Professional Documents
Culture Documents
1
1
Vendor: Juniper
Question 1 -- Question 50
QUESTION 1
Which configuration keyword ensures that all in-progress sessions are re-evaluated upon
committing a security policy change?
A. policy-rematch
B. policy-evaluate
C. rematch-policy
D. evaluate-policy
Answer: A
QUESTION 2
Click the Exhibit button. You need to alter the security policy shown in the exhibit to send matching
traffic to an IPsec VPN tunnel. Which command causes traffic to be sent through an IPsec VPN
named remote-vpn?
Answer: D
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
QUESTION 3
Which three security concerns can be addressed by a tunnel mode IPsec VPN secured by AH?
(Choose three.)
A. data integrity
B. data confidentiality
C. data authentication
D. outer IP header confidentiality
E. outer IP header authentication
Answer: ACE
QUESTION 4
You must configure a SCREEN option that would protect your router from a session table
flood.Which configuration meets this requirement?
Answer: D
QUESTION 5
Which type of Web filtering by default builds a cache of server actions associated with each URL it
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
has checked?
Answer: B
QUESTION 6
Which security or functional zone name has special significance to the Junos OS?
A. self
B. trust
C. untrust
D. junos-global
Answer: D
QUESTION 7
Which command do you use to display the status of an antivirus database update?
Answer: A
QUESTION 8
Which statement contains the correct parameters for a route-based IPsec VPN?
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
}
B. [edit security ipsec]
user@host# show
proposal ike1-proposal {
protocol esp;
authentication-algorithm hmac-md5-96;
encryption-algorithm 3des-cbc;
lifetime-seconds 3200;
}
policy ipsec1-policy {
perfect-forward-secrecy {
keys group2;
}
proposals ike1-proposal;
}
vpn VpnTunnel {
interface st0.0;
ike {
gateway ike1-gateway;
ipsec-policy ipsec1-policy;
}
establish-tunnels immediately;
}
C. [edit security ipsec]
user@host# show
proposal ike1-proposal {
protocol esp;
authentication-algorithm hmac-md5-96;
encryption-algorithm 3des-cbc;
lifetime-seconds 3200;
}
policy ipsec1-policy {
perfect-forward-secrecy {
keys group2;
}
proposals ike1-proposal;
}
vpn VpnTunnel {
bind-interface ge-0/0/1.0;
ike {
gateway ike1-gateway;
ipsec-policy ipsec1-policy;
}
establish-tunnels immediately;
}
D. [edit security ipsec]
user@host# show
proposal ike1-proposal {
protocol esp;
authentication-algorithm hmac-md5-96;
encryption-algorithm 3des-cbc;
lifetime-seconds 3200;
}policy ipsec1-policy {
perfect-forward-secrecy {
keys group2;
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
}
proposals ike1-proposal;
}
vpn VpnTunnel {
bind-interface st0.0;
ike {
gateway ike1-gateway;
ipsec-policy ipsec1-policy;
}
establish-tunnels immediately;
}
Answer: D
QUESTION 9
Which zone is system-defined?
A. security
B. functional
C. junos-global
D. management
Answer: C
QUESTION 10
You want to allow your device to establish OSPF adjacencies with a neighboring device connected
to interface ge-0/0/3.0. Interface ge-0/0/3.0 is a member of the HR zone. Under which configuration
hierarchy must you permit OSPF traffic?
Answer: D
QUESTION 11
Click the Exhibit button. Your IKE SAs are up, but the IPsec SAs are not up.Referring to the exhibit,
what is the problem?
A. One or more of the phase 2 proposals such as authentication algorithm, encryption algorithm do not match.
B. The tunnel interface is down.
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
C. The proxy IDs do not match.
D. The IKE proposals do not match the IPsec proposals.
Answer: C
QUESTION 12
Which three statements are true regarding IDP? (Choose three.)
A. IDP cannot be used in conjunction with other Junos security features such as SCREEN options,
zones, and security policy.
B. IDP inspects traffic up to the Application Layer.
C. IDP searches the data stream for specific attack patterns.
D. IDP inspects traffic up to the Presentation Layer.
E. IDP can drop packets, close sessions, prevent future sessions, and log attacks for review by
network administrators when an attack is detected.
