Juniper JNCIP-SEC JN0-636 Questions & Answers

• Question 31:

  Exhibit

  

  You are validating bidirectional traffic flows through your IPsec tunnel. The 4546 session represents traffic being sourced from the remote end of the IPsec tunnel. The 4547 session represents traffic that is sourced from the local network destined to the remote network.

  Which statement is correct regarding the output shown in the exhibit?

  A. The remote gateway address for the IPsec tunnel is 10.20.20.2

  B. The session information indicates that the IPsec tunnel has not been established

  C. The local gateway address for the IPsec tunnel is 10.20.20.2

  D. NAT is being used to change the source address of outgoing packets

  Correct Answer: B

• Question 32:

  You are asked to allocate security profile resources to the interconnect logical system for it to work properly. In this scenario, which statement is correct?

  A. The NAT resources must be defined in the security profile for the interconnect logical system.

  B. No resources are needed to be allocated to the interconnect logical system.

  C. The resources must be calculated based on the amount of traffic that will flow between the logical systems.

  D. The flow-session resource must be defined in the security profile for the interconnect logical system.

  Correct Answer: D

  Explanation: The flow-session resource is needed in order to ensure adequate and secure communication between the two logical systems.

• Question 33:

  You must implement an IPsec VPN on an SRX Series device using PKI certificates for authentication. As part of the implementation, you are required to ensure that the certificate submission, renewal, and retrieval processes are handled

  automatically from the certificate authority.

  In this scenario, which statement is correct.

  A. You can use CRL to accomplish this behavior.

  B. You can use SCEP to accomplish this behavior.

  C. You can use OCSP to accomplish this behavior.

  D. You can use SPKI to accomplish this behavior.

  Correct Answer: B

  Certificate RenewalThe renewal of certificates is much the same as initial certificate enrollment except you are just replacing an old certificate(about to expire) on the VPN device with a new certificate. As with the initial certificate request, only

  manual renewal issupported. SCEP can be used to re-enroll local certificates automatically before they expire. Refer to Appendix D for moredetails.

• Question 34:

  Your Source NAT implementation uses an address pool that contains multiple IPv4 addresses Your users report that when they establish more than one session with an external application, they are prompted to authenticate multiple times External hosts must not be able to establish sessions with internal network hosts.

  What will solve this problem?

  A. Disable PAT.

  B. Enable destination NAT.

  C. Enable persistent NAT

  D. Enable address persistence.

  Correct Answer: D

  Explanation: The solution to this problem is to enable address persistence. This will ensure that the same external IP address is used for multiple sessions between an internal host and an external host. This will result in only one authentication being required, as the same external IP address will be used for all sessions.

• Question 35:

  You want to configure a threat prevention policy.

  Which three profiles are configurable in this scenario? (Choose three.)

  A. device profile

  B. SSL proxy profile

  C. infected host profile

  D. CandC profile

  E. malware profile

  Correct Answer: ACE

• Question 36:

  SRX Series device enrollment with Policy Enforcer fails To debug further, the user issues the following command show configuration services security--intelligence url

  https : //cloudfeeds . argon . juniperaecurity . net/api/manifeat. xml

  and receives the following output:

  What is the problem in this scenario?

  A. The device is directly enrolled with Juniper ATP Cloud.

  B. The device is already enrolled with Policy Enforcer.

  C. The SRX Series device does not have a valid license.

  D. Junos Space does not have matching schema based on the

  Correct Answer: C

• Question 37:

  You have designed the firewall filter shown in the exhibit to limit SSH control traffic to yours SRX Series device without affecting other traffic. Which two statement are true in this scenario? (Choose two.)

  A. The filter should be applied as an output filter on the loopback interface.

  B. Applying the filter will achieve the desired result.

  C. Applying the filter will not achieve the desired result.

  D. The filter should be applied as an input filter on the loopback interface.

  Correct Answer: CD

  Explanation: https://www.juniper.net/documentation//en_US/junos/topics/concept/firewall- filter-ex-series-evaluation-understanding.html

• Question 38:

  Exhibit.

  

  Referring to the exhibit, which two statements are true? (Choose two.)

  A. The configured solution allows IPv6 to IPv4 translation.

  B. The configured solution allows IPv4 to IPv6 translation.

  C. The IPv6 address is invalid.

  D. External hosts cannot initiate contact.

  Correct Answer: AC

• Question 39:

  In Juniper ATP Cloud, what are two different actions available in a threat prevention policy to deal with an infected host? (Choose two.)

  A. Send a custom message

  B. Close the connection.

  C. Drop the connection silently.

  D. Quarantine the host.

  Correct Answer: BD

  Explanation: In Juniper ATP Cloud, a threat prevention policy allows you to define how the system should handle an infected host. Two of the available actions are:

  Close the connection: This action will close the connection between the infected host and the destination to which it is trying to connect. This will prevent the host from communicating with the destination and will stop any malicious activity.

  Quarantine the host: This action will isolate the infected host from the network by placing it in a quarantine VLAN. This will prevent the host from communicating with other devices on the network, which will prevent it from spreading malware

  or exfiltrating data.

  Sending a custom message is used to notify the user and administrator of the action taken. Drop the connection silently is not an action available in Juniper ATP Cloud.

• Question 40:

  Exhibit You are using trace options to verity NAT session information on your SRX Series device Referring to the exhibit, which two statements are correct? (Choose two.)

  

  A. This packet is part of an existing session.

  B. The SRX device is changing the source address on this packet from

  C. This is the first packet in the session

  D. The SRX device is changing the destination address on this packet 10.0.1 1 to 172 20.101.10.

  Correct Answer: CD