Juniper JNCIP-SEC JN0-636 Questions & Answers

• Question 41:

  Exhibit

  

  Which two statements are correct about the output shown in the exhibit? (Choose two.)

  A. The packet is silently discarded.

  B. The packet is part of an existing session.

  C. The packet is part of a new session.

  D. The packet is explicitly rejected.

  Correct Answer: CD

• Question 42:

  You have noticed a high number of TCP-based attacks directed toward your primary edge device. You are asked to configure the IDP feature on your SRX Series device to block this attack. Which two IDP attack objects would you configure to solve this problem? (Choose two.)

  A. Network

  B. Signature

  C. Protocol anomaly

  D. host

  Correct Answer: BC

• Question 43:

  You are deploying a virtualization solution with the security devices in your network Each SRX Series device must support at least 100 virtualized instances and each virtualized instance must have its own discrete administrative domain. In this scenario, which solution would you choose?

  A. VRF instances

  B. virtual router instances

  C. logical systems

  D. tenant systems

  Correct Answer: C

  Explanation: A logical system is a virtualization feature in SRX Series devices that allows you to create multiple, isolated virtual routers within a single physical device. Each logical system has its own routing table, firewall policies, and interfaces, and it can be managed and configured independently of the other logical systems. Logical systems are an effective way to isolate different administrative domains and to support a large number of virtualized instances.

• Question 44:

  Exhibit

  

  Which two statements are correct about the output shown in the exhibit? (Choose two.)

  A. The packet is processed as host inbound traffic.

  B. The packet matches the default security policy.

  C. The packet matches a configured security policy.

  D. The packet is processed in the first path packet flow.

  Correct Answer: AB

• Question 45:

  You are asked to download and install the IPS signature database to a device operating in chassis cluster mode. Which statement is correct in this scenario?

  A. You must download and install the IPS signature package on the primary node.

  B. The first synchronization of the backup node and the primary node must be performed manually.

  C. The first time you synchronize the IPS signature package from the primary node to the backup node, the primary node must be rebooted.

  D. The IPS signature package must be downloaded and installed on the primary and backup nodes.

  Correct Answer: D

• Question 46:

  Exhibit.

  

  Referring to the exhibit, which two statements are true? (Choose two.)

  A. Juniper Networks will not investigate false positives generated by this custom feed.

  B. The custom infected hosts feed will not overwrite the Sky ATP infected host's feed.

  C. The custom infected hosts feed will overwrite the Sky ATP infected host's feed.

  D. Juniper Networks will investigate false positives generated by this custom feed.

  Correct Answer: AC

  Explanation: https://www.juniper.net/documentation/en_US/junos-space18.1/policy- enforcer/topics/task/configuration/junos-space-policyenforcer-custom-feeds-infected-host- configure.html

• Question 47:

  You have a webserver and a DNS server residing in the same internal DMZ subnet. The public Static NAT addresses for the servers are in the same subnet as the SRX Series devices internet-facing interface.

  You implement DNS doctoring to ensure remote users can access the webserver.

  Which two statements are true in this scenario? (Choose two.)

  A. The DNS doctoring ALG is not enabled by default.

  B. The Proxy ARP feature must be configured.

  C. The DNS doctoring ALG is enabled by default.

  D. The DNS CNAME record is translated.

  Correct Answer: BC

• Question 48:

  Exhibit.

  

  Referring to the exhibit, which two statements are true? (Choose two.)

  A. The c-1 TSYS has a reservation for the security flow resource.

  B. The c-1 TSYS can use security flow resources up to the system maximum.

  C. The c-1 TSYS cannot use any security flow resources.

  D. The c-1 TSYS has no reservation for the security flow resource.

  Correct Answer: CD

  Explanation: https://www.juniper.net/documentation/en_US/junos/topics/topic- map/security-profile-logical-system.html

• Question 49:

  What are two important function of the Juniper Networks ATP appliance solution? (Choose two.).

  A. Statistics

  B. Analysis

  C. Detection

  D. Filtration

  Correct Answer: BC

  Explanation: https://www.juniper.net/us/en/products-services/security/advanced-threat- prevention/

• Question 50:

  Exhibit.

  

  Referring to the exhibit, a spoke member of an ADVPN is not functioning correctly.

  Which two commands will solve this problem? (Choose two.)

  A. [edit interfaces] user@srx# delete st0.0 multipoint

  B. [edit security ike gateway advpn-gateway] user@srx# delete advpn partner

  C. [edit security ike gateway advpn-gateway] user@srx# set version v1-only

  D. [edit security ike gateway advpn-gateway] user@srx# set advpn suggester disable

  Correct Answer: BD

  Explanation: https://www.juniper.net/documentation/en_US/junos/topics/topic- map/security-auto-discovery-vpns.html