Juniper JN0-633 Online Practice Questions and Exam Preparation

Juniper JN0-633 Online Questions & Answers

• Question 31:

  [edit] useu@host# run show log debug Feb 3 22:04:32 22:04:31.983991:CID-0:RT: ge-0/0/1.0:5.0.0.25/59028- >25.0.0.25/23, tcp, flag 18

  Feb 3 22:04:32 22:04:31.983997:CID-0:RT: find flow: table 0x582738c0, hash 53561(0xffff), sa 5.0.0.25, da 5.0.0.25, sp 59028, dp 23, proto 6, tok 20489

  Feb 3 22:04:32 22:04:31.984004:CID-0:RT:Found: session id 0x14f98. sess tok 20489

  Feb 3 22:04:32 22:04:31.984005:CID-0:RT: flow got session.

  Feb 3 22:04:32 22:04:31.984006:CID-0:RT: flow session id 85912

  Feb 3 22:04:32 22:04:31.984009:CID-0:RT: vector bits 0x2 vector 0x53a949e8

  Feb 3 22:04:32 22:04:31.984012:CID-0:RT: tcp sec check.

  Feb 3 22:04:32 22:04:31.984015:CID-0:RT:mbuf 0x4a82cd80, exit nh 0xa0010

  Which two statements are true regarding the output shown in the exhibit? (Choose two.)

  A. The outgoing interface is ge-0/0/1.0.
  B. The packet is subject to fast-path packet processing.
  C. The packet is part of the first-packet path processing.
  D. TCP sequence checking is enabled.
  C. The packet is part of the first-packet path processing.
  D. TCP sequence checking is enabled.

• Question 32:

  Which two statements about AppQoS are true? (Choose two.)

  A. AppQoS remarking supersedes interface remarking.
  B. AppQoS supports forwarding class assignment.
  C. AppQoS supports rate limiting.
  D. AppQoS supports bandwidth reservation.
  B. AppQoS supports forwarding class assignment.
  C. AppQoS supports rate limiting.

• Question 33:

  You are asked to implement IPsec tunnels between your SRX devices located at various locations. You will use the public key infrastructure (PKI) to verify the identification of the endpoints. What are two certificate enrollment options available for this deployment? (Choose two.)

  A. Manually generating a PKCS10 request and submitting it to an authorized CA.
  B. Dynamically generating and sending a certificate request to an authorized CA using OCSP.
  C. Manually generating a CRL request and submitting that request to an authorized CA.
  D. Dynamically generating and sending a certificate request to an authorized CA using SCEP.
  A. Manually generating a PKCS10 request and submitting it to an authorized CA.
  D. Dynamically generating and sending a certificate request to an authorized CA using SCEP.

• Question 34:

  Click the Exhibit button.

  Host A cannot resolve the www.target.host.com Web page when using its configured DNS server. As shown in the exhibit, Host A's configured DNS server and the Web server hosting the www.target.host.com Web page are in the same

  subnet. You have verified bidirectional reachability between Host A and the Web server hosting the Web page.

  What would cause this behavior on the SRX device in Company B's network?

  Exhibit:

  

  A. DNS replication is enabled.
  B. DNS doctoring is enabled.
  C. DNS replication is disabled.
  D. DNS doctoring is disabled.
  D. DNS doctoring is disabled.

• Question 35:

  You have been asked to establish a dynamic IPsec VPN between your SRX device and a remote user. Regarding this scenario, which three statements are correct? (Choose three.)

  A. You must use preshared keys.
  B. IKE aggressive mode must be used.
  C. Only predefined proposal sets can be used.
  D. Only policy-based VPNs are supported.
  E. You can use all methods of encryption.
  A. You must use preshared keys.
  B. IKE aggressive mode must be used.
  D. Only policy-based VPNs are supported.

• Question 36:

  Click the Exhibit button.

  Referring to the exhibit, which two statements are true? (Choose two.)

  Exhibit:

  

  A. Packets may get fragmented.
  B. The tunnel automatically fragments packets based on MTU discovery.
  C. The Phase 2 association will never expire.
  D. The Phase 2 association will expire without traffic.
  A. Packets may get fragmented.
  D. The Phase 2 association will expire without traffic.

• Question 37:

  You are asked to deploy a group VPN between various sites associated with your company. The gateway devices at the remote locations are SRX240 devices. Which two statements about the new deployment are true? (Choose two.)

  A. The networks at the various sites must use NAT.
  B. The participating endpoints in the group VPN can belong to a chassis cluster.
  C. The networks at the various sites cannot use NAT.
  D. The participating endpoints in the group VPN cannot be part of a chassis cluster.
  C. The networks at the various sites cannot use NAT.
  D. The participating endpoints in the group VPN cannot be part of a chassis cluster.

• Question 38:

  Which feature is used for layer 2 bridging on an SRX Series device?

  A. route mode
  B. packet mode
  C. transparent mode
  D. MPLS mode
  C. transparent mode

• Question 39:

  -- Exhibit -[edit security]

  user@srx# show

  idp {

  idp-policy NewPolicy {

  rulebase-exempt { rule 1 { description AllowExternalRule; match { source-address any; destination-address } } } } } -- Exhibit -

  You are performing the initial IDP installation on your new SRX device. You have configured the IDP exempt rulebase as shown in the exhibit, but the commit is not successful. Referring to the exhibit, what solves the issue?

  A. You must configure the destination zone match.
  B. You must configure the IPS exempt accept action.
  C. You must configure the IPS rulebase.
  D. You must configure the IPS engine flow action to ignore.
  C. You must configure the IPS rulebase.

• Question 40:

  HostA (1.1.1.1) is sending TCP traffic to HostB (2.2.2.2). You need to capture the TCP packets locally on the SRX240. Which configuration would you use to enable this capture?

  A. [edit security flow] user@srx# show traceoptions { file dump; flag basic-datapath; }
  B. [edit security] user@srx# show application-tracking { enable; } flow { traceoptions { file dump; flag basic-datapath; } }
  C. [edit firewall filter capture term one] user@srx# show from { source-address { 1.1.1.1; } destination-address { 2.2.2.2; } protocol tcp; } then { port-mirror; accept; }
  D. [edit firewall filter capture term one] user@srx# show from { source-address { 1.1.1.1; } destination-address { 2.2.2.2; } protocol tcp; } then { sample; accept; }
  D. [edit firewall filter capture term one] user@srx# show from { source-address { 1.1.1.1; } destination-address { 2.2.2.2; } protocol tcp; } then { sample; accept; }