Juniper Juniper Certifications JN0-633 Questions & Answers

• Question 111:

  You configured a custom signature attack object to match specific components of an attack:

  HTTP-request Pattern .*\x90 90 90 ... 90 Direction: client-to-server

  Which client traffic would be identified as an attack?

  A. HTTP GET .*\x90 90 90 ... 90

  B. HTTP POST .*\x90 90 90 ... 90

  C. HTTP GET .*x909090 ... 90

  D. HTTP POST .*x909090 ... 90

  Correct Answer: A

• Question 112:

  An external host is attacking your network. The host sends an HTTP request to a Web server, but does not

  include the version of HTTP in the request.

  Which type of attack is being performed?

  A. signature-based attack

  B. application identification

  C. anomaly

  D. fingerprinting

  Correct Answer: C

• Question 113:

  You want to create a custom IDP signature for a new HTTP attack on your SRX device. You have the exact string that identifies the attack. Which two additional elements do you need to define your custom signature? (Choose two.)

  A. service context

  B. protocol number

  C. direction

  D. source IP address of the attacker

  Correct Answer: AC

• Question 114:

  You have installed a new IPS license on your SRX device and successfully downloaded the attack signature database. However, when you run the command to install the database, the database fails to install. What are two reasons for the failure? (Choose two.)

  A. The file system on the SRX device has insufficient free space to install the database.

  B. The downloaded signature database is corrupt.

  C. The previous version of the database must be uninstalled first.

  D. The SRX device does not have the high memory option installed.

  Correct Answer: AB

• Question 115:

  Which problem is introduced by setting the terminal parameter on an IPS rule?

  A. The SRX device will stop IDP processing for future sessions.

  B. The SRX device might detect more false positives.

  C. The SRX device will terminate the session in which the terminal rule detected the attack.

  D. The SRX device might miss attacks.

  Correct Answer: D

• Question 116:

  Which three match condition objects are required when creating IPS rules? (Choose three.)

  A. attack objects

  B. address objects

  C. terminal objects

  D. IP action objects

  E. zone objects

  Correct Answer: ABE

• Question 117:

  What are the three types of attack objects used in an IPS engine? (Choose three.)

  A. signature

  B. chargen

  C. compound

  D. component

  E. anomaly

  Correct Answer: ACE

• Question 118:

  At which two times does the IPS rulebase inspect traffic on an SRX device? (Choose two.)

  A. When traffic matches the active IDP policy.

  B. When traffic first matches an IDP rule with the terminal parameter.

  C. When traffic uses the application layer gateway.

  D. When traffic is established in the firewall session table.

  Correct Answer: AB

• Question 119:

  You have an existing group VPN established in your internal network using the group-id 1. You have been asked to configure a second group using the group-id 2. You must ensure that the key server for group 1 participates in group 2 but is not the key server for that group. Which statement is correct regarding the group configuration on the current key server for group 1?

  A. You must configure both groups at the [edit security ipsec vpn] hierarchy.

  B. You must configure both groups at the [edit security group-vpn member] hierarchy.

  C. You must configure both groups at the [edit security ike] hierarchy.

  D. You must configure both groups at the [edit security group-vpn] hierarchy.

  Correct Answer: D

• Question 120:

  You want to implement a hub-and-spoke VPN topology using a single logical interface on the hub. Which st0 interface configuration is correct for the hub device?

  A. [edit interfaces] user@srx# show st0 { multipoint

  unit 0 {

  family inet {

  address 10.10.10.1/24;

  }

  }

  }

  B. [edit interfaces] user@srx# show st0 {

  unit 0 {

  family inet {

  address 10.10.10.1/24;

  }

  }

  }

  C. [edit interfaces] user@srx# show st0 {

  unit 0 {

  point-to-point;

  family inet {

  address 10.10.10.1/24;

  }

  }

  }

  D. [edit interfaces] user@srx# show st0 {

  unit 0 {

  multipoint;

  family inet {

  address 10.10.10.1/24;

  }

  }

  }

  Correct Answer: D