Real JN0-635 Exam Questions Juniper JNCIP-SEC Study Guide

Regina2021-08-11T06:34:54+00:00

Security, Professional (JNCIP-SEC) is the professional level of Security certification, which designed for networking professionals with advanced knowledge of the Juniper Networks Junos OS for SRX Series devices. This certification requires to take and pass a written exam, JN0-635 Security, Professional to verify your understanding of advanced security technologies and related platform configuration and troubleshooting skills. If you are the one of JN0-635 exam candidates, please choose the real Juniper JN0-635 exam questions to be well-prepared. Online study guide containing real exam questions and answers ensure that you can pass Juniper JNCIP-SEC JN0-635 exam successfully.

Read Security, Professional (JNCIP-SEC) JN0-635 Free Questions Online First

Page 1 of 2

1. Which two VPN features are supported with CoS-based IPsec VPNs? (Choose two.)

IKEv2

VPN monitoring

dead peer detection

IKEv1

2. According to the log shown in the exhibit, you notice the IPsec session is not establishing.

What is the reason for this behavior?

Mismatched proxy ID

Mismatched peer ID

Mismatched preshared key

Incorrect peer address.

3. Exhibit.

Referring to the exhibit, a spoke member of an ADVPN is not functioning correctly.

Which two commands will solve this problem? (Choose two.)

[edit interfaces] user@srx# delete st0.0 multipoint

[edit security ike gateway advpn-gateway] user@srx# delete advpn partner

[edit security ike gateway advpn-gateway] user@srx# set version v1-only

[edit security ike gateway advpn-gateway] user@srx# set advpn suggester disable

4. In which two ways are tenant systems different from logical systems? (Choose two.)

Tenant systems have higher scalability than logical systems

Tenant systems have less scalability than logical systems

Tenant systems have fewer routing features than logical systems

Tenant systems have more routing features than logical systems

5. You must troubleshoot ongoing problems with IPsec tunnels and security policy processing. Your network consists of SRX340s and SRX5600s.

In this scenario, which two statements are true? (Choose two.)

IPsec logs are written to the kmd log file by default

IKE logs are written to the messages log file by default

You must enable data plane logging on the SRX340 devices to generate security policy logs

You must enable data plane logging on the SRX5600 devices to generate security policy logs

6. Exhibit.

Referring to the exhibit, which two statements are true? (Choose two.)

Juniper Networks will not investigate false positives generated by this custom feed.

The custom infected hosts feed will not overwrite the Sky ATP infected host’s feed.

The custom infected hosts feed will overwrite the Sky ATP infected host’s feed.

Juniper Networks will investigate false positives generated by this custom feed.

7. Click the Exhibit button.

A user is trying to reach a company’s website, but the connection errors out. The security policies are configured correctly.

Referring to the exhibit, what is the problem?

Persistent NAT must be enabled

The action for rule 1 must change to static-nat inet

DNS ALG must be disabled

Static NAT is missing a rule for DNS server

8. You are asked to configure an IPsec VPN between two SRX Series devices that allows for processing of CoS on the intermediate routers.

What will satisfy this requirement?

route-based VPN

OpenVPN

remote access VPN

policy-based VPN

9. You have designed the firewall filter shown in the exhibit to limit SSH control traffic to yours SRX Series device without affecting other traffic.

Which two statement are true in this scenario? (Choose two.)

The filter should be applied as an output filter on the loopback interface.

Applying the filter will achieve the desired result.

Applying the filter will not achieve the desired result.

The filter should be applied as an input filter on the loopback interface.

10. You are asked to configure a new SRX Series CPE device at a remote office. The device must participate in forwarding MPLS and IPsec traffic.

Which two statements are true regarding this implementation? (Choose two.)

Host inbound traffic must not be processed by the flow module

Host inbound traffic must be processed by the flow module

The SRX Series device can process both MPLS and IPsec with default traffic handling

A firewall filter must be configured to enable packet mode forwarding

Page 2 of 2

11. You have noticed a high number of TCP-based attacks directed toward your primary edge device. You are asked to configure the IDP feature on your SRX Series device to block this attack.

Which two IDP attack objects would you configure to solve this problem? (Choose two.)

Network

Signature

Protocol anomaly

host

12. Click the Exhibit button.

You have configured tenant systems on your SRX Series device.

Referring to the exhibit, which two actions should you take to facilitate inter-TSYS communication? (Choose two.)

Place the logical tunnel interfaces in a virtual router routing instance in the interconnect switch

Place the logical tunnel interfaces in a VPLS routing instance in the interconnect switch

Connect each TSYS with the interconnect switch by configuring INET configured logical tunnel interfaces in the interconnect switch

Connect each TSYS with the interconnect switch by configuring Ethernet VPLS configured logical tunnel interfaces in the interconnect switch

13. Click the Exhibit button.

Referring to the exhibit, which three types of traffic would be examined by the IPS policy between Switch-1 and Switch-2? (Choose three.)

TCP

LLDP

ARP

ICMP

UDP

14. Click the Exhibit button.

Referring to the exhibit, which two statements are true? (Choose two.)

The SRX Series device is enrolled and communicating with a JATP Appliance

The JATP Appliance cannot download the security feeds from the GSS servers

The SRX Series device cannot download the security feeds from the JATP Appliance

The SRX Series device is not enrolled but can communicate with the JATP Appliance

15. You have configured three logical tunnel interfaces in a tenant system on an SRX1500 device. When committing the configuration, the commit fails.

In this scenario, what would cause this problem?

There is no GRE tunnel between the tenant system and master system allowing SSH traffic

There is no VPLS switch on the tenant system containing a peer It-0/0/0 interface

The SRX1500 device does not support more than two logical interfaces per tenant system

The SRX1500 device requires a tunnel PIC to allow for logical tunnel interfaces

16. Click the Exhibit button.

Referring to the exhibit, which two statements are true? (Choose two.)

You can secure intra-VLAN traffic with a security policy on this device

You can secure inter-VLAN traffic with a security policy on this device

The device can pass Layer 2 and Layer 3 traffic at the same time

The device cannot pass Layer 2 and Layer 3 traffic at the same time

17. You are asked to configure an SRX Series device to bypass all security features for IP traffic from the engineering department.

Which firewall filter will accomplish this task?

A)

Option A

Option B

Option C

Option D

18. Click the Exhibit button.

Given the command output shown in the exhibit, which two statements are true? (Choose two.)

The host 172.31.15.1 is directly connected to interface ge-0/0/3.0

Traffic matching this session has been received since the session was established

The host 10.10.101.10 is directly connected to interface ge-0/0/4.0

Network Address Translation is applied to this session

19. A user is unable to reach a necessary resource. You discover the path through the SRX Series device includes several security features. The traffic is not being evaluated by any security policies.

In this scenario, which two components within the flow module would affect the traffic? (Choose two.)

services/ALG

destination NAT

source NAT

route lookup

20. Click the Exhibit button.

Referring to the exhibit, which two statements are true? (Choose two.)

Data is transmitted across the link in plaintext

The link is not protected against man-in-the-middle attacks

The link is protected against man-in-the-middle attacks

Data is transmitted across the link in cyphertext

Welcome To Choose Required IT Certification Exams Online

Real JN0-635 Exam Questions Juniper JNCIP-SEC Study Guide

Read Security, Professional (JNCIP-SEC) JN0-635 Free Questions Online First

Author