Juniper JN0-633 Online Practice Questions and Exam Preparation

Juniper JN0-633 Online Questions & Answers

• Question 81:

  You are responding to a proposal request from an enterprise with multiple branch offices. All branch offices connect to a single SRX device at a centralized location. The request requires each office to be segregated on the central SRX device with separate IP networks and security considerations. No single office should be able to starve the CPU from other branch offices on the central SRX device due to the number of flow sessions. However, connectivity between offices must be maintained. Which three features are required to accomplish this goal? (Choose three.)

  A. Logical Systems
  B. Interconnect Logical System
  C. Virtual Tunnel Interface
  D. Logical Tunnel Interface
  E. Virtual Routing Instance
  A. Logical Systems
  B. Interconnect Logical System
  D. Logical Tunnel Interface

• Question 82:

  You must ensure that your Layer 2 traffic is secured on your SRX Series device in transparent mode. What must be considered when accomplishing this task?

  A. Layer 2 interfaces must use the ethernet-switching protocol family.
  B. Security policies are not supported when operating in transparent mode.
  C. Screens are not supported in your security zones with transparent mode.
  D. You must reboot your device after configuring transparent mode.
  D. You must reboot your device after configuring transparent mode.

• Question 83:

  Which statement is true regarding destination NAT?

  A. Destination NAT changes the content of the source IP address field.
  B. Destination NAT changes the content of the destination IP address field.
  C. Destination NAT matches on the destination IP address and changes the source IP address.
  D. Destination NAT matches on the destination IP address and changes the source port.
  B. Destination NAT changes the content of the destination IP address field.

• Question 84:

  Click the Exhibit button.

  According to the log shown in the exhibit, you notice that the IPsec session is not establishing. What are two reasons for this behavior? (Choose two.)

  Exhibit:

  

  A. mismatched preshared key
  B. mismatched proxy ID
  C. incorrect peer address
  D. mismatched peer ID
  C. incorrect peer address
  D. mismatched peer ID

• Question 85:

  Which statement is true regarding the dynamic VPN feature for Junos devices?

  A. Only route-based VPNs are supported.
  B. Aggressive mode is not supported.
  C. Preshared keys for Phase 1 must be used.
  D. It is supported on all SRX devices.
  C. Preshared keys for Phase 1 must be used.

• Question 86:

  You are asked to establish a baseline for your company's network traffic to determine the bandwidth usage per application. You want to undertake this task on the central SRX device that connects all segments together. What are two ways to accomplish this goal? (Choose two.)

  A. Configure a mirror port on the SRX device to capture all traffic on a data collection server for further investigation.
  B. Use interface packet counters for all permitted and denied traffic and calculate the values using Junos scripts.
  C. Send SNMP traps with bandwidth usage to a central SNMP server.
  D. Enable AppTrack on the SRX device and configure a remote syslog server to receive AppTrack messages.
  A. Configure a mirror port on the SRX device to capture all traffic on a data collection server for further investigation.
  D. Enable AppTrack on the SRX device and configure a remote syslog server to receive AppTrack messages.

• Question 87:

  Click the Exhibit button.

  You have configured an IDP policy as shown in the exhibit. The configuration commits successfully. Which traffic will be examined for attacks?

  Exhibit:

  

  A. only originating traffic from source to destination in a session
  B. only reply traffic from destination to source in a session
  C. both originating and reply traffic between hosts in a session
  D. recommended traffic between the source and destination hosts
  C. both originating and reply traffic between hosts in a session

• Question 88:

  -- Exhibit -[edit security]

  user@srx# show idp

  ...

  application-ddos Webserver {

  service http;

  connection-rate-threshold 1000;

  context http-get-url {

  hit-rate-threshold 60000;

  value-hit-rate-threshold 30000;

  time-binding-count 10;

  time-binding-period 25;

  }

  }

  -- Exhibit -

  You are using AppDoS to protect your network against a bot attack, but noticed an approved application has falsely triggered the configured IDP action of drop. You adjusted your AppDoS configuration as shown in the exhibit. However, the

  approved traffic is still dropped.

  What are two reasons for this behavior? (Choose two.)

  A. The approved traffic results in 50,000 HTTP GET requests per minute.
  B. The approved traffic results in 25 HTTP GET requests within 10 seconds from a single host.
  C. The active IDP policy has not been defined in the security configuration.
  D. The IDP action is still in effect due to the timeout configuration.
  A. The approved traffic results in 50,000 HTTP GET requests per minute.
  D. The IDP action is still in effect due to the timeout configuration.

• Question 89:

  Click the Exhibit button.

  Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:<1.1.1.100/51303->1.1.1.30/3389;6> matched filter MatchTraffic: Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:packet [48] ipid = 5015, @423d7e9e Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:---- flow_process_pkt: (thd 1): flow_ctxt type 13, common flag Ox0, mbuf Ox423d7d00 Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: flow process pak fast ifl 72 In_ifp fe-0/0/7.0 Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: fe-0/0/7.0:1.1.1.100/51303- >1.1.1.30/3389, top, flag 2 syn Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: find flow: table Ox5258d7b0, hash 17008(Oxffff), sa 1.1.1.100, da 1.1.1.30, sp 51303, dp 3389, proto 6, tok Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: no session found, start first path. in_tunnel - 0, from_cp_flag - 0 Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: flow_first_create_session Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: flow first_in_dst_nat: in , out dst_adr 1.1.1.30, sp 51303, dp 3389 Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: chose interface fe-0/0/7.0 as incoming nat if. Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_rule_dst_xlate: packet 1.1.1.100->1.1.1.30 nsp2 0.0.0.0->192.168.224.30. Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_routing: call flow_route_lookup() src_ip 1.1.1.100, x_dst_ip 192.168.224.30, in ifp fe-0/0/7.0, out ifp N/A sp 51303, dp 3389, ip_proto 6, tos 0 Feb 2 09:00:02 09:00:00.1872004:CIDO:RT:Doing DESTINATION addr route-lookup Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: routed (x_dst_ip 192 168.224.30) from untrust (fe-0/0/7.0 in 0) to ge-0/0/0.0, Next-hop: 192.168.224.30 Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: policy search from zone untrust-> zone trust Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: policy has timeout 900 Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: app 0, timeout 1800s, curr ageout 20s Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_src_xlate: src nat 0.0.0.0(51303) to

  192.168.224.30 (3389) returns status 1, rule/pool id 1/2. Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: dip id = 2/0, 1.1.1.100/51303->192.168.224.3/48810 Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: choose interface ge-0/0/0.0 as outgoing phy if Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:is_loop_pak: No loop: on ifp: ge-0/0/0.0, addr: 192.168.224.30, rtt_idx:0 Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:sm_flow_interest_check: app_id 0, policy 9, app_svc_en 0, flags Ox2. not interested Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:sm_flow_interest_check: app_id 1, policy 9, app_svc_en 0, flags Ox2. not interested Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_service_lookup(): natp(Ox51ee4680): app_id, 0(0). Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: service lookup identified service O.

  Referring to the exhibit, which two statements are correct? (Choose two.)

  A. The packet being inspected is a UDP packet.
  B. The incoming interface is fe-0/0/7.
  C. This traffic matches an existing flow.
  D. Source NAT is being used.
  B. The incoming interface is fe-0/0/7.
  C. This traffic matches an existing flow.

• Question 90:

  What are two intrusion protection mechanisms available on SRX Series Services Gateways? (Choose two.)

  A. routing update detection
  B. traffic anomaly detection
  C. NAT anomaly protection
  D. DoS protection
  B. traffic anomaly detection
  D. DoS protection