JN0-334 Online Training Archives

Passing Juniper JN0-334 exam can effectively help you entrench yourself and enhance your status in this competitive IT area. In our Exam4Training you can get the related Juniper JN0-334 Security, Specialist (JNCIS-SEC) Online Training. Our Exam4Training IT experts team will timely provide you the accurate and detailed training materials about JNCIS-SEC JN0-334 exam. Through the Juniper JN0-334 Security, Specialist (JNCIS-SEC) Online Training provided by Exam4Training, we can ensure you have a successful challenge when you are the first time to participate in the Security, Specialist (JNCIS-SEC) exam.

Page 1 of 6

1. Which statement describes the AppTrack module in AppSecure?

The AppTrack module provides enforcement with the ability to block traffic, based on specific applications.

The AppTrack module provides control by the routing of traffic, based on the application.

The AppTrack module identifies the applications that are present in network traffic.

The AppTrack module provides visibility and volumetric reporting of application usage on the network.

2. Click the Exhibit button.

Referring to the exhibit, which two values in the JIMS SRX client configuration must match the values configured on the SRX client? (Choose two.)

IPv6 Reporting

Client ID

Client Secret

Token Lifetime

3. Click the Exhibit button.

Referring to the exhibit, which statement is true?

IDP blocks root users.

IDP closes the connection on matched sessions.

IDP ignores the connection on matched sessions.

IDP blocks all users.

4. What are two valid JIMS event log sources? (Choose two.)

Microsoft Windows Server 2012 audit logs

Microsoft Active Directory server event logs

Microsoft Exchange Server event logs

Microsoft Active Directory audit logs

5. Which three statements are true about the difference between cSRX-based virtual security deployments and vSRX-based virtual security deployments? (Choose three.)

vSRX provides Layer 2 to Layer 7 secure services and cSRX provides Layer 4 to Layer 7 secure services.

cSRX requires less storage and memory space for a given deployment than vSRX-based solutions.

cSRX-based solutions are more scalable than vSRX-based solutions.

vSRX and cSRX both provide Layer 2 to Layer 7 secure services.

vSRX provides faster deployment time and faster reboots compared to cSR

6. Click the Exhibit button.

You have implemented SSL proxy client protection. After implementing this feature, your users are complaining about the warning message shown in the exhibit.

Which action must you perform to eliminate the warning message?

Configure the SRX Series device as a trusted site in the client Web browsers.

Regenerate the SRX self-signed CA certificate and include the correct organization name.

Import the SRX self-signed CA certificate into the client Web browsers.

Import the SRX self-signed CA certificate into the SRX certificate public store.

7. Which two statements are correct about server-protection SSP proxy? (Choose two.)

The server-protection SSL proxy intercepts the server certificate.

The server-protection SSL proxy is also known as SSL reverse proxy.

The server-protection SSL proxy forwards the server certificate after modification.

The server-protection SSL proxy acts as the server from the client’s perspective.

8. Which two statements describe application-layer gateways (ALGs)? (Choose two.)

ALGs are designed for specific protocols that require multiple sessions.

ALGs are used with protocols that use multiple ports.

ALGs can only be configured using Security Director.

ALGs are designed for specific protocols that use a single TCP session.

9. When referencing a SSL proxy profile in a security policy, which two statements are correct? (Choose two.)

A security policy can reference both a client-protection SSL proxy profile and a server-protection proxy profile.

If you apply an SSL proxy profile to a security policy and forget to apply any Layer7 services to the security policy, any encrypted traffic that matches the security policy is not decrypted.

A security policy can only reference a client-protection SSL proxy profile or a server-protection SSL proxy profile.

If you apply an SSL proxy profile to a security policy and forget to apply any Layer7 services to the security policy, any encrypted traffic that matches the security policy is decrypted.

10. You want to support reth LAG interfaces on a chassis cluster.

What must be enabled on the interconnecting switch to accomplish this task?

RSTP

802.3ad

LLDP

swfab

Page 2 of 6

11. Click the Exhibit button.

Referring to the exhibit, which two devices are considered to be part of the secure fabric site with Policy Enforcer? (Choose two.)

Server-2

SRX-1

Server-1

QFX-1

12. What is the maximum number of supported interfaces on a vSRX hosted in a VMware environment?

13. Click the Exhibit button.

You examine the log file shown in the exhibit after running the set security idp active-policy

command.

