Juniper JN0-633 Online Practice Questions and Exam Preparation

Juniper JN0-633 Online Questions & Answers

• Question 61:

  Click the Exhibit button.

  A host is not able to communicate with a Web server. Based on the logs shown in the exhibit, what is the problem?

  Exhibit:

  

  A. A policy is denying the traffic between these two hosts.
  B. A session has not been created for this flow.
  C. A NAT policy is translating the address to a private address.
  D. The session table is running out of resources.
  A. A policy is denying the traffic between these two hosts.

• Question 62:

  Click the Exhibit button.

  Referring to the exhibit, a pair of SRX3600s is in an active/passive chassis cluster configured for transparent mode. Which type of traffic would traverse the secondary SRX3600 (node 1)?

  Exhibit:

  

  A. all traffic including non-IP traffic
  B. any IP traffic
  C. only TCP and UDP traffic
  D. only BPDU traffic
  D. only BPDU traffic

• Question 63:

  You want to implement persistent NAT for an internal resource so that external hosts are able to initiate communications to the resource, without the internal resource having previously sent packets to the external hosts. Which configuration setting will accomplish this goal?

  A. persistent-nat permit target-host
  B. persistent-nat permit any-remote-host
  C. persistent-nat permit target-host-port
  D. address-persistent
  B. persistent-nat permit any-remote-host

• Question 64:

  Click the Exhibit button.

  Traffic is flowing between the Host-1 and Host-2 devices through a hub-and-spoke IPsec VPN. All devices are SRX Series devices. Referring to the exhibit, which two statements are correct? (Choose two.)

  Exhibit:

  

  A. Traffic is encrypted on the Hub device.
  B. Traffic is encrypted on the Spoke-2 device.
  C. Traffic is not encrypted on the Spoke-2 device.
  D. Traffic is not encrypted on the Hub device.
  D. Traffic is not encrypted on the Hub device.

• Question 65:

  Click the Exhibit button. user@host# run show security flow session ... Session ID: 28, Policy name: allow/5, Timeout: 2, Valid In: 172.168.1.2/24800 --> 66.168.100.100/8001; tcp, If: ge-0/0/3.0, Pkts: 1, Bytes: 64 Out: 10.168.100.1/8001 --> 172.168.1.2/24800; tcp, If: ge-0/0/6.0, Pkts: 1, Bytes: 40

  Your customer is unable to reach your HTTP server that is connected to the ge-0/0/6 interface. The HTTP server has an address of 10.168.100.1 on port 80 internally, but is accessed publicly using interface ge- 0/0/3 with the address

  66.168.100.100 on port 8001.

  Referring to the exhibit, what is causing this problem?

  A. The traffic is originated with incorrect IP address from the customer.
  B. The traffic is translated with the incorrect IP address for the HTTP server.
  C. The traffic is translated with the incorrect port number for the HTTP server.
  D. The traffic is originated with the incorrect port number from the customer.
  C. The traffic is translated with the incorrect port number for the HTTP server.

• Question 66:

  -- Exhibit -[edit forwarding-options]

  user@srx240# show

  packet-capture {

  file filename my-packet-capture;

  maximum-capture-size 1500;

  }

  -- Exhibit -

  Referring to the exhibit, you are attempting to perform a packet capture on an SRX240 to troubleshoot an SSH issue in your network. However, no information appears in the packet capture file.

  Which firewall filter must you apply to the necessary interface to collect data for the packet capture?

  A. user@srx240# show filter pkt-capture { term pkt-capture-term { from { protocol tcp; port ssh; } then packet-mode; } term allow-all { then accept; } } [edit firewall family inet]
  B. user@srx240# show filter pkt-capture { term pkt-capture-term { from { protocol tcp; port ssh; } then { count packet-capture; } } term allow-all { then accept; } } [edit firewall family inet]
  C. user@srx240# show filter pkt-capture { term pkt-capture-term { from { protocol tcp; port ssh; } then { routing-instance packet-capture; } } term allow-all { then accept; } } [edit firewall family inet]
  D. user@srx240# show filter pkt-capture { term pkt-capture-term { from { protocol tcp; port ssh; } then { sample; accept; } } term allow-all { then accept; } } [edit firewall family inet]
  D. user@srx240# show filter pkt-capture { term pkt-capture-term { from { protocol tcp; port ssh; } then { sample; accept; } } term allow-all { then accept; } } [edit firewall family inet]

• Question 67:

  You want to verify that all application traffic traversing your SRX device uses standard ports. For example, you need to verify that only DNS traffic runs through port 53, and no other protocols. How would you accomplish this goal?

  A. Use an IDP policy to identify the application regardless of the port used.
  B. Use a custom ALG to detect the application regardless of the port used.
  C. Use AppTrack to detect the application regardless of the port used.
  D. Use AppID to detect the application regardless of the port used.
  A. Use an IDP policy to identify the application regardless of the port used.

• Question 68:

  You want to create a custom IDP signature for a new HTTP attack on your SRX device. You have the exact string that identifies the attack. Which two additional elements do you need to define your custom signature? (Choose two.)

  A. service context
  B. protocol number
  C. direction
  D. source IP address of the attacker
  A. service context
  C. direction

• Question 69:

  Which AppSecure module provides Quality of Service?

  A. AppTrack
  B. AppFW
  C. AppID
  D. AppQoS
  D. AppQoS

• Question 70:

  You have initiated the download of the IPS signature database on your SRX Series device. Which command would you use to confirm the download has completed?

  A. request security idp security-package install
  B. request security idp security-package download
  C. request security idp security-package install status
  D. request security idp security-package download status
  D. request security idp security-package download status