Juniper Juniper Certifications JN0-633 Questions & Answers

• Question 41:

  [edit] useu@host# run show log debug Feb 3 22:04:32 22:04:31.983991:CID-0:RT: ge-0/0/1.0:5.0.0.25/59028->25.0.0.25/23, tcp, flag 18

  Feb 3 22:04:32 22:04:31.983997:CID-0:RT: find flow: table 0x582738c0, hash

  53561(0xffff), sa 5.0.0.25, da 5.0.0.25, sp 59028, dp 23, proto 6, tok 20489 Feb 3 22:04:32 22:04:31.984004:CID-0:RT:Found: session id 0x14f98. sess tok 20489

  Feb 3 22:04:32 22:04:31.984005:CID-0:RT: flow got session.

  Feb 3 22:04:32 22:04:31.984006:CID-0:RT: flow session id 85912

  Feb 3 22:04:32 22:04:31.984009:CID-0:RT: vector bits 0x2 vector 0x53a949e8

  Feb 3 22:04:32 22:04:31.984012:CID-0:RT: tcp sec check.

  Feb 3 22:04:32 22:04:31.984015:CID-0:RT:mbuf 0x4a82cd80, exit nh 0xa0010

  Which two statements are true regarding the output shown in the exhibit? (Choose two.)

  A. The outgoing interface is ge-0/0/1.0.

  B. The packet is subject to fast-path packet processing.

  C. The packet is part of the first-packet path processing.

  D. TCP sequence checking is enabled.

  Correct Answer: CD

• Question 42:

  When configuring AutoVPN, which two actions are required for an administrator to establish communication from the hub site to the spoke sites? (Choose two.)

  A. Configure the next hop tunnel binding (NHTB).

  B. Configure static routes from the hub to the spoke.

  C. Configure a dynamic routing protocol such as BGP, OSPF, or RIP on the tunnel interfaces.

  D. Create a multipoint secure tunnel interface on the hub device.

  Correct Answer: CD

• Question 43:

  Which two statements about AppQoS are true? (Choose two.)

  A. AppQoS remarking supersedes interface remarking.

  B. AppQoS supports forwarding class assignment.

  C. AppQoS supports rate limiting.

  D. AppQoS supports bandwidth reservation.

  Correct Answer: BC

• Question 44:

  You are asked to allow access to an external application for an internal host subject to address translation. The application requires multiple sessions initiated from the internal host and expects all the sessions to originate from the same source IP address.

  Which Junos feature meets this objective?

  A. destination NAT with address persistence

  B. source NAT with address persistence

  C. static NAT with port translation

  D. interface-based persistent NAT

  Correct Answer: B

• Question 45:

  Click the Exhibit button.

  user@host> monitor traffic interface ge-0/0/3

  verbose output suppressed, use or for full protocol decode

  Address resolution is ON. Use to avoid any reverse lookup delay.

  Address resolution timeout is 4s.

  Listening on ge-0/0/3, capture size 96 bytes

  Reverse lookup for 172.168.3.254 failed (check DNS reachability). Other reverse lookup failures will not be

  reported.

  Use to avoid reverse lockups on IP addresses.

  19:24:16.320907 In arp who-has 172.168.3.254 tell 172.168.3.1

  19.24:17.322751 In arp who has 172.168.3.254 tell 172.168.3.1

  19.24:18.328895 In arp who-has 172.168.3.254 tell 172.168.3.1

  19.24:18.332956 In arn who has 172.168.3.254 tell 172.168.3.1

  A new server has been set up in your environment. The administrator suspects that the firewall is blocking

  the traffic from the new server. Previously existing servers in the VLAN are working correctly. After

  reviewing the logs, you do not see any traffic for the new server.

  Referring to the exhibit, what is the cause of the problem?

  Exhibit:

  

  A. The server is in the wrong VLAN.

  B. The server has been misconfigured with the wrong IP address.

  C. The firewall has been misconfigured with the incorrect routing-instance.

  D. The firewall has a filter enabled to block traffic from the server.

  Correct Answer: C

• Question 46:

  Which two statements are true about an interconnect logical system on an SRX Series device? (Choose two.)

