Juniper Juniper Certifications JN0-333 Questions & Answers

• Question 11:

  Click the Exhibit button.

  

  You have an IPsec tunnel between two devices. You clear the IKE security associations, but traffic continues to flow across the tunnel.

  Referring to the exhibit, which statement is correct in this scenario?

  A. The IPsec security association is independent from the IKE security association

  B. The traffic is no longer encrypted

  C. The IKE security association immediately reestablishes

  D. The traffic is using an alternate path

  Correct Answer: AB

• Question 12:

  What are two fields that an SRX Series device examines to determine if a packet is associated with an existing flow? (Choose two.)

  A. protocol

  B. source IP address

  C. source MAC address

  D. type of service

  Correct Answer: AB

• Question 13:

  In a chassis cluster, which two characteristics are true regarding reth interfaces? (Choose two.)

  A. A reth interface inherits its failover properties from a redundancy group.

  B. Reth interfaces must be the same type of interface.

  C. Reth interfaces must be in the same slots on each node.

  D. A reth interface goes down if one of its child interfaces become unavailable.

  Correct Answer: AB

• Question 14:

  Which statement is true about Perfect Forward Secrecy (PFS)?

  A. PFS is used to resolve compatibility issues with third-party IPsec peers.

  B. PFS is implemented during Phase 1 of IKE negotiations and decreases the amount of time required for IKE negotiations to complete.

  C. PFS increases security by forcing the peers to perform a second DH exchange during Phase 2.

  D. PFS increases the IPsec VPN encryption key length and uses RSA or DSA certificates.

  Correct Answer: C

• Question 15:

  Which type of VPN provides a secure method of transporting encrypted IP traffic?

  A. IPsec

  B. Layer 3 VPN

  C. VPLS

  D. Layer 2 VPN

  Correct Answer: A

• Question 16:

  Your internal webserver uses port 8088 for inbound connections. You want to allow external HTTP traffic to connect to the webserver.

  Which two actions would accomplish this task? (Choose two.)

  A. Create a custom application for port 8088 and create a security policy that permits the custom-http application.

  B. Remap port 80 to port 8088 in the junos-http application and create a security policy that permits the junos-http application.

  C. Use destination NAT to remap incoming traffic from port 80 to port 8088.

  D. Create an Application Layer Gateway to permit HTTP traffic on port 8088.

  Correct Answer: AC

• Question 17:

  Click the Exhibit button.

  

  You notice that your SRX Series device is not blocking HTTP traffic as expected. Referring to the exhibit, what should you do to solve the problem?

  A. Commit the configuration.

  B. Reboot the SRX Series device.

  C. Configure the SRX Series device to operate in packet-based mode.

  D. Move the deny-http policy to the bottom of the policy list.

  Correct Answer: B

• Question 18:

  Which action will restrict SSH access to an SRX Series device from a specific IP address which is connected to a security zone named trust?

  A. Implement a firewall filter on the security zone trust.

  B. Implement a security policy from security zone junos-host to security zone trust.

  C. Implement host-inbound-traffic system-services to allow SSH.

  D. Implement a security policy from security zone trust to security zone junos-host.

  Correct Answer: D

• Question 19:

  You are changing the default vCPU allocation on a vSRX. How are the additional vCPUs allocated in this scenario?

  A. The vCPU are allocated equally across the Junos control plane and packet forwarding engine.

  B. One dedicated vCPU is allocated for the Junos control plane and the remaining vCPUs for the packet forwarding engine.

  C. One dedicated vCPU is allocated for the packet forwarding engine, one for the Junos control plane, and the remaining vCPUs are equally balanced.

  D. One dedicated vCPU is allocated for the packet forwarding engine and the remaining vCPUs for the Junos plane.

  Correct Answer: B

• Question 20:

  You recently configured an IPsec VPN between two SRX Series devices. You notice that the Phase 1 negotiation succeeds and the Phase 2 negotiation fails.

  Which two configuration parameters should you verify are correct? (Choose two.)

  A. Verify that the IKE gateway proposals on the initiator and responder are the same.

  B. Verify that the VPN tunnel configuration references the correct IKE gateway.

  C. Verify that the IPsec policy references the correct IKE proposals.

  D. Verify that the IKE initiator is configured for main mode.

  Correct Answer: AC