Security, Professional JN0-635 Questions and Answers

dumps2021-12-28T06:40:35+08:00

JN0-635 exam is a related test for Juniper JNCIP-SEC certification. There are 65 multiple-choice questions in real Juniper certification JN0-635 exam, and you have 120 minutes to complete all the questions. The available language is English. Pass/fail result is available immediately after taking the test. You can register Juniper JN0-635 exam at Pearson VUE testing center. Free Security, Professional JN0-635 questions and answers are available below.

Page 1 of 3

1. Click the Exhibit button.

Referring to the exhibit, which IPS deployment mode is running on the SRX5800 device?

sniffer mode

integrated mode

monitor mode

in-line tap mode

2. Which Junos security feature is used for signature-based attack prevention?

RADIUS

AppQoS

IPS

PIM

3. Click the Exhibit button.

Given the command output shown in the exhibit, which two statements are true? (Choose two.)

The host 172.31.15.1 is directly connected to interface ge-0/0/3.0

Traffic matching this session has been received since the session was established

The host 10.10.101.10 is directly connected to interface ge-0/0/4.0

Network Address Translation is applied to this session

4. Which two modes are supported on Juniper Sky ATP? (Choose two.)

private mode

global mode

tap mode

secure wire mode

5. Click the Exhibit button.

You deployed a site-to-site IPsec VPN connecting two data centers together using SRX5800s. After examining the performance of the IPsec VPN, you decide to enable IPsec performance acceleration to increase the rate of traffic that can be sent through the tunnel.

Referring to the exhibit, which two statements should you add to the configuration to accomplish this task? (Choose two.)

[edit security flow] user@srx# set tcp-mss ipsec-vpn mss 65535

[edit security flow] user@srx# set ipsec-performance-acceleration

[edit security flow] user@srx# set power-mode-ipsec

[edit security flow] user@srx# set load-distribution session-affinity ipsec

6. Click the Exhibit button.

You have configured tenant systems on your SRX Series device.

Referring to the exhibit, which two actions should you take to facilitate inter-TSYS communication? (Choose two.)

Place the logical tunnel interfaces in a virtual router routing instance in the interconnect switch

Place the logical tunnel interfaces in a VPLS routing instance in the interconnect switch

Connect each TSYS with the interconnect switch by configuring INET configured logical tunnel interfaces in the interconnect switch

Connect each TSYS with the interconnect switch by configuring Ethernet VPLS configured logical tunnel interfaces in the interconnect switch

7. Click the Exhibit button.

Referring to the exhibit, which two statements are true? (Choose two.)

The SRX Series device is enrolled and communicating with a JATP Appliance

The JATP Appliance cannot download the security feeds from the GSS servers

The SRX Series device cannot download the security feeds from the JATP Appliance

The SRX Series device is not enrolled but can communicate with the JATP Appliance

8. Which two log format types are supported by the JATP appliance? (Choose two.)

YAML

XML

CSV

YANG

9. You have set up Security Director with Policy Enforcer and have configured 12 third-party feeds and a Sky ATP feed. You are also injecting 16 feeds using the available open API. You want to add another compatible feed using the available open API, but Policy Enforcer is not receiving the new feed.

What is the problem in this scenario?

You must wait 48 hours for the feed to update

You cannot add more than 16 feeds through the available open API

You have reached the maximum limit of 29 total feeds

You cannot add more than 16 feeds with the available open API

10. Click the Exhibit button.

Which type of NAT is shown in the exhibit?

NAT46

NAT64

persistent NAT

DS-Lite

Page 2 of 3

11. Click the Exhibit button.

A user reports trouble when using SSH to a server outside your organization. The traffic traverses an SRX Series device that is performing NAT and applying security policies.

Referring to the exhibit, which configuration will allow you to see the bidirectional flow through the SRX Series device?

A)

Option A

Option B

Option C

Option D

12. Which two statements are true about ADVPN members? (Choose two.)

ADVPN members are authenticated using pre-shared keys

ADVPN members are authenticated using certificates

ADVPN members can use IKEv2

ADVPN members can use IKEv1

13. Click the Exhibit button.

The exhibit shows a snippet of a security flow trace. A user cannot open an SSH session to a server .

Which action will solve the problem?

Create a security policy that matches the traffic parameters

Edit the source NAT to correct the translated address

Create a route entry to direct traffic into the configured tunnel

Create a route to the desired server

14. You configured a security policy permitting traffic from the trust zone to the DMZ zone, inserted the new policy at the top of the list, and successfully committed it to the SRX Series device. Upon monitoring, you notice that the hit count does not increase on the newly configured policy.

