Juniper Juniper Certifications JN0-740 Questions & Answers

• Question 81:

  You are looking at the event log of the initiating device and it says Received notify message for DOI <1> <14> . What is likely to be the problem?

  A. Phase 2 PFS failure

  B. Phase 1 gateway failure

  C. Phase 1 proposal mismatch

  D. Phase 2 proposal mismatch

  Correct Answer: D

• Question 82:

  You are looking at the event log of the responding device and it says Rejected an initial Phase 1 packet from an unrecognized peer gateway Which is NOT a likely reason for the failure?

  A. Peer ID misconfigured

  B. gateway address misconfigured

  C. Outgoing Interface misconfigured

  D. Security proposals misconfigured

  Correct Answer: D

• Question 83:

  Your VPN is failing during Phase 2 communication. You check your local event log and do not see anything to indicate why the failure occurred. What action should be taken to fix the problem?

  A. View the event log of the destination gateway

  B. Configure the peer-id on your local IKE gateway

  C. Delete the remote NetScreen configuration and rebuild it correctly

  D. Run Debug on the local NetScreen to view the error output in the log

  Correct Answer: A

• Question 84:

  Which command is used to avoid IP Fragmentation when configuring IPSec on a NetScreen device?

  A. set flow

  B. set tcp-mss flow

  C. set flow tcp-mss

  D. set mss-flow size

  Correct Answer: C

• Question 85:

  Which three are part of the configuration of an IKE Phase 1 gateway? (Choose three.)

  A. preshare key

  B. security zone

  C. negotiation mode

  D. outgoing interface

  E. Diffie-Hellman group number for PFS

  Correct Answer: ACD

• Question 86:

  Which command is used to avoid IP fragmentation when configuring IPSec on a ScreenOS device?

  A. set flow

  B. set tcp-mss flow

  C. set flow tcp-mss

  D. set mss-flow size

  Correct Answer: C

• Question 87:

  Which two statements are accurate about AH packets? (Choose two.)

  A. AH authenticates the complete packet.

  B. AH offers enhanced security over ESP.

  C. AH allows the creation of unencrypted VPN networks.

  D. AH cannot traverse NAT devices when operating in transport mode.

  Correct Answer: CD

• Question 88:

  Which is NOT part of the configuration of an IKE Phase 1 gateway?

  A. Security Zone

  B. Security proposal

  C. Peer identification

  D. Outgoing interface

  Correct Answer: A

• Question 89:

  Which statement is correct about the sequence number in the IPSec packets?

  A. The sequence number is used by default on all ScreenOS devices.

  B. The sequence number is checked by default by the ScreenOS device for every received packet.

  C. The sequence number is used to provide anti-replay services for ESP and AH packets.

  D. The sequence number is used to uniquely identify every security parameter index in a tunnel.

  Correct Answer: C

• Question 90:

  Which two statements are true about symmetric key algorithms? (Choose two.)

  A. DH and RSA are symmetric.

  B. DES, 3DES, AES are symmetric.

  C. Symmetric key algorithms are computationally more expensive.

  D. Symmetric key algorithms are more suitable for bulk data transfers.

  Correct Answer: BD