  A. VXLAN is used to switch inter-LSYS-traffic.

  B. The root and user LSYSs connect to the interconnect LSYS using vt interfaces.

  C. VPLS is used to switch inter-LSYS traffic.

  D. The root and user LSYSs connect to the interconnect LSYS using lt interfaces.

  Correct Answer: CD

• Question 47:

  Click the Exhibit button.

  user@host> show services application-identification application-system—cache

  Application System Cache Configurations: Application-cache: off nested-application-cache: on cache-unknown-result: on cache-entry-timeout: 3600 seconds

  You are using the application identification feature on your SRX Series device. The help desk reports that users are complaining about slow Internet connectivity. You issue the command shown in the exhibit.

  What must you do to correct the problem?

  A. Modify the configuration with the delete services application-identification noapplication-system-cachecommand and commit the change.

  B. Modify the configuration with the delete services application-identification no-clear-application-system-cachecommand and commit the change.

  C. Reboot the SRX Series device.

  D. Modify the configuration with the delete services application-identification no-application identificationcommand and commit the change.

  Correct Answer: B

• Question 48:

  Click the Exhibit button. [edit] user@host# run show log debug

  Feb 3 22:04:31 22:04:31.824294:CID-0:RT:flow_first_policy_search: policy search from zone host->

  zone attacker (Ox0,0xe4089404,0x17)

  Feb 3 22:04:31 22:04:31.824297:CID-0:RT:Policy lkup: vsys 0 zone(9:host) -> zone(10:attacker) scope:

  0

  Feb 3 22:04:31 22:04:31.824770:CID-0:RT: 5.0.0.25/59028 -> 25.0.0.25/23 proto 6

  Feb 3 22:04:31 22:04:31.824778:CID-0:RT:Policy lkup: vsys 0 zone(5:Umkmowm) -> zone

  (5:Umkmowm) scope: 0

  Feb 3 22:04:31 22:04:31.824780:CID-0:RT: 5.0.0.25/59028 -> 25.0.0.25/23 proto 6

  Feb 3 22:04:31 22:04:31.824783:CID-0:RT: app 10, timeout 1800s, curr ageout 20s

  Feb 3 22:04:31 22:04:31.824785:CID-0:RT: permitted by policy default-policy-00(2)

  Feb 3 22:04:31 22:04:31.824787:CID-0:RT: packet passed, Permitted by

  policy.

  Feb 3 22:04:31 22:04:31.824790:CID-0:RT:flow_first_src_xlate:

  nat_src_xlated: False, nat_src_xlate_failed; False

  Feb 3 22:04:31 22:04:31.824834:CID-0:RT:flow_first_src_xlate: incoming src port is: 38118

  Which two statements are true regarding the output shown in the exhibit? (Choose two.)

  A. The packet does not match any user-configured security policies.

  B. The user has configured a security policy to allow the packet.

  C. The log is showing the first path packet flow.

  D. The log shows the reverse flow of the session.

  Correct Answer: C

• Question 49:

  Click the Exhibit button.

  user@host# run show security flow session ... Session ID: 28, Policy name: allow/5, Timeout: 2, Valid

  In: 172.168.1.2/24800 --> 66.168.100.100/8001; tcp, If: ge-0/0/3.0, Pkts: 1, Bytes: 64

  Out: 10.168.100.1/8001 --> 172.168.1.2/24800; tcp, If: ge-0/0/6.0, Pkts: 1, Bytes: 40

  Your customer is unable to reach your HTTP server that is connected to the ge-0/0/6 interface. The HTTP server has an address of 10.168.100.1 on port 80 internally, but is accessed publicly using interface ge0/0/3 with the address 66.168.100.100 on port 8001.

  Referring to the exhibit, what is causing this problem?

  A. The traffic is originated with incorrect IP address from the customer.

  B. The traffic is translated with the incorrect IP address for the HTTP server.

  C. The traffic is translated with the incorrect port number for the HTTP server.

  D. The traffic is originated with the incorrect port number from the customer.

  Correct Answer: C

• Question 50:

  You are asked to establish a hub-and-spoke IPsec VPN using your SRX Series device as the hub. All of your spoke devices are third-party devices.

  Which statement is correct?

  A. You must create a policy-based VPN on the hub device when peering with third-party devices.

  B. You must always peer using loopback addresses when using non-Junos devices as your spokes.

  C. You must statically configure the next-hop tunnel binding table entries for each of the third- party spoke devices.

  D. You must ensure that you are using aggressive mode when incorporating third-party devices as your spokes.

  Correct Answer: C