In this scenario, which two commands would help you to identify the problem? (Choose two.)

user@srx> show security zones trust detail

user@srx> show security shadow-policies from zone trust to zone DMZ

user@srx> show security match-policies from-zone trust to-zone DMZ source-ip 192.168.10.100/32 destination-ip 10.10.10.80/32 protocol tcp source-port 5806 destination-port 443

user@srx> show security match-policies from-zone trust to-zone DMZ source-ip 192.168.10.100/32 destination-ip 10.10.10.80/32 protocol tcp source-port 5806 destination-port 443 result-count 10

15. You are not able to activate the SSH honeypot on the all-in-one Juniper ATP appliance.

What would be a cause of this problem?

The collector must have a minimum of two interfaces.

The collector must have a minimum of three interfaces.

The collector must have a minimum of five interfaces.

The collector must have a minimum of four interfaces.

16. Your SRX Series device does not see the SYN packet.

What is the default action in this scenario?

The device will forward the subsequent packets and the session will be established

The device will forward the subsequent packets and the session will not be established

The device will drop the subsequent packets and the session will not be established

The device will drop the subsequent packets and the session will be established

17. You are trying to get a SSH honeypot set up on a Juniper ATP Appliance collector. The collector is running on hardware with two physical interfaces and two physical CPU cores. The honeypot feature is not working.

Which statement is true in this scenario?

The collector must have at least three physical interfaces

The collector must have at least four physical cores

The collector must have at least four physical interfaces

The collector must have at least six physical cores

18. 1. Which two VPN features are supported with CoS-based IPsec VPNs? (Choose two.)

IKEv2

VPN monitoring

dead peer detection

IKEv1

19. Exhibit.

Referring to the exhibit, which two statements are true? (Choose two.)

Juniper Networks will not investigate false positives generated by this custom feed.

The custom infected hosts feed will not overwrite the Sky ATP infected host’s feed.

The custom infected hosts feed will overwrite the Sky ATP infected host’s feed.

Juniper Networks will investigate false positives generated by this custom feed.

20. You are asked to look at a configuration that is designed to take all traffic with a specific

source ip address and forward the

traffic to a traffic analysis server for further evaluation. The configuration is no longer working as intended.

Referring to the exhibit which change must be made to correct the configuration?

Apply the filter as in input filter on interface xe-0/2/1.0

Apply the filter as in input filter on interface xe-0/0/1.0

Create a routing instance named default

Apply the filter as in output filter on interface xe-0/1/0.0

Page 3 of 3

21. Malware that is detonated by the JATP sandbox must be able to communicate with the Internet without being able to harm your local network resources.

Which statement is correct in this scenario?

The management interface must be connected to the Internet zone

The exhaust interface must be connected to the Internet zone

The honeypot interface must be connected to the Internet zone

The monitoring interface must be connected to the Internet zone

22. What are two important functions of the Juniper Networks ATP Appliance solution? (Choose two.)

filtration

detection

statistics

analytics

23. You correctly configured a security policy to deny certain traffic, but logs reveal that traffic is still allowed.

Which specific traceoption flag will help you troubleshoot this problem?

lookup

configuration

routing-socket

rules

24. You are connecting two remote sites to your corporate headquarters site; you must ensure that all traffic is secured and only uses a single Phase 2 SA for both sites.

In this scenario, which VPN should be used?

An IPsec group VPN with the corporate firewall acting as the hub device.

Full mesh IPsec VPNs with tunnels between all sites.

A hub-and-spoke IPsec VPN with the corporate firewall acting as the hub device.

A full mesh Layer 3 VPN with the corporate firewall acting as the hub device.

25. Your organization has multiple Active Directory domain to control user access. You must ensure that security polices are passing traffic based upon the user’s access rights.

What would you use to assist your SRX series devices to accomplish this task?

JIMS

Junos Space

JSA

JATP Appliance

26. You opened a support ticket with JTAC for your Juniper ATP appliance. JTAC asks you to set up access to the device using the reverse SSH connection.

Which three setting must be configured to satisfy this request? (Choose three.)

Enable JTAC remote access

Create a temporary root account.

Enable a JATP support account.

Create a temporary admin account.

Enable remote support.

27. Which three type of peer devices are supported for Cos-Based IPsec VPN?

High-end SRX Series device

cSRX

vSRX

Branch-end SRX Series devics

Security, Professional JN0-635 Questions and Answers

Security, Professional JN0-635 Questions and Answers

Share this post

Leave a Reply Cancel reply

Related Posts