Juniper JN0-633 Online Practice Questions and Exam Preparation

Juniper JN0-633 Online Questions & Answers

• Question 161:

  Your company provides managed services for two customers. Each customer has been segregated within its own routing instance on your SRX device. Customer A and customer B inform you that they need to be able to reach certain hosts on each other's network. Which two configuration settings would be used to share routes between these routing instances? (Choose two.)

  A. routing-group
  B. instance-import
  C. import-rib
  D. next-table
  B. instance-import
  D. next-table

• Question 162:

  Click the Exhibit button.

  Referring to the exhibit, you notice that filter-based forwarding is not working.

  What is the reason for this behavior?

  Exhibit:

  A. The RIB group is configured incorrectly.
  B. The routing policy is configured incorrectly.
  C. The routing instance is configured incorrectly.
  D. The default static routes are configured incorrectly.
  C. The routing instance is configured incorrectly.

• Question 163:

  Which QoS function is supported in transparent mode?

  A. 802.1p
  B. DSCP
  C. IP precedence
  D. MPLS EXP
  A. 802.1p

• Question 164:

  In which situation is NAT proxy NDP required?

  A. when translated addresses belong to the same subnet as the ingress interface
  B. when filter-based forwarding and static NAT are used on the same interface
  C. when working with static NAT scenarios
  D. when the security device operates in transparent mode
  C. when working with static NAT scenarios

• Question 165:

  Click the Exhibit button.

  root@host# show system login

  user user {

  uid 2000;

  class operator;

  authentication {

  encrypted-password "$1$4s7ePrk5$9S.MZTwmXTV7sovJZFFsw1"; ## SECRET-DATA ]

  }

  An SRX Series device has been configured for multiple certificate-based VPNs. The IPsec security association used for data replication is currently down . The administrator is a contractor and has the permissions on the SPX Series device

  as shown in the exhibit

  Which command set would allow the administrator to troubleshoot the cause for the VPN being down?

  A. set security ipsec traceoptions file ipsec set security ipsec traceoptions flag security-associations
  B. set security ike traceoptions file ike set security ike traceoptions flag ike
  C. request security pki verify-integrity-status
  D. request security ike debug-enable local remote
  C. request security pki verify-integrity-status

• Question 166:

  You want to configure in-band management of an SRX device in transparent mode. Which command is required to enable this functionality?

  A. set interfaces irb unit 1 family inet address
  B. set interfaces vlan unit 1 family inet address
  C. set interfaces ge-0/0/0 unit 0 family inet address
  D. set interfaces ge-0/0/0 unit 0 family bridge address
  A. set interfaces irb unit 1 family inet address

• Question 167:

  Click the Exhibit button.

  You have been asked to block YouTube video streaming for internal users. You have implemented the configuration shown in the exhibit, however users are still able to stream videos.

  What must be modified to correct the problem?

  Exhibit:

  

  A. The application firewall rule needs to be applied to an IDP policy.
  B. You must create a custom application to block YouTube streaming.
  C. The application firewall rule needs to be applied to the security policy.
  D. You must apply the dynamic application to the security policy
  C. The application firewall rule needs to be applied to the security policy.

• Question 168:

  -- Exhibit -[edit security idp]

  user@srx# show | no-more

  idp-policy basic {

  rulebase-ips {

  rule 1 {

  match {

  from-zone untrust;

  source-address any;

  to-zone trust;

  destination-address any;

  application default;

  attacks {

  custom-attacks data-inject;

  }

  }

  then {

  action {

  recommended;

  }

  notification {

  log-attacks;

  }

  }

  }

  }

  }

  active-policy basic;

  custom-attack data-inject {

  recommended-action close;

  severity critical;

  attack-type {

  signature {

  context mssql-query;

  pattern "SELECT * FROM accounts";

  direction client-to-server;

  }

  }

  }

  -- Exhibit -

  You have configured the custom attack signature shown in the exhibit. This configuration is valid, but you want to improve the efficiency and performance of your IDP.

  Which two commands should you use? (Choose two.)

  A. set custom attack data-inject recommended-action drop
  B. set custom-attack data-inject attack-type signature protocol-binding tcp
  C. set idp-policy basic rulebase-ips rule 1 match destination-address webserver
  D. set idp-policy basic rulebase-ips rule 1 match application any
  B. set custom-attack data-inject attack-type signature protocol-binding tcp
  C. set idp-policy basic rulebase-ips rule 1 match destination-address webserver

• Question 169:

  You want to implement a hub-and-spoke VPN topology using a single logical interface on the hub. Which st0 interface configuration is correct for the hub device?

  A. [edit interfaces] user@srx# show st0 { multipoint unit 0 { family inet { address 10.10.10.1/24; } } }
  B. [edit interfaces] user@srx# show st0 { unit 0 { family inet { address 10.10.10.1/24; } } }
  C. [edit interfaces] user@srx# show st0 { unit 0 { point-to-point; family inet { address 10.10.10.1/24; } } }
  D. [edit interfaces] user@srx# show st0 { unit 0 { multipoint; family inet { address 10.10.10.1/24; } } }
  D. [edit interfaces] user@srx# show st0 { unit 0 { multipoint; family inet { address 10.10.10.1/24; } } }

• Question 170:

  A local user complains that they cannot connect to an FTP server on the DMZ network. You investigate and confirm that the security policy allows FTP traffic from the trust zone to the DMZ zone.

  What are two reasons for this problem? (Choose two.)

  A. The FTP server has no route back to the local network.
  B. No route is configured to the DMZ network.
  C. No security policy exists for traffic from the DMZ zone to the trust zone.
  D. The FTP ALG is disabled.
  A. The FTP server has no route back to the local network.
  D. The FTP ALG is disabled.