Juniper JN0-633 Online Practice Questions and Exam Preparation

Juniper JN0-633 Online Questions & Answers

• Question 111:

  You are using the AppDoS feature to control against malicious bot client attacks. The bot clients are using file downloads to attack your server farm. You have configured a context value rate of 10,000 hits in 60 seconds. At which threshold will the bot clients no longer be classified as malicious?

  A. 5000 hits in 60 seconds
  B. 8000 hits in 60 seconds
  C. 7500 hits in 60 seconds
  D. 9999 hits in 60 seconds
  B. 8000 hits in 60 seconds

• Question 112:

  -- Exhibit -security {

  nat {

  destination {

  pool Web-Server {

  address 10.0.1.5/32;

  }

  rule-set From-Internet {

  from zone Untrust;

  rule To-Web-Server {

  match {

  source-address 0.0.0.0/0;

  destination-address 172.16.1.7/32;

  }

  then {

  destination-nat pool Web-Server;

  }

  }

  }

  }

  }

  zones {

  security-zone Untrust {

  address-book {

  address Web-Server-External 172.16.1.7/32;

  address Web-Server-Internal 10.0.1.5/32;

  }

  interfaces {

  ge-0/0/0.0;

  }

  }

  security-zone DMZ {

  address-book {

  address Web-Server-External 172.16.1.7/32;

  address Web-Server-Internal 10.0.1.5/32; } interfaces { ge-0/0/1.0; } } } } -- Exhibit -

  You are migrating from one external address block to a different external address block. You want to enable a smooth transition to the new address block. You temporarily want to allow external users to contact the Web server using both the existing external address as well as the new external address 192.168.1.1.

  How do you accomplish this goal?

  A. Add address 192.168.1.1/32 under [edit security nat destination pool Web-Server].
  B. Change the address Web-Server-Ext objects to be address-set objects that include both addresses.
  C. Change the destination address under [edit security nat destination rule-set From-Internet rule To-Web- Server match] to include both 172.16.1.7/32 and 192.168.1.2/32.
  D. Create a new rule for the new address in the [edit security nat destination rule-set From- Internet] hierarchy.
  D. Create a new rule for the new address in the [edit security nat destination rule-set From- Internet] hierarchy.

• Question 113:

  You want requests from the same internal transport address to be mapped to the same external transport address. Only internal hosts can initialize the session. Which Junos configuration setting supports the requirements?

  A. any-remote-host
  B. target-host
  C. source-host
  D. address-persistent
  D. address-persistent

• Question 114:

  Click the Exhibit button.

  user@host# show interfaces

  ge-0/0/0 {

  unit 1 {

  family bridge {

  interface-mode trunk;

  vlan-id-list 20;

  vlan-rewrite {

  translate 2 20;

  }

  }

  }

  }

  Referring to the exhibit, which two statements are correct regarding VLAN rewrite? (Choose two.)

  A. An incoming packet with VLAN tag 20 will be translated to VLAN tag 2.
  B. An outgoing packet with VLAN tag 2 will be translated to VLAN tag 20.
  C. An incoming packet with VLAN tag 2 will be translated to VLAN tag 20.
  D. An outgoing packet with VLAN tag 20 will be translated to VLAN tag 2.
  C. An incoming packet with VLAN tag 2 will be translated to VLAN tag 20.

• Question 115:

  Where does the AppSecure suite of functions occur in the security flow process on an SRX Series device?

  A. services
  B. security policy
  C. NAT
  D. session initiation
  A. services

• Question 116:

  What is a benefit of using a dynamic VPN?

  A. It provides a layer of redundancy on top of a point-to-point VPN mesh architecture.
  B. It eliminates the need for point-to-point VPN tunnels.
  C. It provides a way to grant VPN access on a per-user-group basis.
  D. It simplifies IPsec access for remote clients.
  D. It simplifies IPsec access for remote clients.

• Question 117:

  You have installed a new IPS license on your SRX device and successfully downloaded the attack signature database. However, when you run the command to install the database, the database fails to install. What are two reasons for the failure? (Choose two.)

  A. The file system on the SRX device has insufficient free space to install the database.
  B. The downloaded signature database is corrupt.
  C. The previous version of the database must be uninstalled first.
  D. The SRX device does not have the high memory option installed.
  A. The file system on the SRX device has insufficient free space to install the database.
  B. The downloaded signature database is corrupt.

• Question 118:

  You are performing AppSecure traffic processing to enforce AppFW.

  What happens when traffic matching an established security session is newly detected as a different application?

  A. The security processing facility of the data plane re-examines the whitelist or blacklist referenced in the security policy to see if the new application is permitted.
  B. The newly detected application will not be permitted and session will be torn down unless a specific match exists against the exempt rulebase.
  C. Zone-based firewall rules will be re-parsed to determine if a rule exists that permits the newly detected application.
  D. The application will not be permitted if doing so would violate the session limit in the screen properties applied to that zone.
  B. The newly detected application will not be permitted and session will be torn down unless a specific match exists against the exempt rulebase.

• Question 119:

  You are asked to design a solution to verify IPsec peer reachability with data path forwarding. Which feature would meet the design requirements?

  A. DPD over Phase 1 SA
  B. DPD over Phase 2 SA
  C. VPN monitoring over Phase 1 SA
  D. VPN monitoring over Phase 2 SA
  D. VPN monitoring over Phase 2 SA

• Question 120:

  You are asked to implement a point-to-multipoint hub-and-spoke topology in a mixed vendor environment. The hub device is running the Junos OS and the spoke devices are different vendor devices. Regarding this scenario, which statement is correct?

  A. The NHTB table must be statically defined.
  B. The NHTB table is automatically created during Phase 2.
  C. The NHTB table is automatically created during Phase 1.
  D. The NHTB table must be imported from each spoke.
  A. The NHTB table must be statically defined.