Juniper JN0-633 Online Practice Questions and Exam Preparation

Juniper JN0-633 Online Questions & Answers

• Question 51:

  You are asked to deploy dynamic VPNs between the corporate office and remote employees that work from home. The gateway device at the corporate office consists of a pair of SRX650s in a chassis cluster. Which two statements about the deployment are true? (Choose two.)

  A. The SRX650s must be separated as standalone devices to support the dynamic VPNs.
  B. The remote clients must install client software to establish a tunnel with the corporate network.
  C. The remote clients must reside behind an SRX device configured as the local tunnel endpoint.
  D. The SRX650 must have HTTP or HTTPS enabled to aid in the client software distribution process.
  B. The remote clients must install client software to establish a tunnel with the corporate network.
  D. The SRX650 must have HTTP or HTTPS enabled to aid in the client software distribution process.

• Question 52:

  Which two statements are true regarding DNS doctoring? (Choose two.)

  A. DNS doctoring translates the DNS CNAME payload.
  B. DNS doctoring for IPv4 is supported on SRX devices.
  C. DNS doctoring for IPv4 and IPv6 is supported on SRX devices.
  D. DNS doctoring translates the DNS A-record.
  B. DNS doctoring for IPv4 is supported on SRX devices.
  D. DNS doctoring translates the DNS A-record.

• Question 53:

  Your company is using a dynamic VPN configuration on their SRX device. Your manager asks you to enforce password expiration policies for all VPN users. Which authentication method meets the requirement?

  A. local password database
  B. TACACS+
  C. RADIUS
  D. LDAP
  D. LDAP

• Question 54:

  Which two configuration components are required for enabling transparent mode on an SRX device? (Choose two.)

  A. IRB
  B. bridge domain
  C. interface family bridge
  D. interface family ethernet-switching
  B. bridge domain
  C. interface family bridge

• Question 55:

  You have recently deployed a dynamic VPN. The remote users are complaining that communications with devices on the same subnet as the SRX device are intermittent and often fail. The tunnel is stable and up, and communications with remote devices on different subnets work without any issues. Which configuration setting would resolve this issue?

  A. adding local-redirect at the [edit security nat] hierarchy
  B. adding local-redirect at the [edit interfaces ] hierarchy
  C. adding proxy-arp at the [edit security nat] hierarchy
  D. adding proxy-arp at the [edit interfaces ] hierarchy
  C. adding proxy-arp at the [edit security nat] hierarchy

• Question 56:

  You are asked to allow access to an external application for an internal host subject to address translation. The application requires multiple sessions initiated from the internal host and expects all the sessions to originate from the same source IP address.

  Which Junos feature meets this objective?

  A. destination NAT with address persistence
  B. source NAT with address persistence
  C. static NAT with port translation
  D. interface-based persistent NAT
  B. source NAT with address persistence

• Question 57:

  Click the Exhibit button.

  [edit security application-firewall]

  user@host# show

  rule-sets web {

  rule one {

  match {

  dynamic-application junos:HTTP;

  }

  then {

  permit;

  }

  }

  default-rule {

  reject;

  }

  }

  What will happen to non-HTTP traffic that matches the application-firewall policy shown in the exhibit?

  A. It will be denied because this is a blacklist policy.
  B. It will be dropped and an error will be sent to the source.
  C. It will be silently dropped.
  D. It will be allowed because this is a whitelist policy.
  C. It will be silently dropped.

• Question 58:

  What is a secure key management protocol used by IPsec?

  A. AH
  B. ESP
  C. TCP
  D. IKE
  D. IKE

• Question 59:

  Which problem is introduced by setting the terminal parameter on an IPS rule?

  A. The SRX device will stop IDP processing for future sessions.
  B. The SRX device might detect more false positives.
  C. The SRX device will terminate the session in which the terminal rule detected the attack.
  D. The SRX device might miss attacks.
  D. The SRX device might miss attacks.

• Question 60:

  Click the Exhibit button.

  user@key-server> show security group-vpn server ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 97 UP bb224408940cc5d 435b9404284083c2 Main 192.168.11.1 98 UP 242c840089404d15 ab19284089408ba8 Main 192.168.11.2

  user@key-server> show security group-vpn server ipsec security-associations Group: group-1, Group Id: Total IPsec SAs: 1 IPsec SA Algorithm SPI Lifetime group-l-sa ESP:3des/shal 1343991c 2736 Group: group-2, Group id: 2 Total IPsec SAs: 1 IPsec SA Algorithm SPI Lifetime group-2-sa ESP:3des/shal 13be9e9 2741 Group: group-3, Group Id: 3 Total IPsec SAs: 1 IPsec SA Algorithm SPI Lifetime group-3-sa ESP:3des/shal 20709057 2741 Group: group-4, Group Id: 4 Total IPsec SAs: 1 IPsec SA Algorithm SPI Lifetime group-4-sa ESP:3des/shal 5111c2e1 2741

  Which statement is correct regarding the outputs shown in the exhibit?

  Which statement is correct regarding the outputs shown in the exhibit?

  A. Two established peers are in the group VPNs.
  B. One established peer is in the group VPNs.
  C. No established peer is in the group VPNs.
  D. Four established peers are in the group VPNs.
  A. Two established peers are in the group VPNs.