Juniper JNCIP-SEC JN0-636 Questions & Answers

• Question 21:

  Which method does an SRX Series device in transparent mode use to learn about unknown devices in a network?

  A. LLDP-MED

  B. IGMP snooping

  C. RSTP

  D. packet flooding

  Correct Answer: D

  Explanation: The SRX Series device in transparent mode uses packet flooding to learn about unknown devices in a network. Packet flooding is a process wherein the device sends out packets to every device it knows about or suspects in the network. When the packets are returned, the device can identify and classify the unknown devices in the network.

• Question 22:

  Exhibit You are using ATP Cloud and notice that there is a host with a high number of ETI and CandC hits sourced from the same investigation and notice that some of the events have not been automatically mitigated. Referring to the exhibit, what is a reason for this behavior?

  

  A. The CandC events are false positives.

  B. The infected host score is globally set bellow a threat level of 5.

  C. The infected host score is globally set above a threat level of 5.

  D. The ETI events are false positives.

  Correct Answer: D

• Question 23:

  Exhibit

  

  The exhibit shows a snippet of a security flow trace.

  In this scenario, which two statements are correct? (Choose two.)

  A. This packet arrived on interface ge-0/0/4.0.

  B. Destination NAT occurs.

  C. The capture is a packet from the source address 172.20.101.10 destined to 10.0.1.129.

  D. An existing session is found in the table.

  Correct Answer: CD

• Question 24:

  Which statement is true about persistent NAT types?

  A. The target-host-port parameter cannot be used with IPv4 addresses in NAT46.

  B. The target-host parameter cannot be used with IPv6 addressee in NAT64.

  C. The target-host parameter cannot be used with IPv4 addresses in NAT46

  D. The target-host-port parameter cannot be used with IPv6 addresses in NAT64

  Correct Answer: D

  Explanation: NAT (Network Address Translation) is a method to map one IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device. There are different types of NAT, one of them is the persistent NAT which is a type of NAT that allows you to map the same internal IP address to the same external IP address each time a host initiates a connection.

• Question 25:

  You issue the command shown in the exhibit.

  Which policy will be active for the identified traffic?

  A. Policy p4

  B. Policy p7

  C. Policy p1

  D. Policy p12

  Correct Answer: B

• Question 26:

  Which two statements are correct regarding tenant systems on SRX Series devices? (Choose two.)

  A. A maximum of 32 tenant systems can be configured on a physical SRX device.

  B. All tenant systems share a single routing protocol process.

  C. Each tenant system runs its own instance of the routing protocol process

  D. A maximum of 500 tenant systems can be configured on a physical SRX device.

  Correct Answer: CD

  Explanation: The following statements are true regarding tenant systems on SRX Series devices:

  Each tenant system runs its own instance of the routing protocol process. Each tenant system is isolated, and it has its own routing table, interfaces, and security policies.

  A maximum of 500 tenant systems can be configured on a physical SRX device. This allows for a high degree of flexibility and scalability, as each tenant system can be configured with its own set of features and security policies. A maximum

  of 32 tenant systems can be configured on a physical SRX device and All tenant systems share a single routing protocol process are not correct statements

• Question 27:

  You are connecting two remote sites to your corporate headquarters site; you must ensure that all traffic is secured and only uses a single Phase 2 SA for both sites.

  In this scenario, which VPN should be used?

  A. An IPsec group VPN with the corporate firewall acting as the hub device.

  B. Full mesh IPsec VPNs with tunnels between all sites.

  C. A hub-and-spoke IPsec VPN with the corporate firewall acting as the hub device.

  D. A full mesh Layer 3 VPN with the corporate firewall acting as the hub device.

  Correct Answer: A

  Explanation: https://www.juniper.net/us/en/local/pdf/app-notes/3500202-en.pdf

• Question 28:

  You are not able to activate the SSH honeypot on the all-in-one Juniper ATP appliance. What would be a cause of this problem?

  A. The collector must have a minimum of two interfaces.

  B. The collector must have a minimum of three interfaces.

  C. The collector must have a minimum of five interfaces.

  D. The collector must have a minimum of four interfaces.

  Correct Answer: D

  Explanation: https://www.juniper.net/documentation/en_US/release- independent/jatp/topics/task/configuration/jatp-traffic-collectorsetting-ssh-honeypot- detection.html

• Question 29:

  Exhibit

  

  Which two statements are correct about the output shown in the exhibit. (Choose two.)

  A. The source address is translated.

  B. The packet is an SSH packet

  C. The packet matches a user-configured policy

  D. The destination address is translated.

  Correct Answer: AB

• Question 30:

  You are asked to determine if the 203.0.113.5 IP address has been added to the third-party security feed, DS hield, from Juniper Seclnte1. You have an SRX Series device that is using Seclnte1 feeds from Juniper ATP Cloud. Which command will return this information?

  A. show security dynamic--address category--name CC | match 203.0.113.5

  B. show security dynamic--address category--name Infected--Hosts | match 203.0.113.5

  C. show security dynamic-address category-name IP Filter I match 203.0.113.5

  D. show Security dynamic-address category-name JWAS | match 203.0.113.5

  Correct Answer: A

  Explanation: The command "show security dynamic-address category-name DS hield" will show the IP addresses that are part of the DS hield category. By filtering the output of this command with the "match 203.0.113.5" command, you can determine if the IP address 203.0.113.5 is part of the DS hield feed. This command will check the feeds that are configured on SRX Series device and are associated to juniper ATP Cloud.