Juniper Juniper Certifications JN0-633 Questions & Answers

• Question 31:

  Which two configuration statements are used to share interface routes between routing instances? (Choose two.)

  A. export-rib

  B. static rib-group

  C. interface-routes rib-group

  D. import-rib

  Correct Answer: CD

• Question 32:

  Where does the AppSecure suite of functions occur in the security flow process on an SRX Series device?

  A. services

  B. security policy

  C. NAT

  D. session initiation

  Correct Answer: A

• Question 33:

  Click the Exhibit button.

  [edit security nat static rule-set 12] user@SRX2# show from zone untrust; rule 1 {

  match {

  destination-address 192.168.1.1/32;

  }

  then {

  static-nat {

  prefix {

  10.60.60.1/32;

  }

  }

  }

  }

  Host-2 initiates communication with Host-1. All other routing and policies are in place to allow the traffic. What is the result of the communication?

  Exhibit:

  

  A. The 192.168.0.1 address is translated to the 10.60.60.1 address.

  B. The 10.60.60.1 address is translated to the 192.168.1.1 address.

  C. No translation occurs.

  D. The 192.168.0.1 address is translated to the 192.168.1.1 address.

  Correct Answer: B

• Question 34:

  Click the Exhibit button.

  user@host> show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 3271043 UP 7f42284089404673 95fd8408940438d8 Main 172.31.50.2

  user@host> show security ipsec security-associations Total active tunnels: 0

  user@host> show log phase2

  Feb 2 14:21:18 host kmd[1088]: IKE negotiation failed with error: TS unacceptable. IKE Version: 1, VPN:

  vpn-1 Gateway: gate-1, Local: 172.31.50.1/500, Remote: 172.31.50.2/500, Local IKE-ID: 172.31.50.1,

  Remote IKE-ID: 172.31.50.2, VR-ID: 0

  Feb 2 14:21:18 host kmd[1088]: KMD_VPN_TS_MISMATCH: Traffic-selector mismatch, vpn name: vpn-1,

  Peer Proposed traffic-selector local-ip: ipv4(2.2.2.2), Peer Proposed traffic-selector remote-ip: ipv4

  (1.1.1.1)

  Feb 2 14:21:54 host kmd[1088]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1,

  VPN: vpn-1 Gateway: gate-1, Local:

  172.31.50.1/500, Remote: 172.31.50.2/500, Local IKE-ID: 172.31.50.1, Remote IKE-ID: 172.31.50.2, VRID: 0

  Feb 2 14:22:19 host kmd[1088]: KMD_VPN_TS_MISMATCH: Traffic-selector mismatch, vpn name: vpn-1,

  Peer Proposed traffic-selector local-ip:

  ipv4 (2.2.

  2.2), Peer Proposed traffic-selector remote-ip: ipv4(1.1.1.1)

  You have recently configured an IPsec VPN between an SRX Series device and another non- Junos security device. The phase one tunnel is up but the phase two tunnel is not present.

  Referring to the exhibit, what is the cause of this problem?

  A. preshared key mismatch

  B. mode mismatch

  C. proposal mismatch

  D. proxy-ID mismatch

  Correct Answer: D

• Question 35:

  Click the Exhibit button.

  Traffic is flowing between the Host-1 and Host-2 devices through a hub-and-spoke IPsec VPN. All devices

  are SRX Series devices.

  Referring to the exhibit, which two statements are correct? (Choose two.)

  Exhibit:

  

  A. Traffic is encrypted on the Hub device.

  B. Traffic is encrypted on the Spoke-2 device.

  C. Traffic is not encrypted on the Spoke-2 device.

  D. Traffic is not encrypted on the Hub device.

  Correct Answer: D

• Question 36:

  What is a secure key management protocol used by IPsec?

  A. AH

  B. ESP

  C. TCP

  D. IKE

  Correct Answer: D

• Question 37:

  Your manager asks you to show which attacks have been detected on your SRX Series device using the IPS feature.

  Which command would you use to accomplish this task?

  A. show security idp attack detail

  B. show security idp attack table

  C. show security idp memory

  D. show security idp counters

  Correct Answer: B

• Question 38:

  A local user complains that they cannot connect to an FTP server on the DMZ network. You investigate and confirm that the security policy allows FTP traffic from the trust zone to the DMZ zone.

  What are two reasons for this problem? (Choose two.)

  A. The FTP server has no route back to the local network.

  B. No route is configured to the DMZ network.

  C. No security policy exists for traffic from the DMZ zone to the trust zone.

  D. The FTP ALG is disabled.

  Correct Answer: AD

• Question 39:

  user@host> show interfaces routing-instance all ge* terse Interface Admin Link Proto Local Instance ge-0/0/0.0 up up inet 172.16.12.205/24 default ge-0/0/1.0 up up inet 5.0.0.5/24

  iso A ge-0/0/2.0 up up inet 25.0.0.5/24 iso B

  user@host> show security flow session

  Session ID: 82274, Policy name: default-policy-00/2, Timeout: 1770, Valid In: 5.0.0.25/61935 --> 25.0.0.25/23;tcp, If: ge-0/0/1.0, Pkts: 31, Bytes: 1781 Out: 25.0.0.25/23 --> 5.0.0.25/61935;tcp, If: ge-0/0/2.0, Pkts: 23, Bytes: 1452

  Total sessions: 3

  user@host> show route

  inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden)

  + = Active Route, - = Last Active, + = Both

  0.0.0.0/0 *[Static/5] 04:08:52 > to 172.16.12.1 via ge-0/0/0.0 172.16.12.0/24 *[Direct/0] 04:08:52 via ge-0/0/0.0 172.16.12.205/32 *[Local/0] 4w4d 23:04:29 Loca1 via ge-0/0/0.0 224.0.0.5/32 *[OSPF/10] 14:37:35, metric 1 MultiRecv

  A.inet.0: 4 destinations, 4 routes {4 active, 0 holddown, 0 hidden)

  + = Active Route, - = Last Active, * = Both

  5.0.0.0/24 5 *[Direct/0] 00:05:04 > via ge-0/0/1.0 5.0.0.5/32 *[Local/0] 00:05:04 Local via ge-0/0/1.0 25.0.0.0/24 *[Direct/0] 00:02:37 > via ge-0/0/2.0

  B.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)

  + = Active Route, - = Last Active, * = Both

  5.0.0.25/32 *[Static/5] 00:02:38 to table A.inet.0 25.0.0.0/24 *[Direct/0] 00:02:37 > via ge-0/0/2.0 25.0.0.5/32 *[Local/0] 00:02:37 Local via ge-0/0/2.0

  A. The routing instances A and B are connected using an lt interface.

  B. Routing instance A's routes are shared with routing instance B.

  C. Routing instance B's routes are shared with routing instance A.

  D. The routing instances A and B are connected using a vt interface.

  Correct Answer: C

• Question 40:

  A branch SRX Series device in flow mode is forwarding between two virtual routers using a paired set of logical tunnel interfaces. You have a server connected to one virtual router and the client is on the other virtual router.

  How many security policies are needed to connect from the client to the server across the logical tunnel link?

  A. 0

  B. 2

  C. 3

  D. 1

  Correct Answer: D