Weekend Special Limited Time Flat 70% Discount offer - Ends in 0d 00h 00m 00s - Coupon code: 70spcl

Juniper JN0-637 Security, Professional (JNCIP-SEC) Exam Practice Test

Page: 1 / 12
Total 115 questions

Security, Professional (JNCIP-SEC) Questions and Answers

Question 1

Click the Exhibit button.

Question # 1

Referring to the exhibit, which two statements are true? (Choose two.)

Options:

A.

The traffic is permitted.

B.

The traffic was initiated by the 10.10.102.10 address.

C.

The destination device is not responding.

D.

The traffic is denied.

Question 2

You need to generate a certificate for a PKI-based site-to-site VPN. The peer is expecting to

user your domain name vpn.juniper.net.

Which two configuration elements are required when you generate your certificate request? (Chose two,)

Options:

A.

ip-address 10.100.0.5

B.

subject CN=vpn.juniper.net

C.

email admin@juniper.net

D.

domain-name vpn.juniper.net

Question 3

Which two statements are correct about automated threat mitigation with Security Director? (Choose two.)

Options:

A.

Infected hosts are tracked by their IP address.

B.

Infected hosts are tracked by their chassis serial number.

C.

Infected hosts are tracked by their MAC address.

D.

Infected hosts are tracked by their user identity.

Question 4

Referring to the exhibit, you have been assigned the user LogicalSYS1 credentials shown in

the configuration.

Question # 4

In this scenario, which two statements are correct? (Choose two.)

Options:

A.

When you log in to the device, you will be permitted to view all routing tables available on the SRX device

B.

When you log in to the device, you will be permitted to view only the routing tables for Logic

C.

When you log in to the device, you will be located at the operational mode of the Logic

D.

When you log in to the device, you will be located at the operational mode of the main system

Question 5

You are using trace options to troubleshoot a security policy on your SRX Series device.

Question # 5

Referring to the exhibit, which two statements are true? (Choose two.)

Options:

A.

The SSH traffic matches an existing session.

B.

No entries are created in the SRX session table.

C.

The traffic is not destined for the root logical system.

D.

The security policy controls traffic destined to the SRX device.

Question 6

Exhibit:

Question # 6

Referring to the exhibit, a default static route on SRX-1 sends all traffic to ISP-A. You have configured APBR to send all requests for streaming video traffic to ISP-B. However, the return traffic from the streaming video server is coming through ISP-A, and the traffic is being dropped by SRX-1. You can only make changes on SRX-1.

How do you solve this problem?

Options:

A.

Place both ISP-facing interfaces in the same zone.

B.

Change the APBR routing instance from a forwarding instance to a virtual router instance.

C.

Enable AppTrack to keep track of the sessions and zones for the streaming video traffic.

D.

Configure BGP to control the return path of the streaming video traffic.

Question 7

A user reports that a specific application is not working properly. This application makes

multiple connection to the server and must have the same address every time from a pool and this behavior needs to be changed.

What would solve this problem?

Options:

A.

Use STUN.

B.

Use DNS doctoring.

C.

Use the address-persistent parameter.

D.

Use the persistent-nat parameter.

Question 8

Exhibit:

Question # 8

Referring to the exhibit, which technology would you use to provide communication between

IPv4 host1 and ipv4 internal host

Options:

A.

DS-Lite

B.

NAT444

C.

NAT46

D.

full cone NAT

Question 9

You are deploying OSPF over IPsec with an SRX Series device and third-party device using GRE.

Which two statements are correct? (Choose two.)

Options:

A.

The GRE interface should use lo0 as endpoints.

B.

The OSPF protocol must be enabled under the VPN zone.

C.

Overlapping addresses are allowed between remote networks.

D.

The GRE interface must be configured under the OSPF protocol.

Question 10

You configured two SRX series devices in an active/passive multimode HA setup.

In this scenario, which statement is correct?

Options:

A.

Both devices are in the passive state until the activeness determination process is completed.

B.

Both devices start in a hold state until the activeness determination process is completed.

C.

Both devices start in the undiscovered state until the activeness determination process is completed.

D.

Both devices are in the active state until the activeness determine determination process is completed.

Question 11

Which two statements about transparent mode and Ethernet switching mode on an SRX series

device are correct.

Options:

A.

In Ethernet switching mode, Layer 2 interfaces must be placed in a security zone.

B.

In Ethernet switching mode, IRB interfaces must be placed in a security zone.

C.

In transparent mode, Layer 2 interfaces must be placed in a security zone.

D.

In transparent mode, IRB interfaces must be placed in a security zone.

Question 12

Referring to the exhibit, you are assigned the tenantSYS1 user credentials on an SRX series

device.

