Free JN0-633 Exam Dumps Preview

You are asked to provide access for an external VoIP server to VoIP phones in your network using private addresses. However, due to security concerns, the VoIP server should only be able to initiate connections to each phone once the phone has logged into the VoIP server. The VoIP server requires access to the
phones using multiple ports.

Which type of persistent NAT is required?

-- Exhibit --
[edit security]
user@srx# show idp
...
application-ddos Webserver {
service http;
connection-rate-threshold 1000;
context http-get-url {
hit-rate-threshold 60000;
value-hit-rate-threshold 30000;
time-binding-count 10;
time-binding-period 25;
}
}
-- Exhibit --

You are using AppDoS to protect your network against a bot attack, but noticed an approved application has falsely triggered the configured IDP action of drop. You adjusted your AppDoS configuration as shown in the exhibit. However, the approved traffic is still dropped.

What are two reasons for this behavior? (Choose two.)

Which two configuration statements are used to share interface routes between routing instances? (Choose two.)

You are asked to configure class of service (CoS) on an SRX device running in transparent mode.

Which command would you use?

Click the Exhibit button

[edit security]
user@host# show policies
global {
policy new-policy {
match {
source-address any;
destination-address any;
application junos-https;
}
then {
permit {
application-services {
application-firewall {

rule-set appfw;
}
}
}
}
}
}

[edit security]
user@host# show application-firewall
rule-sets appfw {
rule 1 {
match {
dynamic-application junos:SSL;
}
then {
permit;
}
}
rule 2 {
match {
dynamic-application junos:HTTP;
}
then {
reject;
}
}
default-rule {
permit;
}
}

Referring to the exhibit, which two statements are correct? (Choose two.)

Click the Exhibit button.

In the network shown in the exhibit, you want to forward traffic from the employees to ISP1 and ISP2. You want to forward all Web traffic to ISP1 and all other traffic to ISP2. However, your configuration is not producing the expected results. Part of the configuration is shown in the exhibit. When you run the show route table isp1 command, you do not see the default route listed.

What is causing this behavior?

Exhibit:

You have implemented a tunnel in your network using DS-Lite. The tunnel is formed between one of the SRX devices in your network and a DS-Lite-compatible CPE device in your customer's network.

Which two statements are true about this scenario? (Choose two.)

You must configure a central SRX device connected to two branch offices with overlapping IP address space. The branch office connections to the central SRX device must reside in separate routing instances.

Which two components are required? (Choose two.)

You have been asked to configure traffic to flow between two virtual routers (VRs) residing on two unique logical systems (LSYSs) on the same SRX5800.

How would you accomplish this task?

You configured a custom signature attack object to match specific components of an attack:

HTTP-request
Pattern .*\x90 90 90 ... 90
Direction: client-to-server

Which client traffic would be identified as an attack?

Which feature is used for layer 2 bridging on an SRX Series device?

You have a group IPsec VPN established with a single key server and five client devices.
Regarding this scenario, which statement is correct?

You must ensure that your Layer 2 traffic is secured on your SRX Series device in transparent mode.

What must be considered when accomplishing this task?

In the IPS packet processing flow on an SRX Series device, when does application identification occur?

-- Exhibit --

[edit forwarding-options]
user@srx240# show
packet-capture {
file filename my-packet-capture;
maximum-capture-size 1500;
}
-- Exhibit --

Referring to the exhibit, you are attempting to perform a packet capture on an SRX240 to troubleshoot an SSH issue in your network. However, no information appears in the packet capture file.

Which firewall filter must you apply to the necessary interface to collect data for the packet capture?

Which action will allow an administrator to connect in band to an SRX Series device in transparent mode over SSH?

You want to configure in-band management of an SRX device in transparent mode.

Which command is required to enable this functionality?

A security administrator has configured an IPsec tunnel between two SRX devices. The devices are configured with OSPF on the st0 interface and an external interface destined to the IPsec endpoint. The adminstrator notes that the IPsec tunnel and OSPF adjacency keep going up and down.

Which action would resolve this issue?

What is a benefit of using a group VPN?

You are working as a security administrator and must configure a solution to protect against distributed botnet attacks on your company's central SRX cluster.

How would you accomplish this goal?

Your management has a specific set of Web-based applications that certain employees are allowed to use.

Which two SRX Series device features would be used to accomplish this task? (Choose two.)

You have initiated the download of the IPS signature database on your SRX Series device.

Which command would you use to confirm the download has completed?

You are troubleshooting an IPsec session and see the following IPsec security associations:

ID Gateway Port Algorithm SPI Life:sec/kb Mon vsys
< 192.168.224.1 500 ESP:aes-256/sha1 d6393645 26/ unlim - 0
> 192.168.224.1 500 ESP:aes-256/sha1 153ec235 26/ unlim - 0
< 192.168.224.1 500 ESP:aes-256/sha1 f9a2db9a 3011/ unlim - 0
> 192.168.224.1 500 ESP:aes-256/sha1 153ec236 3011/ unlim - 0

What are two reasons for this behavior? (Choose two.)

What are two intrusion protection mechanisms available on SRX Series Services Gateways? (Choose two.)

You are asked to configure your SRX Series device to support IDP SSL inspections for up to 6,000 concurrent HTTP sessions to a server within your network.

Which two statements are true in this scenario? (Choose two.)

Click the Exhibit button.

Traffic is being sent from Host-1 to Host-2 through an IPsec VPN. In this process, SRX-2 is using NAT to change the destination address of Host-2 from 192.168.1.1 to 10.60.60.1 SRX-1 uses the 172.31.50.1 address for its tunnel endpoint and SRX-2 uses the 10.10.50.1 address for its tunnel endpoint.

Referring to the exhibit, which statement is true?

Exhibit:

Your manager asks you to show which attacks have been detected on your SRX Series device using the
IPS feature.

Which command would you use to accomplish this task?