Which two statements are true in this scenario? (Choose two.)

The IDP policy compiled successfully.

The IDP policy loaded successfully.

The IDP hit cache is set to 16384.

The entire configuration was committed.

14. What is the default timeout period for a TCP session in the session table of a Junos security device?

1 minute

60 minutes

15 minutes

30 minutes

15. Click the Exhibit button.

The output shown in the exhibit is displayed in which format?

syslog

sd-syslog

binary

WELF

16. Which two functions are performed by Juniper Identity Management Service (JIMS)? (Choose two.)

JIMS synchronizes Active Directory authentication information between a primary and secondary JIMS server.

JIMS forwards Active Directory authentication information to SRX Series client devices.

JIMS collects and maintains a database of authentication information from Active Directory domains.

JIMS replicates Active Directory authentication information to non-trusted Active Directory domain controllers.

17. You are deploying the Junos application firewall feature in your network.

In this scenario, which two elements are mapped to applications in the application system cache? (Choose two.)

destination port

source port

destination IP address

source IP address

18. You must fine tune an IPS security policy to eliminate false positives. You want to create exemptions to the normal traffic examination for specific traffic.

Which two parameters are required to accomplish this task? (Choose two.)

source IP address

destination IP address

destination port

source port

19. Click the Exhibit button.

Which two statements are true about the configuration shown in the exhibit? (Choose two.)

The session is removed from the session table after 10 seconds of inactivity.

The session is removed from the session table after 10 milliseconds of inactivity.

Aggressive aging is triggered if the session table reaches 95% capacity.

Aggressive aging is triggered if the session table reaches 80% capacity.

20. Click the Exhibit button.

You are configuring an SRX chassis cluster with the node-specific hostname and management address. Referring to the exhibit, which configuration completes this requirement?

A)

Option A

Option B

Option C

Option D

Page 3 of 6

21. Which two statements describe SSL proxy on SRX Series devices? (Choose two.)

SSL proxy supports TLS version 1.2.

Client-protection is also known as reverse proxy.

SSL proxy is supported when enabled within logical systems.

SSL proxy relies on Active Directory to provide secure communication.

22. How many nodes are configurable in a chassis cluster using SRX Series devices?

23. Which statement is true about high availability (HA) chassis clusters for the SRX Series device?

Cluster nodes require an upgrade to HA compliant Routing Engines.

Cluster nodes must be connected through a Layer 2 switch.

There can be active/passive or active/active clusters.

HA clusters must use NAT to prevent overlapping subnets between the nodes.

24. Which default protocol and port are used for JIMS to SRX client communication?

WMI over TCP; port 389

ADSI over TCP; port 389

HTTPS over TCP: port 443

RPC over TCP, port 135

25. You must ensure that all encrypted traffic passing through your SRX device uses strong protocols and ciphers.

Which feature should you implement to satisfy this requirement?

SSL proxy

AppSecure

JIMS

JATP

26. You are configuring a client-protection SSL proxy profile.

Which statement is correct in this scenario?

A server certificate is not used but a root certificate authority is used.

A server certificate and root certificate authority are not used.

A server certificate is used but a root certificate authority is not used.

A server certificate and a root certificate authority are both used.

27. Which two statements describe JSA? (Choose two.)

Security Director must be used to view third-party events rom JSA flow collectors.

JSA supports events and flows from Junos devices, including third-party devices.

JSA events must be manually imported into Security Directory using an SSH connection.

JSA can be used as a log node with Security Director or as a standalone solution.

28. Which statement about the control link in a chassis cluster is correct?

A cluster can have redundant control links.

Recovering from a control link failure requires a reboot.

The control link heartbeats contain the configuration file of the nodes.

The control messages sent over the link are encrypted by default.

29. Which solution should you use if you want to detect known attacks using signature-based methods?

SSL proxy

JIMS

IPS

ALGs

30. Which two solutions provide a sandboxing feature for finding zero-day malware threats? (Choose two.)

Sky ATP

UTM

JATP

IPS

Page 4 of 6

31. What are two supported hypervisors for hosting a vSRX? (Choose two.)

VMware ESXi

Solaris Zones

KVM

Docker

32. You are asked to change when your SRX high availability failover occurs. One network interface is considered more important than others in the high availability configuration. You want to prioritize failover based on the state of that interface.

