Juniper JNCIP-SEC JN0-636 Questions & Answers

• Question 81:

  Regarding IPsec CoS-based VPNs, what is the number of IPsec SAs associated with a peer based upon?

  A. The number of traffic selectors configured for the VPN.

  B. The number of CoS queues configured for the VPN.

  C. The number of classifiers configured for the VPN.

  D. The number of forwarding classes configured for the VPN.

  Correct Answer: D

  Explanation: In IPsec CoS-based VPNs, the number of IPsec Security Associations (SAs) associated with a peer is based on the number of forwarding classes configured for the VPN. The forwarding classes are used to classify and prioritize different types of traffic, such as voice and data traffic. Each forwarding class requires a separate IPsec SA to be established between the peers, in order to provide the appropriate level of security and quality of service for each type of traffic.

• Question 82:

  Click the Exhibit button.

  

  Which type of NAT is shown in the exhibit?

  A. NAT46

  B. NAT64

  C. persistent NAT

  D. DS-Lite

  Correct Answer: B

• Question 83:

  Exhibit

  

  Referring to the exhibit, which two statements are true? (Choose two.)

  A. The 3uspicious_Endpoint3 feed is only usable by the SRX-1 device.

  B. You must manually create the suspicious_Endpoint3 feed in the Juniper ATP Cloud interface.

  C. The 3uspiciou3_Endpoint3 feed is usable by any SRX Series device that is a part of the same realm as SRX-1

  D. Juniper ATP Cloud automatically creates the 3uopi'cioua_Endpoints feed after you commit the security policy.

  Correct Answer: AC

• Question 84:

  Exhibit

  

  You are trying to configure an IPsec tunnel between SRX Series devices in the corporate office and branch1. You have committed the configuration shown in the exhibit, but the IPsec tunnel is not establishing. In this scenario, what would solve this problem.

  A. Add multipoint to the st0.0 interface configuration on the branch1 device.

  B. Change the IKE proposal-set to compatible on the branch1 and corporate devices.

  C. Change the local identity to inet advpn on the branch1 device.

  D. Change the IKE mode to aggressive on the branch1 and corporate devices.

  Correct Answer: C

• Question 85:

  What is the purpose of the Switch Microservice of Policy Enforcer?

  A. to isolate infected hosts

  B. to enroll SRX Series devices with Juniper ATP Cloud

  C. to inspect traffic for malware

  D. to synchronize security policies to SRX Series devices

  Correct Answer: D

  Explanation: The Switch Microservice of Policy Enforcer is used to synchronize security policies to SRX Series devices. It receives the policy configuration from the Policy Manager and pushes it to the SRX Series devices. It's responsible for configuring the security policies on the SRX devices, including firewall rules, VPN configurations, and other security features.

  The purpose of the Switch Microservice of Policy Enforcer is to synchronize security policies to SRX Series devices. It allows administrators to quickly apply security policies across their network devices, ensuring consistent security settings. Additionally, it can help to prevent unauthorized access and malware propagation.

• Question 86:

  Exhibit

  

  Your company recently acquired a competitor. You want to use using the same IPv4 address space as your company. Referring to the exhibit, which two actions solve this problem? (Choose two)

  A. Configure static NAT on the SRX Series devices.

  B. Connect the competitor network using IPsec policy-based VPNs.

  C. Identify two neutral IPv4 address spaces for address translation.

  D. Configure IPsec Transport mode.

  Correct Answer: AC

• Question 87:

  Exhibit

  

  Referring to the exhibit, an internal host is sending traffic to an Internet host using the 203.0.113.1 reflexive address with source port 54311. Which statement is correct in this situation?

  A. Only the Internet host that the internal host originally communicated with can initiate traffic to reach the internal host using the 203.0.113.1 address, source port 54311, and a random destination port.

  B. Only the Internet host that the internal host originally communicated with can initiate traffic to reach the internal host using the 203.0 113.1 address, a random source port, and destination port 54311.

  C. Any host on the Internet can initiate traffic to reach the internal host using the 203.0.113.1 address, source port 54311, and a random destination port.

  D. Any host on the Internet can initiate traffic to reach the internal host using the 203.0.113.1 address, a random source port, and destination port 54311.

  Correct Answer: C

• Question 88:

  Which two features would be used for DNS doctoring on an SRX Series firewall? (Choose two.)

  A. The DNS ALG must be enabled.

  B. static NAT

  C. The DNS ALG must be disabled.

  D. source NAT

  Correct Answer: AD

  Explanation: DNS Doctoring is a feature that allows a firewall to rewrite the source IP address of DNS requests to match the address of the interface on which the request is received. In order to achieve this two main features are used:

  The DNS ALG (Application Layer Gateway) must be enabled: The DNS ALG is responsible for tracking and modifying DNS requests and responses. It allows the SRX Series firewall to understand the DNS protocol and to be able to rewrite

  the source IP address of DNS requests.

  Source NAT (Network Address Translation) is used: It is used to change the source IP address of the DNS request to match the address of the interface on which the request is received.

• Question 89:

  Exhibit

  

  Which statement is true about the output shown in the exhibit?

  A. The SRX Series device is configured with default security forwarding options.

  B. The SRX Series device is configured with packet-based IPv6 forwarding options.

  C. The SRX Series device is configured with flow-based IPv6 forwarding options.

  D. The SRX Series device is configured to disable IPv6 packet forwarding.

  Correct Answer: A

• Question 90:

  You have the NAT rule, shown in the exhibit, applied to allow communication across an IPsec tunnel between your two sites with identical networks. Which statement is correct in this scenario?

  A. The NAT rule with translate the source and destination addresses.

  B. The NAT rule will only translate two addresses at a time.

  C. The NAT rule in applied to the N/A routing instance.

  D. 10 packets have been processed by the NAT rule.

  Correct Answer: A