Juniper Juniper Certifications JN0-633 Questions & Answers

• Question 101:

  You are troubleshooting an IPsec session and see the following IPsec security associations: ID Gateway Port Algorithm SPI Life:sec/kb Mon vsys

  <

  192.168.224.1 500 ESP:aes-256/sha1 d6393645 26/ unlim - 0 > 192.168.224.1 500 ESP:aes-256/sha1 153ec235 26/ unlim - 0

  <

  192.168.224.1 500 ESP:aes-256/sha1 f9a2db9a 3011/ unlim - 0 > 192.168.224.1 500 ESP:aes-256/sha1 153ec236 3011/ unlim - 0

  What are two reasons for this behavior? (Choose two.)

  A. Both peers are trying to establish IKE Phase 1 but are not successful.

  B. Both peers have established SAs with one another, resulting in two IPsec tunnels.

  C. The lifetime of the Phase 2 negotiation is close to expiration.

  D. Both peers have establish-tunnels immediately configured.

  Correct Answer: CD

• Question 102:

  You are asked to troubleshoot ongoing problems with IPsec tunnels and security policy processing. Your network consists of SRX240s and SRX5600s. Regarding this scenario, which two statements are true? (Choose two.)

  A. You must enable data plane logging on the SRX240 devices to generate security policy logs.

  B. You must enable data plane logging on the SRX5600 devices to generate security policy logs.

  C. IKE logs are written to the kmd log file by default.

  D. IPsec logs are written to the kmd log file by default.

  Correct Answer: BD

• Question 103:

  A security administrator has configured an IPsec tunnel between two SRX devices. The devices are configured with OSPF on the st0 interface and an external interface destined to the IPsec endpoint. The adminstrator notes that the IPsec tunnel and OSPF adjacency keep going up and down. Which action would resolve this issue?

  A. Create a firewall filter on the st0 interface to permit IP protocol 89.

  B. Configure the IPsec tunnel to accept multicast traffic.

  C. Create a /32 static route to the IPsec endpoint through the external interface.

  D. Increase the OSPF metric of the external interface.

  Correct Answer: C

• Question 104:

  What is the default action for an SRX device in transparent mode to determine the outgoing interface for an unknown destination MAC address?

  A. Perform packet flooding.

  B. Send an ARP query.

  C. Send an ICMP packet with a TTL of 1.

  D. Perform a traceroute request.

  Correct Answer: A

• Question 105:

  Which QoS function is supported in transparent mode?

  A. 802.1p

  B. DSCP

  C. IP precedence

  D. MPLS EXP

  Correct Answer: A

• Question 106:

  You are asked to configure class of service (CoS) on an SRX device running in transparent mode. Which command would you use?

  A. set interfaces ge-0/0/0 unit 0 classifiers dscp priority-app

  B. set class-of-service interfaces ge-0/0/0 unit 0 classifiers dscp priority-app

  C. set class-of-service interfaces ge-0/0/0 unit 0 classifiers ieee-802.1 priority-app

  D. set interfaces ge-0/0/0 unit 0 classifiers inet-precedence priority-app

  Correct Answer: C

• Question 107:

  For an SRX chassis cluster in transparent mode, which action occurs to signal a high availability failover to neighboring switches?

  A. the SRX chassis cluster generates Spanning Tree messages

  B. the SRX chassis cluster generates gratuitous ARPs

  C. the SRX chassis cluster flaps the former active interfaces

  D. the SRX chassis cluster uses IP address monitoring

  Correct Answer: C

• Question 108:

  You want to configure in-band management of an SRX device in transparent mode. Which command is required to enable this functionality?

  A. set interfaces irb unit 1 family inet address

  B. set interfaces vlan unit 1 family inet address

  C. set interfaces ge-0/0/0 unit 0 family inet address

  D. set interfaces ge-0/0/0 unit 0 family bridge address

  Correct Answer: A

• Question 109:

  Which two configuration components are required for enabling transparent mode on an SRX device? (Choose two.)

  A. IRB

  B. bridge domain

  C. interface family bridge

  D. interface family ethernet-switching

  Correct Answer: BC

• Question 110:

  You are deploying a standalone SRX650 in transparent mode for evaluation purposes in a potential client's network. The client will need to access the device to modify security policies and perform other various configurations. Where would you configure a Layer 3 interface to meet this requirement?

  A. fxp0.0

  B. vlan.1

  C. irb.1

  D. ge-0/0/0.0

  Correct Answer: C