Juniper JN0-633 Online Practice Questions and Exam Preparation

Juniper JN0-633 Online Questions & Answers

• Question 11:

  What are three advantages of group VPNs? (Choose three.)

  A. Supports any-to-any member connectivity.
  B. Provides redundancy with cooperative key servers.
  C. Eliminates the need for full mesh VPNs.
  D. Supports translating private to public IP addresses.
  E. Preserves original IP source and destination addresses.
  A. Supports any-to-any member connectivity.
  C. Eliminates the need for full mesh VPNs.
  E. Preserves original IP source and destination addresses.

• Question 12:

  Click the Exhibit button.

  user@host> show security ike security-associations

  Index State Initiator cookie Responder cookie Mode Remote Address 3271043 UP 7f42284089404673 95fd8408940438d8 Main 172.31.50.2

  user@host> show security ipsec security-associations

  Total active tunnels: 0

  user@host> show log phase2

  Feb 2 14:21:18 host kmd[1088]: IKE negotiation failed with error: TS unacceptable. IKE Version: 1, VPN:

  vpn-1 Gateway: gate-1, Local: 172.31.50.1/500, Remote: 172.31.50.2/500, Local IKE-ID: 172.31.50.1, Remote IKE-ID: 172.31.50.2, VR-ID: 0

  Feb 2 14:21:18 host kmd[1088]: KMD_VPN_TS_MISMATCH: Traffic-selector mismatch, vpn name: vpn-1, Peer Proposed traffic-selector local-ip: ipv4(2.2.2.2), Peer Proposed traffic-selector remote-ip: ipv4 (1.1.1.1)

  Feb 2 14:21:54 host kmd[1088]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1, VPN: vpn-1 Gateway: gate-1, Local:

  172.31.50.1/500, Remote: 172.31.50.2/500, Local IKE-ID: 172.31.50.1, Remote IKE-ID: 172.31.50.2, VRID: 0

  Feb 2 14:22:19 host kmd[1088]: KMD_VPN_TS_MISMATCH: Traffic-selector mismatch, vpn name: vpn-1, Peer Proposed traffic-selector local-ip:

  ipv4 (2.2.

  2.2), Peer Proposed traffic-selector remote-ip: ipv4(1.1.1.1)

  You have recently configured an IPsec VPN between an SRX Series device and another non- Junos security device. The phase one tunnel is up but the phase two tunnel is not present.

  Referring to the exhibit, what is the cause of this problem?

  A. preshared key mismatch
  B. mode mismatch
  C. proposal mismatch
  D. proxy-ID mismatch
  D. proxy-ID mismatch

• Question 13:

  Click the Exhibit button.

  TCP traffic sourced from Host A destined for Host B is being redirected using filter-based forwarding to use the Red network. However, return traffic from Host B destined for Host A is using the Blue network and getting dropped by the SRX device.

  Which action will resolve the issue?

  Exhibit:

  

  A. Enable asyncronous-routing under the Blue zone.
  B. Configure ge-0/0/1 to belong to the Red zone.
  C. Disable RPF checking.
  D. Disable TCP sequence checking.
  B. Configure ge-0/0/1 to belong to the Red zone.

• Question 14:

  What is the default action for an SRX device in transparent mode to determine the outgoing interface for an unknown destination MAC address?

  A. Perform packet flooding.
  B. Send an ARP query.
  C. Send an ICMP packet with a TTL of 1.
  D. Perform a traceroute request.
  A. Perform packet flooding.

• Question 15:

  You have an existing group VPN established in your internal network using the group-id 1. You have been asked to configure a second group using the group-id 2. You must ensure that the key server for group 1 participates in group 2 but is not the key server for that group. Which statement is correct regarding the group configuration on the current key server for group 1?

  A. You must configure both groups at the [edit security ipsec vpn] hierarchy.
  B. You must configure both groups at the [edit security group-vpn member] hierarchy.
  C. You must configure both groups at the [edit security ike] hierarchy.
  D. You must configure both groups at the [edit security group-vpn] hierarchy.
  D. You must configure both groups at the [edit security group-vpn] hierarchy.