In this scenario, which two statements are correct? (Choose two.)

Options:

A.

When you log in to the device, you will be located at the operational mode of the main system hierarchy.

B.

When you log in to the device, you will be located at the operational mode of the Tenant.SY51 logical system hierarchy.

C.

When you log in to the device, you will be permitted to view only the routing tables for the Tenant SYS1 logical system.

D.

When you log in to the device, you will be permitted to view all routing tables available on the on an SYS1 Series device.

Question 13

Exhibit:

Question # 13

Question # 13

In which mode is the SRX Series device?

Options:

A.

Packet

B.

Ethernet switching

C.

Mixed

D.

Transparent

Question 14

You have configured the backup signal route IP for your multinode HA deployment, and the ICL link fails.

Which two statements are correct in this scenario? (Choose two.)

Options:

A.

The current active node retains the active role.

B.

The active node removes the active signal route.

C.

The backup node changes the routing preference to the other node at its medium priority.

D.

The active node keeps the active signal route.

Question 15

You are deploying IPsec VPNs to securely connect several enterprise sites with ospf for dynamic

routing. Some of these sites are secured by third-party devices not running Junos.

Which two statements are true for this deployment? (Choose two.)

Options:

A.

OSPF over IPsec can be used for intersite dynamic routing.

B.

Sites with overlapping address spaces can be supported.

C.

OSPF over GRE over IPsec is required to enable intersite dynamic routing

D.

Sites with overlapping address spaces cannot be supported.

Question 16

Exhibit:

Question # 16

Question # 16

Referring to the exhibit, which two statements are correct? (Choose two.)

Options:

A.

The ge-0/0/3.0 and ge-0/0/4.0 interfaces are not active and will not respond to ARP requests to the virtual IP MAC address.

B.

This device is the backup node for SRG1.

C.

The ge-0/0/3.0 and ge-0/0/4.0 interfaces are active and will respond to ARP requests to the virtual IP MAC address.

D.

This device is the active node for SRG1.

Question 17

You are configuring an interconnect logical system that is configured as a VPLS switch to allow two logical systems to communicate.

Which two parameters are required when configuring the logical tunnel interfaces? (Choose two.)

Options:

A.

Encapsulation ethernet must be used.

B.

The virtual tunnel interfaces should only be configured with two logical unit pairs per logical system interconnect.

C.

The logical tunnel interfaces should be configured with two logical unit pairs per logical system interconnect.

D.

Encapsulation ethernet-vpls must be used.

Question 18

Exhibit:

Question # 18

Referring to the flow logs exhibit, which two statements are correct? (Choose two.)

Options:

A.

The packet is dropped by the default security policy.

B.

The packet is dropped by a configured security policy.

C.

The data shown requires a traceoptions flag of host-traffic.

D.

The data shown requires a traceoptions flag of basic-datapath.

Question 19

How does an SRX Series device examine exception traffic?

Options:

A.

The device examines the host-inbound traffic for the ingress interface and zone.

B.

The device examines the host-outbound traffic for the ingress interface and zone.

C.

The device examines the host-inbound traffic for the egress interface and zone.

D.

The device examines the host-outbound traffic for the egress interface and zone.

Question 20

Exhibit:

Question # 20

Question # 20

Referring to the exhibit, which statement is true?

Options:

A.

SRG1 is configured in hybrid mode.

B.

The ICL is encrypted.

C.

If SRG1 moves to peer 2, peer 1 will drop packets sent to the SRG1 interfaces.

D.

If SRG1 moves to peer 2, peer 1 will forward packets sent to the SRG1 interfaces.

Question 21

Which encapsulation type must be configured on the lt-0/0/0 logical units for an interconnect

logical systems VPLS switch?

Options:

A.

encapsulation ethernet-bridge

B.

encapsulation ethernet

C.

encapsulation ethernet-vpls

D.

encapsulation vlan-vpls

Question 22

Which two statements are correct about mixed mode? (Choose two.)

Options:

A.

Layer 2 and Layer 3 interfaces can use the same security zone.

B.

IRB interfaces can be used to route traffic.

C.

Layer 2 and Layer 3 interfaces can use separate security zones.

D.

IRB interfaces cannot be used to route traffic.

Question 23

Exhibit:

Question # 23

Referring to the exhibit, what do you use to dynamically secure traffic between the Azure and AWS clouds?

Options:

A.

You can dynamically secure traffic between the clouds by using user identities in the security policies.

B.

You can dynamically secure traffic between the clouds by using advanced connection tracking in the security policies.

C.

You can dynamically secure traffic between the clouds by using security tags in the security policies.

D.

You can dynamically secure traffic between the clouds by using URL filtering in the security policies.

Question 24

You have a multinode HA default mode deployment and the ICL is down.

