Juniper JN0-633 Online Practice Questions and Exam Preparation

Juniper JN0-633 Online Questions & Answers

• Question 121:

  What is a benefit of using a group VPN?

  A. It provides a layer of redundancy on top of a point-to-point VPN mesh architecture.
  B. It eliminates the need for point-to-point VPN tunnels.
  C. It provides a way to grant VPN access on a per-user-group basis.
  D. It simplifies IPsec access for remote clients.
  B. It eliminates the need for point-to-point VPN tunnels.

• Question 122:

  Click the Exhibit button

  [edit security]

  user@host# show policies

  global {

  policy new-policy {

  match {

  source-address any;

  destination-address any;

  application junos-https;

  }

  then {

  permit {

  application-services {

  application-firewall {

  rule-set appfw;

  }

  }

  }

  }

  }

  }

  [edit security]

  user@host# show application-firewall

  rule-sets appfw {

  rule 1 {

  match {

  dynamic-application junos:SSL;

  }

  then {

  permit;

  }

  }

  rule 2 {

  match {

  dynamic-application junos:HTTP;

  }

  then {

  reject;

  }

  }

  default-rule {

  permit;

  }

  }

  Referring to the exhibit, which two statements are correct? (Choose two.)

  A. HTTP traffic is permitted.
  B. HTTP traffic is dropped.
  C. HTTPS traffic is permitted.
  D. HTTPS traffic is dropped.
  B. HTTP traffic is dropped.
  C. HTTPS traffic is permitted.

• Question 123:

  Click the Exhibit button.

  Referring to the exhibit, which feature allows the hosts in the Trust and DMZ zones to route to either ISP, based on source address?

  Exhibit:

  

  A. source NAT
  B. static NAT
  C. filter-based forwarding
  D. source-based routing
  C. filter-based forwarding

• Question 124:

  Click the Exhibit button.

  Referring to the exhibit, the application firewall configuration fails to commit. What must you do to allow the configuration to commit?

  Exhibit:

  

  A. Each firewall rule set must only have one rule.
  B. A firewall rule set cannot mix dynamic applications and dynamic application groups.
  C. The action in the rules must be different than the action in the default rule.
  D. The action in the default rule must be set to deny.
  C. The action in the rules must be different than the action in the default rule.

• Question 125:

  -- Exhibit -[edit security idp]

  user@srx# show

  security-package {

  url https://services.netscreen.com/cgi-bin/index.cgi;

  automatic {

  start-time "2012-12-11.01:00:00 +0000";

  interval 120;

  enable;

  }

  }

  -- Exhibit -

  You have configured your SRX device to download and install attack signature updates as shown in the exhibit. You discover that updates are not being downloaded. What are two reasons for this behavior? (Choose two.)

  A. No security policy is configured to allow the SRX device to contact the update server.
  B. The SRX device does not have a DNS server configured.
  C. The management zone interface does not have an IP address configured.
  D. The SRX device has no Internet connectivity.
  B. The SRX device does not have a DNS server configured.
  D. The SRX device has no Internet connectivity.

• Question 126:

  You recently implemented application firewall rules on an SRX device to act upon encrypted traffic. However, the encrypted traffic is not being correctly identified. Which two actions will help the SRX device correctly identify the encrypted traffic? (Choose two.)

  A. Enable heuristics to detect the encrypted traffic.
  B. Disable the application system cache.
  C. Use the junos:UNSPECIFIED-ENCRYPTED application signature.
  D. Use the junos:SPECIFIED-ENCRYPTED application signature.
  A. Enable heuristics to detect the encrypted traffic.
  C. Use the junos:UNSPECIFIED-ENCRYPTED application signature.

• Question 127:

  You are asked to provide access for an external VoIP server to VoIP phones in your network using private addresses. However, due to security concerns, the VoIP server should only be able to initiate connections to each phone once the

  phone has logged into the VoIP server. The VoIP server requires access to the phones using multiple ports.

  Which type of persistent NAT is required?

  A. any-remote-host
  B. target-host
  C. target-host-port
  D. remote-host
  B. target-host

• Question 128:

  A security administrator has configured an IPsec tunnel between two SRX devices. The devices are configured with OSPF on the st0 interface and an external interface destined to the IPsec endpoint. The adminstrator notes that the IPsec tunnel and OSPF adjacency keep going up and down. Which action would resolve this issue?

  A. Create a firewall filter on the st0 interface to permit IP protocol 89.
  B. Configure the IPsec tunnel to accept multicast traffic.
  C. Create a /32 static route to the IPsec endpoint through the external interface.
  D. Increase the OSPF metric of the external interface.
  C. Create a /32 static route to the IPsec endpoint through the external interface.

• Question 129:

  Which two statements are true about persistent NAT? (Choose two.)

  A. The permit target-host-port statement allows an external host to initiate a session to an internal host on any port, provided the internal host previously sent a packet to the external host.
  B. The permit target-host statement allows an external host to initiate a session to an internal host on any port, provided the internal host previously sent a packet to the external host.
  C. Port overloading must be enabled for Interface-based persistent NAT.
  D. Port overloading must be disabled for Interface-based persistent NAT.
  B. The permit target-host statement allows an external host to initiate a session to an internal host on any port, provided the internal host previously sent a packet to the external host.
  D. Port overloading must be disabled for Interface-based persistent NAT.

• Question 130:

  Which configuration statement would allow the SRX Series device to match a signature only on the first match, and not subsequent signature matches in a connection?

  A. user@host# set security idp idp-policy test rulebase-ips rule 1 then action recommended
  B. user@host# set security idp idp-policy test rulebase-ips rule 1 then action ignore-connection
  C. user@host# set security idp idp-policy test rulebase-ips rule 1 then action no-action
  D. user@host# set security idp idp-policy test rulebase-ips rule 1 then action drop-connection
  B. user@host# set security idp idp-policy test rulebase-ips rule 1 then action ignore-connection