• Question 16:

  Click the Exhibit button.

  IPv6 to IPv4 addresses are not being translated as shown in the exhibit.

  Which two configurations would resolve the problem? (Choose two.)

  Exhibit:

  

  A. set security nat natv6v4 no-6-frag-header
  B. set security nat proxy-arp interface ge-0/0/0.0
  C. set security nat source port-randomization disable
  D. set security nat proxy-ndp interface ge-0/0/1.0
  D. set security nat proxy-ndp interface ge-0/0/1.0

• Question 17:

  You have recently deployed a dynamic VPN. Some remote users are complaining that they cannot authenticate through the SRX device at the corporate network. The SRX device serves as the tunnel endpoint for the dynamic VPN. What are two reasons for this problem? (Choose two.)

  A. The supported number of users has been exceeded for the applied license.
  B. The users are connecting to the portal using Windows Vista.
  C. The SRX device does not have the required user account definitions.
  D. The SRX device does not have the required access profile definitions.
  A. The supported number of users has been exceeded for the applied license.
  D. The SRX device does not have the required access profile definitions.

• Question 18:

  Your company has added a connection to a new ISP and you have been asked to send specific traffic to the new ISP. You have decided to implement filter-based forwarding. You have configured new routing instances with type forwarding. You must direct traffic into each instance. Which step would accomplish this goal?

  A. Add a firewall filter to the ingress interface that specifies the intended routing instance as the action.
  B. Create a routing policy to direct the traffic to the required forwarding instances.
  C. Configure the ingress and egress interfaces in each forwarding instance.
  D. Create a static default route for each ISP in inet.0, each pointing to a different forwarding instance.
  A. Add a firewall filter to the ingress interface that specifies the intended routing instance as the action.

• Question 19:

  Click the Exhibit button.

  You are asked to implement NAT to translate addresses between the IPv4 and IPv6 networks shown in the exhibit.

  What are three configuration requirements? (Choose three.)

  Exhibit:

  

  A. Disable SYN checking.
  B. Enable IPv6 flow mode.
  C. Configure proxy ARP.
  D. Configure stateless filtering.
  E. Configure proxy NDP.
  B. Enable IPv6 flow mode.
  C. Configure proxy ARP.
  E. Configure proxy NDP.

• Question 20:

  Click the Exhibit button.

  [edit protocols ospf area 0.0.0.0] user@host# run show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 3289542 UP 48d928408940de28 e418fc7702fe483b Main

  172.31.50.1 3289543 UP eb45940484082b14 428086b100427326 Main 10.10.50.1

  [edit protocols ospf area 0.0.0.0] user@host# run show security ipsec; security-associations Total active tunnels: 2 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <131073 ESP:des/ shal 6d40899b 1360/ unlim - root 500 10.10.50.1

  >131073 ESP:des/ shal 5a89400e 1360/ unlim - root 500 10.10.50.1

  <131074 ESP:des/ shal c04046f 1359/ unlim - root 500 172.31.50.1

  >131074 ESP:des/ shal 5508946c 1359/ unlim - root 500 172.31.50.1

  [edit protocols ospf area 0.0.0.0] user@host# run show ospf neighbor Address Interface State ID Pri Dead 10.40.60.1 st0.0 Init 10.30.50.1 128 35

  10.40.60.2 st0.0 Full 10.30.50.1 128 31

  [edit protocols ospf area 0.0.0.0]

  user@host# show

  interface st0.0;

  You have already configured a hub-and-spoke VPN with one hub device and two spoke devices. However, the hub device has one neighbor in the Init state and one neighbor in the Full state.

  What would you do to resolve this problem?

  A. Configure the st0.0 interface under OSPF as a nonbroadcast multiple access interface.
  B. Configure the st0.0 interface under OSPF as a point-to-multipoint interface.
  C. Configure the st0.0 interface under OSPF as a point-to-point interface.
  D. Configure the st0.0 interface under OSPF as an unnumbered interface.
  B. Configure the st0.0 interface under OSPF as a point-to-multipoint interface.