Juniper JNCIP-SEC JN0-636 Questions & Answers

• Question 11:

  Click the Exhibit button.

  

  Referring to the exhibit, which three topologies are supported by Policy Enforcer? (Choose three.)

  A. Topology 3

  B. Topology 5

  C. Topology 2

  D. Topology 4

  E. Topology 1

  Correct Answer: ADE

  Reference: https://www.juniper.net/documentation/en_US/junos-space17.2/policy- enforcer/topics/concept/ policy-enforcer-deployment-supported-topologies.html

• Question 12:

  Which three type of peer devices are supported for Cos-Based IPsec VPN?

  A. High-end SRX Series device

  B. cSRX

  C. vSRX

  D. Branch-end SRX Series devics

  Correct Answer: ACD

• Question 13:

  You are connecting two remote sites to your corporate headquarters site. You must ensure that all traffic is secured and sent directly between sites In this scenario, which VPN should be used?

  A. IPsec ADVPN

  B. hub-and-spoke IPsec VPN

  C. Layer 2 VPN

  D. full mesh Layer 3 VPN with EBGP

  Correct Answer: A

  Explanation: IPsec ADVPN (Auto-Discovery VPN) is a VPN that enables the creation of a full mesh VPN topology among a set of remote sites. It allows the remote sites to discover one another automatically and establish IPsec VPN tunnels among themselves. It is useful when you need to connect multiple remote sites to your corporate headquarters site, and ensure that all traffic is secured and sent directly between sites. ADVPN allows for the creation of a hub-and-spoke topology, which is not suitable for this case. Layer 2 VPN can be used for point to point connectivity but does not secure the traffic. Also, A full mesh Layer 3 VPN with EBGP is a good option for this scenario but it is more complex than ADVPN, and it requires more configuration.

• Question 14:

  You configured a chassis cluster for high availability on an SRX Series device and enrolled this HA cluster with the Juniper ATP Cloud. Which two statements are correct in this scenario? (Choose two.)

  A. You must use different license keys on both cluster nodes.

  B. When enrolling your devices, you only need to enroll one node.

  C. You must set up your HA cluster after enrolling your devices with Juniper ATP Cloud

  D. You must use the same license key on both cluster nodes.

  Correct Answer: BD

  When enrolling your devices, you only need to enroll one node: The Juniper ATP Cloud automatically recognizes the HA configuration and applies the same license and configuration to both nodes of the cluster.

  You must use the same license key on both cluster nodes: The HA cluster needs to share the same license key in order to be recognized as a single device by the Juniper ATP Cloud.

  You must set up your HA cluster before enrolling your devices with Juniper ATP Cloud. And it is not necessary to use different license keys on both cluster nodes because the HA cluster shares the same license key.

• Question 15:

  Exhibit

  

  Referring to the exhibit, which two statements are true? (Choose two.)

  A. The SRX-1 device can use the Proxy__Nodes feed in another security policy.

  B. You can use the Proxy_Nodes feed as the source-address and destination-address match criteria of another security policy on a different SRX Series device.

  C. The SRX-1 device creates the Proxy_wodes feed, so it cannot use it in another security policy.

  D. You can only use the Proxy_Node3 feed as the destination-address match criteria of another security policy on a different SRX Series device.

  Correct Answer: AC

• Question 16:

  According to the log shown in the exhibit, you notice the IPsec session is not establishing. What is the reason for this behavior?

  A. Mismatched proxy ID

  B. Mismatched peer ID

  C. Mismatched preshared key

  D. Incorrect peer address.

  Correct Answer: B

  Explanation: https://www.juniper.net/documentation/en_US/release- independent/nce/topics/example/policy-based-vpn-using-j-series-srxseries-device- configuring.html

• Question 17:

  Exhibit

  

  The show network-access aaa radius-servers command has been issued to solve authentication issues.

  Referring to the exhibit, to which two authentication servers will the SRX Series device continue to send requests? (Choose TWO)

  A. 200l:DB8:0:f101;:2

  B. 192.168.30.191

  C. 192.168.30.190

  D. 192.168.30.188

  Correct Answer: BD

• Question 18:

  Your organization has multiple Active Directory domain to control user access. You must ensure that security polices are passing traffic based upon the user's access rights.

  What would you use to assist your SRX series devices to accomplish this task?

  A. JIMS

  B. Junos Space

  C. JSA

  D. JATP Appliance

  Correct Answer: A

  Explanation: https://www.juniper.net/documentation/en_US/junos/topics/topic- map/security-user-auth-configure-jims.html

• Question 19:

  Exhibit

  

  Referring to the exhibit, which three protocols will be allowed on the ge-0/0/5.0 interface? (Choose three.)

  A. IBGP

  B. OSPF

  C. IPsec

  D. DHCP

  E. NTP

  Correct Answer: BDE

  Explanation: The exhibit shows the output of the "show interfaces ge-0/0/5.0 extensive" command on an SRX Series device. The output includes a section called "Security" that lists the protocols that are allowed on the ge-0/0/5.0 interface.

  The protocols that are allowed on the ge-0/0/5.0 interface are:

  OSPF

  DHCP

  NTP

  It's important to notice that the output don't have IBGP, IPsec, so these protocols are not allowed on the ge-0/0/5.0 interface.

• Question 20:

  Exhibit

  

  Referring to the exhibit, a spoke member of an ADVPN is not functioning correctly. Which two commands will solve this problem? (Choose two.)

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: C