the 10.60.60.1 destination address.

• Question 102:

  Click the Exhibit button.

  Based on the output shown in the exhibit, what are two results? (Choose two.)

  Exhibit:

  

  A. The output shows source NAT.
  B. The output shows destination NAT.
  C. The port information is changed.
  D. The port information is unchanged.
  B. The output shows destination NAT.
  D. The port information is unchanged.

• Question 103:

  You are troubleshooting an IPsec session and see the following IPsec security associations:

  ID Gateway Port Algorithm SPI Life:sec/kb Mon vsys

  < 192.168.224.1 500 ESP:aes-256/sha1 d6393645 26/ unlim - 0 > 192.168.224.1 500 ESP:aes-256/sha1 153ec235 26/ unlim - 0 < 192.168.224.1 500 ESP:aes-256/sha1 f9a2db9a 3011/ unlim - 0 > 192.168.224.1 500 ESP:aes-256/sha1 153ec236 3011/ unlim - 0

  What are two reasons for this behavior? (Choose two.)

  A. Both peers are trying to establish IKE Phase 1 but are not successful.
  B. Both peers have established SAs with one another, resulting in two IPsec tunnels.
  C. The lifetime of the Phase 2 negotiation is close to expiration.
  D. Both peers have establish-tunnels immediately configured.
  C. The lifetime of the Phase 2 negotiation is close to expiration.
  D. Both peers have establish-tunnels immediately configured.

• Question 104:

  You are troubleshooting an SRX240 acting as a NAT translator for transit traffic. Traffic is dropping at the SRX240 in your network. Which three tools would you use to troubleshoot the issue? (Choose three.)

  A. security flow traceoptions
  B. monitor interface traffic
  C. show security flow session
  D. monitor traffic interface
  E. debug flow basic
  A. security flow traceoptions
  B. monitor interface traffic
  C. show security flow session

• Question 105:

  -- Exhibit -user@srx# show security datapath-debug

  capture-file pkt-cap-file format pcap size 5m;

  action-profile {

  pkt-cap-profile {

  event np-ingress {

  packet-dump;

  }

  }

  }

  packet-filter pkt-filter {

  action-profile pkt-capture;

  source-prefix 1.2.3.4/32;

  }

  -- Exhibit -

  You want to capture transit traffic passing through your SRX3600. You add the configuration shown in the exhibit but do not see entries added to the capture file.

  What is causing the problem?

  A. You are missing the configuration set security datapath-debug maximum-capture-size 1500.
  B. You are missing the configuration set security datapath-debug packet-filter pkt-filter destination-prefix 5.6.7.8/32.
  C. You must start the capture from operational mode with the command request security datapath-debug capture start.
  D. You must start the capture from operational mode with the command monitor start capture.
  C. You must start the capture from operational mode with the command request security datapath-debug capture start.

• Question 106:

  You are asked to implement a monitoring feature that periodically verifies that the data plane is working across your IPsec VPN. Which configuration will accomplish this task?

  A. [edit security ike] user@srx# show policy policy-1 { mode main; proposal-set standard; pre-shared-key ascii-text "$9$URiqPFnCBIc5QIcylLXUjH"; ## SECRET-DATA } gateway my-gateway { ike-policy policy-1; address 10.10.10.2; dead-peer-detection; external-interface ge-0/0/1; }
  B. [edit security ipsec] user@srx# show policy policy-1 { proposal-set standard; } vpn my-vpn { bind-interface st0.0; dead-peer-detection; ike { gateway my-gateway; ipsec-policy policy-1; } establish-tunnels immediately; }
  C. [edit security ike] user@srx# show policy policy-1 { mode main; proposal-set standard; pre-shared-key ascii-text "$9$URiqPFnCBIc5QIcylLXUjH"; ## SECRET-DATA } gateway my-gateway { ike-policy policy-1; address 10.10.10.2; vpn-monitor; external-interface ge-0/0/1; }
  D. [edit security ipsec] user@srx# show policy policy-1 { proposal-set standard; } vpn my-vpn { bind-interface st0.0; vpn-monitor; ike { gateway my-gateway; ipsec-policy policy-1; } establish-tunnels immediately; }
  D. [edit security ipsec] user@srx# show policy policy-1 { proposal-set standard; } vpn my-vpn { bind-interface st0.0; vpn-monitor; ike { gateway my-gateway; ipsec-policy policy-1; } establish-tunnels immediately; }

• Question 107:

  Click the Exhibit button.

  You receive complaints from users that their Web browsing sessions keep dropping prematurely. Upon investigation, you find that the IDP policy shown in the exhibit is detecting the users' sessions as HTTP:WIN-CMD:WIN-CMD-EXE attacks, even though their sessions are not actual attacks. You must allow these sessions but still inspect for all other relevant attacks.

  How would you configure your SRX device to meet this goal?

  Exhibit: A. Create a new security policy that allows HTTP for all users and does not apply IDP.

  

  B. Modify the security policy to add an application exception.
  C. Modify the IDP policy to delete this particular attack from the IDP rulebase.
  D. Modify the IDP policy to add an exempt rulebase rule to not inspect for this attack.
  D. Modify the IDP policy to add an exempt rulebase rule to not inspect for this attack.

• Question 108:

  Your manager asks you to show which attacks have been detected on your SRX Series device using the IPS feature.

  Which command would you use to accomplish this task?

  A. show security idp attack detail
  B. show security idp attack table
  C. show security idp memory
  D. show security idp counters
  B. show security idp attack table

• Question 109:

  What are three techniques to mark DSCP values on an SRX Series device? (Choose three.)

  A. IDP attack action-based DSCP rewriters
  B. 802.11Q
  C. VLAN rewrite
  D. ALG-based DSCP rewriters
  E. Layer 7 application-based DSCP rewriters.
  A. IDP attack action-based DSCP rewriters
  D. ALG-based DSCP rewriters
  E. Layer 7 application-based DSCP rewriters.

• Question 110:

  Which statement is true about Layer 2 zones when implementing transparent mode security?

  A. All interfaces in the zone must be configured with the protocol family mpls.
  B. All interfaces in the zone must be configured with the protocol family inet.
  C. All interfaces in the zone must be configured with the protocol family bridge.
  D. All interfaces in the zone must be configured with the protocol family inet6.
  C. All interfaces in the zone must be configured with the protocol family bridge.