In this scenario, what are two ways that the SRX Series devices verify the activeness of their peers? (Choose two.)

Options:

A.

Custom IP addresses may be configured for the activeness probe.

B.

Fabric link heartbeats are used to verify the activeness of the peers.

C.

Each peer sends a probe with the virtual IP address as the destination IP address.

D.

Each peer sends a probe with the virtual IP address as the source IP address and the upstream router as the destination IP address.

Question 25

Your customer needs embedded security in an EVPN-VXLAN solution.

What are two benefits of adding an SRX Series device in this scenario? (Choose two.)

Options:

A.

It enhances tunnel inspection for VXLAN encapsulated traffic with Layer 4-7 security services.

B.

It adds extra security with the capabilities of an enterprise-grade firewall in the EVPN-VXLAN underlay.

C.

It adds extra security with the capabilities of an enterprise-grade firewall in the EVPN-VXLAN overlay.

D.

It enhances tunnel inspection for VXLAN encapsulated traffic with only Layer 4 security services.

Question 26

 

You are attempting to ping an interface on your SRX Series device, but the ping is unsuccessful.

 

What are three reasons for this behavior? (Choose three.)

 

Options:

A.

    The interface is not assigned to a security zone.

 

B.

    The interface's host-inbound-traffic security zone configuration does not permit ping

 

C.

    The ping traffic is matching a firewall filter.

 

D.

    The device has J-Web enabled.

 

E.

     The interface has multiple logical units configured.

 

Question 27

Referring to the exhibit,

Question # 27

which two statements are correct about the NAT configuration? (Choose two.)

Options:

A.

Both the internal and the external host can initiate a session after the initial translation.

B.

Only a specific host can initiate a session to the reflexive address after the initial session.

C.

Any external host will be able to initiate a session to the reflexive address.

D.

The original destination port is used for the source port for the session.

Question 28

Exhibit:

Question # 28

You have configured a CoS-based VPN that is not functioning correctly.

Referring to the exhibit, which action will solve the problem?

Options:

A.

You must delete one forwarding class.

B.

You must change the loss priorities of the forwarding classes to low.

C.

You must use inet precedence instead of DSCP.

D.

You must change the code point for the DB-data forwarding class to 10000.

Question 29

You are configuring advanced policy-based routing. You have created a static route with next

hop of an interface in your inet.0 routing table

Question # 29

Question # 29

Referring to the exhibit, what should be changed to solve this issue?

Options:

A.

You should change the routing instance type to virtual-router.

B.

You should move the static route configuration to the main routing instance.

C.

You should move the inet. o table before the routing instance table in your rib-groups configuration.

D.

You should delete the interface-routes configuration under the routing-options hierarchy.

Question 30

You are asked to see if your persistent NAT binding table is exhausted.

Which show command would you use to accomplish this task?

Options:

A.

show security nat source persistent-nat-table summary

B.

show security nat source summary

C.

show security nat source pool all

D.

show security nat source persistent-nat-table all

Question 31

You have deployed an SRX Series device at your network edge to secure Internet-bound sessions for your local hosts using source NAT. You want to ensure that your users are able to interact with applications on the Internet that require more than one TCP session for the same application session.

Which two features would satisfy this requirement? (Choose two.)

Options:

A.

address persistence

B.

STUN

C.

persistent NAT

D.

double NAT

Question 32

Click the Exhibit button.

Question # 32

Referring to the exhibit, which two statements are correct? (Choose two.)

Options:

A.

This device is the backup node for SRG1.

B.

The ge-0/0/3.0 and ge-0/0/4.0 interfaces are not active and will not respond to ARP requests to the virtual IP MAC address.

C.

This device is the active node for SRG1.

D.

The ge-0/0/3.0 and ge-0/0/4.0 interfaces are active and will respond to ARP requests to the virtual IP MAC address.

Question 33

You are asked to establish IBGP between two nodes, but the session is not established. To troubleshoot this problem, you configured trace options to monitor BGP protocol message exchanges.

Question # 33

Question # 33

Referring to the exhibit, which action would solve the problem?

Options:

A.

Add the junos-host zone policy to permit the BGP packets.

B.

Add a firewall filter to lo0 that permits the BGP packets.

C.

Modify the security policy to permit the BGP packets.

D.

Add BGP to the lo0 host-inbound-traffic configuration.

Question 34

The SRX series device is performing static NAT. you want to ensure that host A can reach the

internal webserver www.juniper.net using domain name.

Question # 34

Referring to the exhibit, which two Junos features are required to accomplish this task? (Choose two.)

Options:

A.

DNS doctoring

B.

proxy ARP

C.

persistent NAT

D.

STUN

Page: 1 / 12
Total 115 questions