Which configuration would accomplish this task?

Create a VRRP group configuration that lists the reth’s IP address as the VIP while using each physical interface that make up the reth definition of each SRX HA pair.

Configure IP monitoring of the important interface’s IP address and adjust the heartbeat interval and heartbeat threshold to the shortest settings.

Create a separate redundancy group to isolate the important interface; set the priority of the new redundancy group to 255.

Configure interface monitor inside the redundancy group that contains the important physical interface; adjust the weight associated with the monitored interface to 255.

33. Which three Encapsulating Security Payload protocols do the SRX Series devices support with IPsec? (Choose three.)

DES

RC6

TLS

AES

3DES

34. What are three characteristics of session-based forwarding, compared to packet-based forwarding, on an SRX Series device? (Choose three.)

Session-based forwarding uses stateful packet processing.

Session-based forwarding requires less memory.

Session-based forwarding performs faster processing of existing session.

Session-based forwarding uses stateless packet processing,

Session-based forwarding uses six tuples of information.

35. You have configured source NAT with port address translation. You also need to guarantee that the same IP address is assigned from the source NAT pool to a specific host for multiple concurrent sessions.

Which NAT parameter would meet this requirement?

port block-allocation

port range twin-port

address-persistent

address-pooling paired

36. 168.150.111 using HTTP?

The client will be denied by policy p2.

The client will be denied by policy p1.

The client will be permitted by policy p2.

The client will be permitted by policy p1.

37. Click the Exhibit button.

Which feature is enabled with destination NAT as shown in the exhibit?

NAT overload

block allocation

port translation

NAT hairpinning

38. Which two statements about security policy actions are true? (Choose two.)

The log action implies an accept action.

The log action requires an additional terminating action.

The count action implies an accept action.

The count action requires an additional terminating action.

39. Which two statements are true about global security policies? (Choose two.)

Global security policies are evaluated before regular security policies.

Global security policies can be configured to match addresses across multiple zones.

Global security policies can match traffic regardless of security zones.

Global security policies do not support IPv6 traffic.

40. Which statement is true about functional zones?

Functional zones are a collection of regulated transit network segments.

Functional zones provide a means of distinguishing groups of hosts and their resources from one another.

Functional zones are used for management.

Functional zones are the building blocks for security policies.

Page 5 of 6

41. You have recently configured an IPsec tunnel between two SRX Series devices. One of the devices is assigned an IP address using DHCP with an IP address that changes frequently. Initial testing indicates that the IPsec tunnel is not working. Troubleshooting has revealed that Phase 1 negotiations are failing.

Which two actions would solve the problem? (Choose two.)

Verify that the device with the IP address assigned by DHCP is the traffic initiator.

Verify that VPN monitoring is enabled.

Verify that the IKE policy is configured for aggressive mode.

Verify that PKI is properly configured.

42. Click the Exhibit button.

Which statement would explain why the IP-monitoring feature is functioning incorrectly?

The global weight value is too large for the configured global threshold.

The secondary IP address should be on a different subnet than the reth IP address.

The secondary IP address is the same as the reth IP address.

The monitored IP address is not on the same subnet as the reth IP address.

43. Click the Exhibit button.

You have configured NAT on your network so that Host A can communicate with Server B. You want to ensure that Host C can initiate communication with Host A using Host A’s reflexive address.

Referring to the exhibit, which parameter should you configure on the SRX Series device to satisfy this requirement?

Configure persistent NAT with the target-hostparameter.

Configure persistent NAT with the target-host-portparameter.

Configure persistent NAT with the any-remote-hostparameter.

Configure persistent NAT with the port-overloadingparameter.

44. Which feature is used when you want to permit traffic on an SRX Series device only at specific times?

scheduler

pass-through authentication

ALGs

counters

45. Which two modes are supported during the Phase 1 IKE negotiations used to establish an IPsec tunnel? (Choose two.)

transport mode

aggressive mode

main mode

tunnel mode

46. Which statement describes the function of NAT?

NAT encrypts transit traffic in a tunnel.

NAT detects various attacks on traffic entering a security device.

NAT translates a public address to a private address.

NAT restricts or permits users individually or in a group.

47. Click the Exhibit button.

You are monitoring traffic, on your SRX300 that was configured using the factory default security parameters. You notice that the SRX300 is not blocking traffic between Host A and Host B as expected.

