Juniper JN0-633 Online Practice Questions and Exam Preparation

Juniper JN0-633 Online Questions & Answers

• Question 131:

  Click the Exhibit button.

  [edit security idp-policy test]

  user@host# show

  rulebase-ips {

  rule R3 {

  match {

  source-address any;

  destination-address any;

  attacks {

  predefined-attacks FTP:USER:ROOT;

  }

  }

  then {

  action {

  recommended;

  }

  }

  terminal;

  }

  rule R4 {

  match {

  source-address any;

  destination-address any;

  attacks {

  predefined-attacks HTTP:HOTMAIL:FILE-UPLOAD;

  }

  }

  then {

  action {

  recommended;

  }

  }

  }

  }

  You have just committed the new IDP policy shown in the exhibit. However, you notice no action is taken on traffic matching the R4 IDP rule. Which two actions will resolve the problem? (Choose two.)

  A. Change the R4 rule to match on a predefined attack group.
  B. Insert the R4 rule above the R3 rule.
  C. Delete the terminal statement from the R3 rule.
  D. Change the IPS rulebase to an exempt rulebase.
  C. Delete the terminal statement from the R3 rule.

• Question 132:

  You configured a custom signature attack object to match specific components of an attack:

  HTTP-request Pattern .*\x90 90 90 ... 90 Direction: client-to-server

  Which client traffic would be identified as an attack?

  A. HTTP GET .*\x90 90 90 ... 90
  B. HTTP POST .*\x90 90 90 ... 90
  C. HTTP GET .*x909090 ... 90
  D. HTTP POST .*x909090 ... 90
  A. HTTP GET .*\x90 90 90 ... 90

• Question 133:

  An external host is attacking your network. The host sends an HTTP request to a Web server, but does not include the version of HTTP in the request. Which type of attack is being performed?

  A. signature-based attack
  B. application identification
  C. anomaly
  D. fingerprinting
  C. anomaly

• Question 134:

  user@host> show interfaces routing-instance all ge* terse Interface Admin Link Proto Local Instance ge-0/0/0.0 up up inet 172.16.12.205/24 default ge-0/0/1.0 up up inet 5.0.0.5/24 iso A ge-0/0/2.0 up up inet 25.0.0.5/24 iso B

  user@host> show security flow session Session ID: 82274, Policy name: default-policy-00/2, Timeout: 1770, Valid In: 5.0.0.25/61935 --> 25.0.0.25/23;tcp, If: ge-0/0/1.0, Pkts: 31, Bytes: 1781 Out: 25.0.0.25/23 --> 5.0.0.25/61935;tcp, If: ge-0/0/2.0, Pkts: 23, Bytes: 1452 Total sessions: 3

  user@host> show route

  inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, + = Both

  0.0.0.0/0 *[Static/5] 04:08:52 > to 172.16.12.1 via ge-0/0/0.0 172.16.12.0/24 *[Direct/0] 04:08:52 via ge-0/0/0.0 172.16.12.205/32 *[Local/0] 4w4d 23:04:29 Loca1 via ge-0/0/0.0 224.0.0.5/32 *[OSPF/10] 14:37:35, metric 1 MultiRecv

  A. inet.0: 4 destinations, 4 routes {4 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 5.0.0.0/24 5 *[Direct/0] 00:05:04 > via ge-0/0/1.0 5.0.0.5/32 *[Local/0] 00:05:04 Local via ge-0/0/1.0 25.0.0.0/24 *[Direct/0] 00:02:37 > via ge-0/0/2.0
  B. inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 5.0.0.25/32 *[Static/5] 00:02:38 to table A.inet.0 25.0.0.0/24 *[Direct/0] 00:02:37 > via ge-0/0/2.0 25.0.0.5/32 *[Local/0] 00:02:37 Local via ge-0/0/2.0
  C. The routing instances A and B are connected using an lt interface.
  D. Routing instance A's routes are shared with routing instance B.
  E. Routing instance B's routes are shared with routing instance A.
  F. The routing instances A and B are connected using a vt interface.
  C. The routing instances A and B are connected using an lt interface.

• Question 135:

  You want to implement an IPsec VPN on an SRX device using PKI certificates for authentication. As part of the implementation, you are required to ensure that the certificate submission, renewal, and retrieval processes are handled automatically from the certificate authority. Regarding this scenario, which statement is correct?

