Juniper Juniper Certifications JN0-633 Questions & Answers

• Question 1:

  An SRX Series device is configured for inline tap mode.

  What will occur if Drop Packet is selected?

  A. The SRX Series device drops a matching packet before it can reach its destination but does not close the connection.

  B. The SRX Series device will ignore the action Drop Packet.

  C. The SRX Series device closes the connection and sends an RST packet to both the client and the server.

  D. The SRX Series device drops a matching packet associated with the connection, preventing traffic for

  the connection from reaching its destination.

  Correct Answer: D

• Question 2:

  You have initiated the download of the IPS signature database on your SRX Series device.

  Which command would you use to confirm the download has completed?

  A. request security idp security-package install

  B. request security idp security-package download

  C. request security idp security-package install status

  D. request security idp security-package download status

  Correct Answer: D

• Question 3:

  Click the Exhibit button.

  user@key-server> show security group-vpn server ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 97 UP bb224408940cc5d 435b9404284083c2 Main 192.168.11.1 98 UP 242c840089404d15 ab19284089408ba8 Main 192.168.11.2

  user@key-server> show security group-vpn server ipsec security-associations Group: group-1, Group Id:

  1 Total IPsec SAs: 1 IPsec SA Algorithm SPI Lifetime group-l-sa ESP:3des/shal 1343991c 2736

  Group: group-2, Group id: 2 Total IPsec SAs: 1 IPsec SA Algorithm SPI Lifetime group-2-sa ESP:3des/shal 13be9e9 2741

  Group: group-3, Group Id: 3 Total IPsec SAs: 1 IPsec SA Algorithm SPI Lifetime group-3-sa ESP:3des/shal 20709057 2741

  Group: group-4, Group Id: 4 Total IPsec SAs: 1 IPsec SA Algorithm SPI Lifetime group-4-sa ESP:3des/shal 5111c2e1 2741

  Which statement is correct regarding the outputs shown in the exhibit?

  Which statement is correct regarding the outputs shown in the exhibit?

  A. Two established peers are in the group VPNs.

  B. One established peer is in the group VPNs.

  C. No established peer is in the group VPNs.

  D. Four established peers are in the group VPNs.

  Correct Answer: A

• Question 4:

  What are two configurable routing instance types? (Choose two.)

  A. IPsec

  B. VPLS

  C. GRE

  D. VRF

  Correct Answer: BD

• Question 5:

  You are asked to secure your company's Web presence. This includes using an SRX Series device to inspect SSL traffic going to the Web servers in your DMZ.

  Which two actions are required to accomplish this task? (Choose two.)

  A. Load your Web server's private key in the IDP configuration.

  B. Load your Web server's public key in the IDP configuration.

  C. Generate a root certificate on the SRX Series device for your Web servers.

  D. Specify the number of sessions in the SSL sensor configuration.

  Correct Answer: AD

• Question 6:

  In the IPS packet processing flow on an SRX Series device, when does application identification occur?

  A. before fragmentation processing

  B. after protocol decoding

  C. before SSL decryption

  D. after attack signature matching

  Correct Answer: A

• Question 7:

  Which configurable SRX Series device feature allows you to capture transit traffic?

  A. syslog

  B. traceoptions

  C. packet-capture

  D. archival

  Correct Answer: B

• Question 8:

  You are asked to ensure traffic from your executive staff does not use the same ISP connection as your other traffic.

  Which three actions are required to accomplish this task? (Choose three)

  A. Create a firewall filter to match this traffic and send this traffic to the routing instance.

  B. Create a routing instance and define the type as no-forwarding.

  C. Assign the outgoing interface to the no-forwardinginstance.

  D. Create a routing instance and define the type as forwarding.

  E. Create a RIB group to share routes between the main instance and the routing instance.

  Correct Answer: ADE

• Question 9:

  What are three techniques to mark DSCP values on an SRX Series device? (Choose three.)

  A. IDP attack action-based DSCP rewriters

  B. 802.11Q

  C. VLAN rewrite

  D. ALG-based DSCP rewriters

  E. Layer 7 application-based DSCP rewriters.

  Correct Answer: ADE

• Question 10:

  Click the Exhibit button.

  IPv6 to IPv4 addresses are not being translated as shown in the exhibit.

  Which two configurations would resolve the problem? (Choose two.)

  Exhibit:

  

  A. set security nat natv6v4 no-6-frag-header

  B. set security nat proxy-arp interface ge-0/0/0.0

  C. set security nat source port-randomization disable

  D. set security nat proxy-ndp interface ge-0/0/1.0

  Correct Answer: D