Answer: BCE
QUESTION 13
Which two statements regarding symmetric key encryption are true? (Choose two.)
Answer: AD
QUESTION 14
Regarding content filtering, what are two pattern lists that can be configured in the Junos OS?
(Choose two.)
A. protocol list
B. MIME
C. block list
D. extension
Answer: BD
QUESTION 15
Which two statements are true about hierarchical architecture? (Choose two.)
Answer: BD
QUESTION 16
Which two statements regarding external authentication servers for firewall user authentication are
true? (Choose two.)
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
Answer: BD
QUESTION 17
Click the Exhibit button. In the exhibit, a new policy named DenyTelnet was created. You notice
that Telnet traffic is still allowed.
Which statement will allow you to rearrange the policies for the DenyTelnet policy to be evaluated
before your Allow policy?
A. insert security policies from-zone A to-zone B policy DenyTelnet before policy Allow
B. set security policies from-zone B to-zone A policy DenyTelnet before policy Allow
C. insert security policies from-zone A to-zone B policy DenyTelnet after policy Allow
D. set security policies from-zone B to-zone A policy Allow after policy DenyTelnet
Answer: A
QUESTION 18
Which UTM feature requires a license to function?
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
Answer: A
QUESTION 19
Click the Exhibit button. System services SSH, Telnet, FTP, and HTTP are enabled on the SRX
Series device.
Referring to the configuration shown in the exhibit, which two statements are true? (Choose two.)
Answer: BC
QUESTION 20
A user wants to establish an HTTP session to a server behind an SRX device but is being pointed
to Web page on the SRX device for additional authentication. Which type of user authentication is
configured?
Answer: A
QUESTION 21
Which two UTM features require a license to be activated? (Choose two.)
A. antispam
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
B. antivirus (full AV)
C. content filtering
D. Web-filtering redirect
Answer: AB
QUESTION 22
Which two statements in a source NAT configuration are true regarding addresses, rule-sets, or
rules that overlap? (Choose two.)
Answer: AB
QUESTION 23
A network administrator has configured source NAT, translating to an address that is on a locally
connected subnet. The administrator sees the translation working, but traffic does not appear to
come back. What is causing the problem?
Answer: C
QUESTION 24
Which statement describes an ALG?
A. An ALG intercepts and analyzes all traffic, allocates resources, and defines dynamic policies to
deny the traffic.
B. An ALG intercepts and analyzes the specified traffic, allocates resources, and defines dynamic
policies to permit the traffic to pass.
C. An ALG intercepts and analyzes the specified traffic, allocates resources, and defines dynamic
policies to deny the traffic.
D. An ALG intercepts and analyzes all traffic, allocates resources, and defines dynamic policies to
permit the traffic to pass.
Answer: B
QUESTION 25
Which three components can be leveraged when defining a local whitelist or blacklist for antispam
on a branch SRX Series device? (Choose three.)
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
Answer: CDE
QUESTION 26
What is the correct syntax for applying node-specific parameters to each node in a chassis cluster?
Answer: C
QUESTION 27
Which statement describes a security zone?
Answer: A
QUESTION 28
A system administrator detects thousands of open idle connections from the same source.Which
problem can arise from this type of attack?
Answer: C
QUESTION 29
Under which Junos hierarchy level are security policies configured?
A. [edit security]
B. [edit protocols]
C. [edit firewall]
D. [edit policy-options]
Answer: A
QUESTION 30
You must configure a SCREEN option that would protect your device from a session table flood.
Which configuration meets this requirement?
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
ip-sweep threshold 5000;
flood threshold 2000;
}
}
B. [edit security screen]
user@host# show
ids-option protectFromFlood {
tcp {
syn-flood {
attack-threshold 2000;
destination-threshold 2000;
}
}
}
C. [edit security screen]
user@host# show
ids-option protectFromFlood {
udp {
flood threshold 5000;
}
}
D. [edit security screen]
user@host# show
ids-option protectFromFlood {
limit-session {
source-ip-based 1200;
destination-ip-based 1200;
}
}
Answer: D
QUESTION 31
Which three methods of source NAT does the Junos OS support? (Choose three.)
Answer: ABC
QUESTION 32
Which three firewall user authentication objects can be referenced in a security policy? (Choose
three.)