  A. You can use SCEP to accomplish this behavior.
  B. You can use OCSP to accomplish this behavior.
  C. You can use CRL to accomplish this behavior.
  D. You can use SPKI to accomplish this behavior.
  A. You can use SCEP to accomplish this behavior.

• Question 136:

  For an SRX chassis cluster in transparent mode, which action occurs to signal a high availability failover to neighboring switches?

  A. the SRX chassis cluster generates Spanning Tree messages
  B. the SRX chassis cluster generates gratuitous ARPs
  C. the SRX chassis cluster flaps the former active interfaces
  D. the SRX chassis cluster uses IP address monitoring
  C. the SRX chassis cluster flaps the former active interfaces

• Question 137:

  Click the Exhibit button.

  user@host> monitor traffic interface ge-0/0/3

  verbose output suppressed, use or for full protocol decode Address resolution is ON. Use to avoid any reverse lookup delay.

  Address resolution timeout is 4s.

  Listening on ge-0/0/3, capture size 96 bytes

  Reverse lookup for 172.168.3.254 failed (check DNS reachability). Other reverse lookup failures will not be reported.

  Use to avoid reverse lockups on IP addresses.

  19:24:16.320907 In arp who-has 172.168.3.254 tell 172.168.3.1 19.24:17.322751 In arp who has 172.168.3.254 tell 172.168.3.1 19.24:18.328895 In arp who-has 172.168.3.254 tell 172.168.3.1 19.24:18.332956 In arn who has 172.168.3.254

  tell 172.168.3.1

  A new server has been set up in your environment. The administrator suspects that the firewall is blocking the traffic from the new server. Previously existing servers in the VLAN are working correctly. After reviewing the logs, you do not see

  any traffic for the new server.

  Referring to the exhibit, what is the cause of the problem?

  Exhibit:

  

  A. The server is in the wrong VLAN.
  B. The server has been misconfigured with the wrong IP address.
  C. The firewall has been misconfigured with the incorrect routing-instance.
  D. The firewall has a filter enabled to block traffic from the server.
  C. The firewall has been misconfigured with the incorrect routing-instance.

• Question 138:

  Click the Exhibit button.

  Host traffic is traversing through an IPsec tunnel. Users are complaining of intermittent issues with their connection.

  Referring to the exhibit, what is the problem?

  Exhibit:

  

  A. The tunnel is down due to a configuration change.
  B. The do-not-fragment bit is copied to the tunnel header.
  C. The MSS option on the SYN packet is set to 1300.
  D. The TCP SYN check option is disabled for tunnel traffic.
  B. The do-not-fragment bit is copied to the tunnel header.

• Question 139:

  Click the Exhibit button.

  user@host> show services application-identification application-system--cache Application System Cache Configurations: Application-cache: off nested-application-cache: on cache-unknown-result: on cache-entry-timeout: 3600 seconds

  You are using the application identification feature on your SRX Series device. The help desk reports that users are complaining about slow Internet connectivity. You issue the command shown in the exhibit.

  What must you do to correct the problem?

  A. Modify the configuration with the delete services application-identification no- application-system-cache command and commit the change.
  B. Modify the configuration with the delete services application-identification no- clear-application-system-cache command and commit the change.
  C. Reboot the SRX Series device.
  D. Modify the configuration with the delete services application-identification no- application identification command and commit the change.
  B. Modify the configuration with the delete services application-identification no- clear-application-system-cache command and commit the change.

• Question 140:

  You are asked to deploy dynamic VPNs between the corporate office and remote employees that work from home. The gateway device at the corporate office is a chassis cluster formed from two SRX240s. Which two statements about this deployment are true? (Choose two.)

  A. You must remove the SRX240s from the chassis cluster before enabling the dynamic VPNs.
  B. The remote clients can run Windows XP, Windows Vista, Windows 7, or OS X operating systems.
  C. If more than two dynamic VPN tunnels are required, you must purchase and install a new license.
  D. The remote users can be authenticated by the SRX240s or a configured RADIUS server.
  C. If more than two dynamic VPN tunnels are required, you must purchase and install a new license.
  D. The remote users can be authenticated by the SRX240s or a configured RADIUS server.