Juniper Juniper Certifications JN0-633 Questions & Answers

• Question 91:

  Click the Exhibit button.

  TCP traffic sourced from Host A destined for Host B is being redirected using filter-based forwarding to use the Red network. However, return traffic from Host B destined for Host A is using the Blue network and getting dropped by the SRX device.

  Which action will resolve the issue?

  Exhibit:

  

  A. Enable asyncronous-routing under the Blue zone.

  B. Configure ge-0/0/1 to belong to the Red zone.

  C. Disable RPF checking.

  D. Disable TCP sequence checking.

  Correct Answer: B

• Question 92:

  -- Exhibit -

  user@srx240< show route summary

  Router ID.

  inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)

  Direct: 1 routes, 1 active

  Local: 1 routes, 1 active

  StatiC. 1 routes, 1 active

  customer-A.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)

  Direct: 1 routes, 1 active

  Local: 1 routes, 1 active

  StatiC. 1 routes, 1 active

  customer-B.inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden) Direct: 1 routes, 1 active Local: 1 routes, 1 active OSPF. 1 routes, 1 active StatiC. 1 routes, 1 active customer-B.inet6.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)

  Direct:

  2 routes,

  2 active

  Local:

  2 routes,

  2 active

  StatiC.

  1 routes,

  1 active

  -- Exhibit -

  In the output, how many user-configured routing instances have active routes?

  A. 1

  B. 2

  C. 3

  D. 4

  Correct Answer: B

• Question 93:

  Click the Exhibit button.

  Referring to the exhibit, the application firewall configuration fails to commit. What must you do to allow the configuration to commit?

  Exhibit:

  

  A. Each firewall rule set must only have one rule.

  B. A firewall rule set cannot mix dynamic applications and dynamic application groups.

  C. The action in the rules must be different than the action in the default rule.

  D. The action in the default rule must be set to deny.

  Correct Answer: C

• Question 94:

  Click the Exhibit button.

  Referring to the exhibit, the session close log was generated by the application firewall rule set HTTP.

  Why did the session close?

  Exhibit:

  

  A. The application identification engine was unable to determine which application was in use, which caused the SRX device to close the session.

  B. The host with the IP address of 192.168.1.123 received a TCP segment with the FIN flag set from the host with the IP address of 65.197.244.218.

  C. The SRX device was unable to determine the user and role in the allotted time, which caused the session to close.

  D. The host with the IP address of 192.168.1.123 sent a TCP segment with the FIN flag set to the host with the IP address of 65.197.244.218.

  Correct Answer: D

• Question 95:

  Click the Exhibit button.

  You have been asked to block YouTube video streaming for internal users. You have implemented the

  configuration shown in the exhibit, however users are still able to stream videos.

  What must be modified to correct the problem?

  Exhibit:

  

  A. The application firewall rule needs to be applied to an IDP policy.

  B. You must create a custom application to block YouTube streaming.

  C. The application firewall rule needs to be applied to the security policy.

  D. You must apply the dynamic application to the security policy

  Correct Answer: C

• Question 96:

  Click the Exhibit button.

  Referring to the exhibit, AppTrack is only logging the session closure messages for sessions that last 1 to 3 minutes.

  What is causing this behavior?

  Exhibit:

  

  A. AppTrack is not properly configured under the [edit security application-tracking] hierarchy.

  B. AppTrack only generates session update messages.

  C. AppTrack only generates session closure messages.

  D. AppTrack generates other messages only when the update interval is surpassed.

  Correct Answer: D

• Question 97:

  -- Exhibit -[edit security] user@srx# show idp … application-ddos Webserver {

  service http;

  connection-rate-threshold 1000;

  context http-get-url {

  hit-rate-threshold 60000;

  value-hit-rate-threshold 30000;

  time-binding-count 10;

  time-binding-period 25;

  } } -- Exhibit -

  You are using AppDoS to protect your network against a bot attack, but noticed an approved application has falsely triggered the configured IDP action of drop. You adjusted your AppDoS configuration as shown in the exhibit. However, the approved traffic is still dropped.

  What are two reasons for this behavior? (Choose two.)

  A. The approved traffic results in 50,000 HTTP GET requests per minute.

  B. The approved traffic results in 25 HTTP GET requests within 10 seconds from a single host.

  C. The active IDP policy has not been defined in the security configuration.

  D. The IDP action is still in effect due to the timeout configuration.

  Correct Answer: AD

• Question 98:

  Somebody has inadvertently configured several security policies with application firewall rule sets on an SRX device. These security policies are now dropping traffic that should be allowed. You must find and remove the application firewall rule sets that are associated with these policies. Which two commands allow you to view these associations? (Choose two.)

  A. show security policies

  B. show services application-identification application-system-cache

  C. show security application-firewall rule-set all

  D. show security policies application-firewall

  Correct Answer: AD

• Question 99:

  You are troubleshooting an SRX240 acting as a NAT translator for transit traffic. Traffic is dropping at the SRX240 in your network. Which three tools would you use to troubleshoot the issue? (Choose three.)

  A. security flow traceoptions

  B. monitor interface traffic

  C. show security flow session

  D. monitor traffic interface

  E. debug flow basic

  Correct Answer: ABC

• Question 100:

  HostA (1.1.1.1) is sending TCP traffic to HostB (2.2.2.2). You need to capture the TCP packets locally on the SRX240. Which configuration would you use to enable this capture?

  A. [edit security flow] user@srx# show traceoptions {

  file dump;

  flag basic-datapath;

  }

  B. [edit security] user@srx# show application-tracking {

  enable;

  }

  flow {

  traceoptions {

  file dump;

  flag basic-datapath;

  }

  }

  C. [edit firewall filter capture term one] user@srx# show from {

  source-address {

  1.1.1.1;

  }

  destination-address {

  2.2.2.2;

  }

  protocol tcp;

  }

  then {

  port-mirror;

  accept;

  }

  D. [edit firewall filter capture term one] user@srx# show from {

  source-address {

  1.1.1.1;

  }

  destination-address {

  2.2.2.2;

  }

  protocol tcp;

  }

  then {

  sample;

  accept;

  }

  Correct Answer: D