Juniper Juniper Certifications JN0-633 Questions & Answers

• Question 71:

  -- Exhibit -user@srx# show security datapath-debug

  capture-file pkt-cap-file format pcap size 5m;

  action-profile {

  pkt-cap-profile {

  event np-ingress {

  packet-dump;

  }

  } } packet-filter pkt-filter {

  action-profile pkt-capture;

  source-prefix 1.2.3.4/32; } -- Exhibit -

  You want to capture transit traffic passing through your SRX3600. You add the configuration shown in the

  exhibit but do not see entries added to the capture file.

  What is causing the problem?

  A. You are missing the configuration set security datapath-debug maximum-capture-size 1500.

  B. You are missing the configuration set security datapath-debug packet-filter pkt-filter destination-prefix 5.6.7.8/32.

  C. You must start the capture from operational mode with the command request security datapath-debug capture start.

  D. You must start the capture from operational mode with the command monitor start capture.

  Correct Answer: C

• Question 72:

  Click the Exhibit button.

  Referring to the exhibit, a pair of SRX3600s is in an active/passive chassis cluster configured for transparent mode. Which type of traffic would traverse the secondary SRX3600 (node 1)?

  Exhibit:

  

  A. all traffic including non-IP traffic

  B. any IP traffic

  C. only TCP and UDP traffic

  D. only BPDU traffic

  Correct Answer: D

• Question 73:

  Click the Exhibit button.

  You receive complaints from users that their Web browsing sessions keep dropping prematurely. Upon investigation, you find that the IDP policy shown in the exhibit is detecting the users' sessions as HTTP:WIN-CMD:WIN-CMD-EXE attacks, even though their sessions are not actual attacks. You must allow these sessions but still inspect for all other relevant attacks.

  How would you configure your SRX device to meet this goal?

  Exhibit:

  

  A. Create a new security policy that allows HTTP for all users and does not apply IDP.

  B. Modify the security policy to add an application exception.

  C. Modify the IDP policy to delete this particular attack from the IDP rulebase.

  D. Modify the IDP policy to add an exempt rulebase rule to not inspect for this attack.

  Correct Answer: D

• Question 74:

  Click the Exhibit button.

  In the exhibit, the SRX device has hosts connected to interface ge-0/0/1 and ge-0/0/6. The devices are not able to ping each other. What is causing this behavior?

  Exhibit:

  

  A. The interfaces must be in trunk mode.

  B. The interfaces need to be configured for Ethernet switching.

  C. The default security policy does not apply to transparent mode.

  D. A bridge domain has not been defined.

  Correct Answer: D

• Question 75:

  -- Exhibit -[edit security idp]

  user@srx# show | no-more

  idp-policy basic {

  rulebase-ips {

  rule 1 {

  match {

  from-zone untrust;

  source-address any;

  to-zone trust;

  destination-address any;

  application default;

  attacks {

  custom-attacks data-inject;

  }

  }

  then {

  action {

  recommended;

  }

  notification {

  log-attacks; } } } } }

  active-policy basic;

  custom-attack data-inject { recommended-action close; severity critical; attack-type {

  signature {

  context mssql-query;

  pattern "SELECT * FROM accounts";

  direction client-to-server;

  }

  } } -- Exhibit -

  You have configured the custom attack signature shown in the exhibit. This configuration is valid, but you

  want to improve the efficiency and performance of your IDP.

  Which two commands should you use? (Choose two.)

  A. set custom attack data-inject recommended-action drop

  B. set custom-attack data-inject attack-type signature protocol-binding tcp

  C. set idp-policy basic rulebase-ips rule 1 match destination-address webserver

  D. set idp-policy basic rulebase-ips rule 1 match application any

  Correct Answer: BC

• Question 76:

  -- Exhibit -[edit security idp] user@srx# show security-package {

  url https://services.netscreen.com/cgi-bin/index.cgi;

  automatic {

  start-time "2012-12-11.01:00:00 +0000";

  interval 120;

  enable;

  } } -- Exhibit -

  You have configured your SRX device to download and install attack signature updates as shown in the exhibit. You discover that updates are not being downloaded. What are two reasons for this behavior? (Choose two.)

  A. No security policy is configured to allow the SRX device to contact the update server.

  B. The SRX device does not have a DNS server configured.

  C. The management zone interface does not have an IP address configured.

  D. The SRX device has no Internet connectivity.

  Correct Answer: BD

• Question 77:

  -- Exhibit -[edit security] user@srx# show idp {

  idp-policy NewPolicy {

  rulebase-exempt {

  rule 1 {

  description AllowExternalRule;

  match {

  source-address any;

  destination-address

  }

  }

  }

  } } -- Exhibit -

  You are performing the initial IDP installation on your new SRX device. You have configured the IDP

  exempt rulebase as shown in the exhibit, but the commit is not successful.

  Referring to the exhibit, what solves the issue?

  A. You must configure the destination zone match.

  B. You must configure the IPS exempt accept action.

  C. You must configure the IPS rulebase.

  D. You must configure the IPS engine flow action to ignore.

  Correct Answer: C

• Question 78:

  Click the Exhibit button.

  You have configured an IDP policy as shown in the exhibit. The configuration commits successfully. Which traffic will be examined for attacks?

  Exhibit:

  

  A. only originating traffic from source to destination in a session

  B. only reply traffic from destination to source in a session

  C. both originating and reply traffic between hosts in a session

  D. recommended traffic between the source and destination hosts

  Correct Answer: C

• Question 79:

  Click the Exhibit button.

  An attacker is using a nonstandard port for HTTP for reconnaissance into your network. Referring to the exhibit, which two statements are true? (Choose two.)

  Exhibit:

  

  A. The IPS engine will not detect the application due to the nonstandard port.

  B. The IPS engine will detect the application regardless of the nonstandard port.

  C. The IPS engine will perform application identification until the session is established.

  D. The IPS engine will perform application identification until it processes the first 256 bytes of the packet.

  Correct Answer: BD

• Question 80:

  Click the Exhibit button.

  According to the log shown in the exhibit, you notice that the IPsec session is not establishing. What are two reasons for this behavior? (Choose two.)

  Exhibit:

  

  A. mismatched preshared key

  B. mismatched proxy ID

  C. incorrect peer address

  D. mismatched peer ID

  Correct Answer: CD