A. access profile
B. client group
C. client
D. default profile
E. external
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
Answer: ABC
QUESTION 33
What is the default session timeout for TCP sessions?
A. 1 minute
B. 15 minutes
C. 30 minutes
D. 90 minutes
Answer: C
QUESTION 34
Which three advanced permit actions within security policies are valid? (Choose three.)
Answer: ACE
QUESTION 35
Which statement is true regarding the Junos OS for security platforms?
Answer: C
QUESTION 36
Click the Exhibit button. Which type of NAT is being used in the exhibit?
A. no NAT
B. destination NAT
C. source NAT
D. port address translation (PAT)
Answer: C
QUESTION 37
At which two levels of the Junos CLI hierarchy is the host-inbound-traffic command configured?
(Choose two.)
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
B. [edit security zones security-zone trust interfaces ge-0/0/0.0]
C. [edit security zones security-zone trust]
D. [edit security screen]
Answer: BC
QUESTION 38
Which two parameters are configured in IPsec policy? (Choose two.)
A. mode
B. IKE gateway
C. security proposal
D. Perfect Forward Secrecy
Answer: CD
QUESTION 39
The SRX device receives a packet and determines that it does not match an existing session.After
SCREEN options are evaluated, what is evaluated next?
A. source NAT
B. destination NAT
C. route lookup
D. zone lookup
Answer: B
QUESTION 40
Which zone type can be specified in a policy?
A. security
B. functional
C. user
D. system
Answer: A
QUESTION 41
Which two statements about Junos software packet handling are correct? (Choose two.)
A. The Junos OS applies service ALGs only for the first packet of a flow.
B. The Junos OS uses fast-path processing only for the first packet of a flow.
C. The Junos OS performs policy lookup only for the first packet of a flow.
D. The Junos OS applies SCREEN options for both first and consecutive packets of a flow.
Answer: CD
QUESTION 42
Which Web-filtering technology can be used at the same time as integrated Web filtering on a single
branch SRX Series device?
Answer: B
QUESTION 43
In a chassis cluster with two SRX 5800 devices, the interface ge-13/0/0 belongs to which device?
Answer: C
QUESTION 44
An IPsec tunnel is established on an SRX Series Gateway on an interface whose IP address was
obtained using DHCP. Which two statements are true? (Choose two.)
Answer: BC
QUESTION 45
Which two statements about the use of SCREEN options are correct? (Choose two.)
A. SCREEN options are deployed at the ingress and egress sides of a packet flow.
B. Although SCREEN options are very useful, their use can result in more session creation.
C. SCREEN options offer protection against various attacks at the ingress zone of a packet flow.
D. SCREEN options examine traffic prior to policy processing, thereby resulting in fewer resources
used for malicious packet processing.
Answer: CD
QUESTION 46
Click the Exhibit button. In the exhibit, you decided to change my Hosts addresses. What will
happen to the new sessions matching the policy and in-progress sessions that had already
matched the policy?
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
Answer: A
QUESTION 47
When using UTM features in an HA cluster, which statement is true for installing the licenses on
the cluster members?
A. One UTM cluster license will activate UTM features on both members.
B. Each device will need a UTM license generated for its serial number.
C. Each device will need a UTM license generated for the cluster, but licenses can be applied to
either member.
D. HA clustering automatically comes with UTM licensing, no additional actions are needed.
Answer: B
QUESTION 48
Which statement is true regarding NAT?
Answer: D
QUESTION 49
Which two functions of the Junos OS are handled by the data plane? (Choose two.)
A. NAT
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html
Free VCE and PDF Exam Dumps from PassLeader
B. OSPF
C. SNMP
D. SCREEN options
Answer: AD
QUESTION 50
After applying the policy-rematch statement under the security policies stanza, what would happen
to an existing flow if the policy source address or the destination address is changed and committed?
A. The Junos OS drops any flow that does not match the source address or destination address.
B. All traffic is dropped.
C. All existing sessions continue.
D. The Junos OS does a policy re-evaluation.
Answer: D
JN0-332 Exam Dumps JN0-332 Exam Questions JN0-332 PDF Dumps JN0-332 VCE Dumps
http://www.passleader.com/jn0-332.html