JN0-633 by Juniper Actual Free Exam Questions And Answers

Question 1

What are two configurable routing instance types? (Choose two.)

A. GRE

B. VPLS

C. IPsec

D. VRF

Discussion 0

Correct Answer: B,D Vote an answer

Question 2

You want to route traffic between two newly created virtual routers without the use of logical systems using the configuration options on the SRX5800.
Which two methods of forwarding, between virtual routers, would you recommend? (Choose two.)

A. Use a RIB group to share the internal routing protocol routes from the master routing instance.

B. Connect a direct cable between boo physical interfaces, one in each virtual router and use static routes with thenext-hopcommand.

C. Use a static route to forward traffic across virtual routers using the next-table option. Enable the return route by using a RIB group.

D. Create static routes in each virtual router using thenext-tablecommand.

Discussion 0

Correct Answer: D Vote an answer

Question 3

Click the Exhibit button. -- Exhibit-

-- Exhibit -
In the network shown in the exhibit, you want to forward traffic from the employees to ISP1 and ISP2. You want to forward all Web traffic to ISP1 and all other traffic to ISP2. However, your configuration is not producing the expected results. Part of the configuration is shown in the exhibit. When you run the show route table isp1 command, you do not see the default route listed.
What is causing this behavior?

A. The show route table isp1 command does not display the default route unless you add the exact 0.0.0.0/0 option.

B. The isp1 routing instance is configured with an incorrect instance-type.

C. The device is not able to resolve the next-hop.

D. The autonomous system number is incorrect, which is preventing the device from receiving a default route from ISP1.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 4

Click the Exhibit button. -- Exhibit-

-- Exhibit -
Referring to the exhibit, which feature allows the hosts in the Trust and DMZ zones to route to either ISP, based on source address?

A. static NAT

B. filter-based forwarding

C. source NAT

D. source-based routing

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 5

Which QoS function is supported in transparent mode?

A. DSCP

B. IP precedence

C. 802.1p

D. MPLS EXP

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 6

Click the Exhibit button. -- Exhibit-

-- Exhibit -
You receive complaints from users that their Web browsing sessions keep dropping prematurely. Upon investigation, you find that the IDP policy shown in the exhibit is detecting the users' sessions as HTTP:WIN-CMD:WIN-CMD-EXE attacks, even though their sessions are not actual attacks. You must allow these sessions but still inspect for all other relevant attacks.
How would you configure your SRX device to meet this goal?

A. Modify the security policy to add an application exception.

B. Modify the IDP policy to delete this particular attack from the IDP rulebase.

C. Create a new security policy that allows HTTP for all users and does not apply IDP.

D. Modify the IDP policy to add an exempt rulebase rule to not inspect for this attack.

Discussion 0

Correct Answer: D Vote an answer

Question 7

Click the Exhibit button. -- Exhibit-

-- Exhibit -You have been asked to block YouTube video streaming for internal users. You have implemented the configuration shown in the exhibit, however users are still able to stream videos.
What must be modified to correct the problem?

A. You must create a custom application to block YouTube streaming.

B. The application firewall rule needs to be applied to an IDP policy.

C. You must apply the dynamic application to the security policy

D. The application firewall rule needs to be applied to the security policy.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 8

You are asked to design a solution to verify IPsec peer reachability with data path forwarding.
Which feature would meet the design requirements?

A. DPD over Phase 2 SA

B. VPN monitoring over Phase 1 SA

C. DPD over Phase 1 SA

D. VPN monitoring over Phase 2 SA

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 9

What is a benefit of using a dynamic VPN?

A. It provides a way to grant VPN access on a per-user-group basis.

B. It eliminates the need for point-to-point VPN tunnels.

C. It provides a layer of redundancy on top of a point-to-point VPN mesh architecture.

D. It simplifies IPsec access for remote clients.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 10

At which two times does the IPS rulebase inspect traffic on an SRX device? (Choose two.)

A. When traffic first matches an IDP rule with the terminal parameter.

B. When traffic matches the active IDP policy.

C. When traffic uses the application layer gateway.

D. When traffic is established in the firewall session table.

Discussion 0

Correct Answer: A,B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 11

Click the Exhibit button.
-- Exhibit -user@srx> show security flow session Session ID.7724, Policy namE.default-permit/4, Timeout: 2 In: 1.1.70.6/17 --> 100.0.0.1/2326;icmp, IF.ge-0/0/3 Out: 10.1.10.5/2326 --> 1.1.70.6/17;icmp, IF.ge-0/0/2 Session ID.18408, Policy namE.default-permit/4, Timeout: 2 In: 10.1.10.5/64513 --> 1.1.70.6/512;icmp, IF.ge-0/0/2.0 Out: 1.1.70.6/512 --> 100.0.0.1/64513;icmp, IF.ge-0/0/3.10 -- Exhibit -
A user has reported a traffic drop issue between a host with the 10.1.10.5 internal IP address and a host with the 1.1.70.6 IP address. The traffic transits an SRX240 acting as a NAT translator. You are investigating the issue on the SRX240 using the output shown in the exhibit.
Regarding this scenario, which two statements are true? (Choose two.)

A. ICMP traffic is passing in both directions.

B. ICMP traffic is passing in one direction.

C. The sessions shown indicate static NAT processing.

D. The sessions shown indicate interface-based NAT processing.

Discussion 0

Correct Answer: A,C Vote an answer

Question 12

Which statement is true about NAT?

A. When you implement destination NAT, the router skips source NAT rules for the initiating traffic flow.

B. When you implement static NAT, each packet must go through a route lookup.

C. When you implement static NAT, the router skips destination NAT rules for the initiating traffic flow.

D. When you implement destination NAT, the router does not apply ALG services.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 13

Which AppSecure module provides Quality of Service?

A. AppQoS

B. AppID

C. AppTrack

D. AppFW

Discussion 0

Correct Answer: A Vote an answer

Question 14

What are three advantages of group VPNs? (Choose three.)

A. Supports translating private to public IP addresses.

B. Eliminates the need for full mesh VPNs.

C. Preserves original IP source and destination addresses.

D. Supports any-to-any member connectivity.

E. Provides redundancy with cooperative key servers.

Discussion 0

Correct Answer: B,C,D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 15

You configured a custom signature attack object to match specific components of an
attack:
HTTP-request
Pattern .*\x90 90 90 ... 90
Direction: client-to-server
Which client traffic would be identified as an attack?

A. HTTP POST .*\x90 90 90 ... 90

B. HTTP GET .*\x90 90 90 ... 90

C. HTTP GET .*x909090 ... 90

D. HTTP POST .*x909090 ... 90

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Juniper Security, Professional (JNCIP-SEC) - JN0-633 Exam Practice Test

Contact Us

Useful Links

Latest Updated