Juniper JNCIP-SEC JN0-635 Questions & Answers

• Question 1:

  You are asked to look at a configuration that is designed to take all traffic with a specific source ip address and forward the traffic to a traffic analysis server for further evaluation. The configuration is no longer working as intended.

  

  Referring to the exhibit which change must be made to correct the configuration?

  A. Apply the filter as in input filter on interface xe-0/2/1.0

  B. Apply the filter as in input filter on interface xe-0/0/1.0

  C. Create a routing instance named default

  D. Apply the filter as in output filter on interface xe-0/1/0.0

  Correct Answer: B

• Question 2:

  Which three type of peer devices are supported for Cos-Based IPsec VPN?

  A. High-end SRX Series device

  B. cSRX

  C. vSRX

  D. Branch-end SRX Series devics

  Correct Answer: ACD

• Question 3:

  What are two important function of the Juniper Networks ATP appliance solution? (Choose two.).

  A. Statistics

  B. Analysis

  C. Detection

  D. Filtration

  Correct Answer: BC

  Reference: https://www.juniper.net/us/en/products-services/security/advanced-threat-prevention/

• Question 4:

  Exhibit.

  

  Referring to the exhibit, which two statements are true? (Choose two.)

  A. The c-1 TSYS has a reservation for the security flow resource.

  B. The c-1 TSYS can use security flow resources up to the system maximum.

  C. The c-1 TSYS cannot use any security flow resources.

  D. The c-1 TSYS has no reservation for the security flow resource.

  Correct Answer: CD

  Reference: https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-profile-logical-system.html

• Question 5:

  You are connecting two remote sites to your corporate headquarters site; you must ensure that all traffic is

  secured and

  only uses a single Phase 2 SA for both sites.

  In this scenario, which VPN should be used?

  A. An IPsec group VPN with the corporate firewall acting as the hub device.

  B. Full mesh IPsec VPNs with tunnels between all sites.

  C. A hub-and-spoke IPsec VPN with the corporate firewall acting as the hub device.

  D. A full mesh Layer 3 VPN with the corporate firewall acting as the hub device.

  Correct Answer: A

  Reference: https://www.juniper.net/us/en/local/pdf/app-notes/3500202-en.pdf

• Question 6:

  You have the NAT rule, shown in the exhibit, applied to allow communication across an IPsec tunnel between your two sites with identical networks. Which statement is correct in this scenario?

  A. The NAT rule with translate the source and destination addresses.

  B. The NAT rule will only translate two addresses at a time.

  C. The NAT rule in applied to the N/A routing instance.

  D. 10 packets have been processed by the NAT rule.

  Correct Answer: A

• Question 7:

  You are asked to configure a security policy on the SRX Series device. After committing the policy, you

  receive the "Policy is out of sync between RE and PFE ." error.

  Which command would be used to solve the problem?

  A. request security polices resync

  B. request service-deployment

  C. request security polices check

  D. restart security-intelligence

  Correct Answer: A

  Reference: https://kb.juniper.net/InfoCenter/index?page=contentandid=KB30443andcat=SRX_SERIESandactp=LIST

• Question 8:

  Exhibit.

  

  Referring to the exhibit, a spoke member of an ADVPN is not functioning correctly. Which two commands will solve this problem? (Choose two.)

  A. [edit interfaces] user@srx# delete st0.0 multipoint

  B. [edit security ike gateway advpn-gateway] user@srx# delete advpn partner

  C. [edit security ike gateway advpn-gateway] user@srx# set version v1-only

  D. [edit security ike gateway advpn-gateway] user@srx# set advpn suggester disable

  Correct Answer: BD

  Reference: https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-auto-discovery-vpns.html

• Question 9:

  Exhibit.

  

  Referring to the exhibit, which two statements are true? (Choose two.)

  A. Juniper Networks will not investigate false positives generated by this custom feed.

  B. The custom infected hosts feed will not overwrite the Sky ATP infected host's feed.

  C. The custom infected hosts feed will overwrite the Sky ATP infected host's feed.

  D. Juniper Networks will investigate false positives generated by this custom feed.

  Correct Answer: AC

  Reference: https://www.juniper.net/documentation/en_US/junos-space18.1/policy-enforcer/topics/task/configuration/ junos-space-policyenforcer-custom-feeds-infected-host-configure.html

• Question 10:

  You must implement an IPsec VPN on an SRX Series device using PKI certificates for authentication. As

  part of the implementation, you are required to ensure that the certificate submission, renewal, and

  retrieval processes are handled automatically from the certificate authority.

  In this scenario, which statement is correct.

  A. You can use CRL to accomplish this behavior.

  B. You can use SCEP to accomplish this behavior.

  C. You can use OCSP to accomplish this behavior.

  D. You can use SPKI to accomplish this behavior.

  Correct Answer: B

  Certificate Renewal The renewal of certificates is much the same as initial certificate enrollment except you are just replacing an old certificate (about to expire) on the VPN device with a new certificate. As with the initial certificate request, only manual renewal is supported. SCEP can be used to re-enroll local certificates automatically before they expire. Refer to Appendix D for more details.