Referring to the exhibit, what is causing this issue?

Host B was not assigned to the Untrust zone.

You have not created address book entries for Host A and Host

The default policy has not been committed.

The default policy permits intrazone traffic within the Trust zone.

48. What is the function of redundancy group 0 in a chassis cluster?

Redundancy group 0 identifies the node controlling the cluster management interface IP addresses.

The primary node for redundancy group 0 identifies the first member node in a chassis cluster.

The primary node for redundancy group 0 determines the interface naming for all chassis cluster nodes.

The node on which redundancy group 0 is primary determines which Routing Engine is active in the cluster.

49. Which statement describes the function of screen options?

Screen options encrypt transit traffic in a tunnel.

Screen options protect against various attacks on traffic entering a security device.

Screen options translate a private address to a public address.

Screen options restrict or permit users individually or in a group.

50. You want to protect your SRX Series device from the ping-of-death attack coming from the untrust security zone.

How would you accomplish this task?

Configure the host-inbound-traffic system-services ping except parameter in the untrust security zone.

Configure the application tracking parameter in the untrust security zone.

Configure a from-zone untrust to-zone trust security policy that blocks ICMP traffic.

Configure the appropriate screen and apply it to the [edit security zone security-zone untrust] hierarchy.

Page 6 of 6

51. After an SRX Series device processes the first packet of a session, how are subsequent packets for the same session processed?

They are processed using fast-path processing.

They are forwarded to the control plane for deep packet inspection.

All packets are processed in the same manner.

They are queued on the outbound interface until a matching security policy is found.

52. You must verify if destination NAT is actively being used by users connecting to an internal server from the Internet.

Which action will accomplish this task on an SRX Series device?

Examine the destination NAT translations table.

Examine the installed routes in the packet forwarding engine.

Examine the NAT translation table.

Examine the active security flow sessions.

53. Which interface is used exclusively to forward Ethernet-switching traffic between two chassis cluster nodes?

swfab0

fxp0

fab0

me0

54. Which three statements describes traditional firewalls? (Choose three.)

A traditional firewall performs stateless packet processing.

A traditional firewall offers encapsulation, authentication, and encryption.

A traditional firewall performs stateful packet processing.

A traditional firewall forwards all traffic by default.

A traditional firewall performs NAT and PA

55. Which SRX5400 component is responsible for performing first pass security policy inspection?

Routing Engine

Switch Control Board

Services Processing Unit

Modular Port Concentrator

56. 100.75.75. The external DNS server address is 75.75.76.76. Traffic from the inside server to the DNS server fails.

Referring to the exhibit, what is causing the problem?

The security policy must match the translated destination address.

Source and static NAT cannot be configured at the same time.

The static NAT rule must use the global address book entry name for the DNS server.

The security policy must match the translated source and translated destination address.

57. Click the Exhibit button.

Users at a remote office are unable to access an FTP server located at the remote corporate data center as expected. The remote FTP server is listening on the non-standard TCP port 2121.

Referring to the exhibit, what is causing the problem?

The FTP clients must be configured to listen on non-standard client ports for the FTP data channel negotiations to succeed.

Two custom FTP applications must be defined to allow bidirectional FTP communication through the SRX Series device.

The custom FTP application definition does not have the FTP ALG enabled.

A new security policy must be defined between the untrust and trust zones.

58. You want to trigger failover of redundancy group 1 currently running on node 0 and make node 1 the primary node the redundancy group 1.

Which command would be used accomplish this task?

[email protected]# set chassis cluster redundancy-group 1 node 1

[email protected]> request chassis cluster failover redundancy-group 1 node 1

[email protected]# set chassis cluster redundancy-group 1 preempt

[email protected]> request chassis cluster failover reset redundancy-group 1

59. You need to configure an IPsec tunnel between a remote site and a hub site. The SRX Series device at the remote site receives a dynamic IP address on the external interface that you will use for IPsec.

Which feature would you need to configure in this scenario?

NAT-T

crypto suite B

aggressive mode

IKEv2

60. Which statement is true about high availability (HA) chassis clusters for the SRX Series device?

Cluster nodes require an upgrade to HA compliant Routing Engines.

Cluster nodes must be connected through a Layer 2 switch.

There can be active/passive or active/active clusters.

HA clusters must use NAT to prevent overlapping subnets between the nodes.