Juniper Juniper Certifications JN0-333 Questions & Answers

• Question 41:

  What are three valid virtual interface types for a vSRX? (Choose three.)

  A. SR-IOV

  B. fxp0

  C. eth0

  D. VMXNET 3

  E. virtio

  Correct Answer: ABD

• Question 42:

  Clients at a remote office are accessing a website that is against your company Internet policy. You change the action of the security policy that controls HTTP access from permit to deny on the remote office SRX Series device. After committing the policy change, you notice that new users cannot access the website but users that have existing sessions on the device still have access. You want to block all user sessions immediately.

  Which change would you make on the SRX Series device to accomplish this task?

  A. Add the set security flow tcp-session rst-invalidate-session option to the configuration and commit the change.

  B. Add the set security policies policy-rematch parameter to the configuration and commit the change.

  C. Add the security flow tcp-session strict-syn-check option to the configuration and commit the change.

  D. Issue the commit full command from the top of the configuration hierarchy.

  Correct Answer: B

• Question 43:

  What are two valid zones available on an SRX Series device? (Choose two.)

  A. security zones

  B. policy zones

  C. transit zones

  D. functional zones

  Correct Answer: AD

• Question 44:

  You want to ensure that any certificates used in your IPsec implementation do not expire while in use by your SRX Series devices.

  In this scenario, what must be enabled on your devices?

  A. RSA

  B. TLS

  C. SCEP

  D. CRL

  Correct Answer: C

• Question 45:

  What are the maximum number of redundancy groups that would be used on a chassis cluster?

  A. The maximum number of redundancy groups use is equal to the number of configured physical interfaces.

  B. The maximum number of redundancy groups use is equal to one more than the number of configured physical interfaces.

  C. The maximum number of redundancy groups use is equal to the number of configured logical interfaces.

  D. The maximum number of redundancy groups use is equal to one more than the number of configured logical interfaces.

  Correct Answer: C

• Question 46:

  Which statement is true about high availability (HA) chassis clusters for the SRX Series device?

  A. Cluster nodes require an upgrade to HA compliant Routing Engines.

  B. Cluster nodes must be connected through a Layer 2 switch.

  C. There can be active/passive or active/active clusters.

  D. HA clusters must use NAT to prevent overlapping subnets between the nodes.

  Correct Answer: C

• Question 47:

  You need to configure an IPsec tunnel between a remote site and a hub site. The SRX Series device at the remote site receives a dynamic IP address on the external interface that you will use for IPsec. Which feature would you need to configure in this scenario?

  A. NAT-T

  B. crypto suite B

  C. aggressive mode

  D. IKEv2

  Correct Answer: C

• Question 48:

  You want to trigger failover of redundancy group 1 currently running on node 0 and make node 1 the primary node the redundancy group 1.

  Which command would be used accomplish this task?

  A. user@host# set chassis cluster redundancy-group 1 node 1

  B. user@host> request chassis cluster failover redundancy-group 1 node 1

  C. user@host# set chassis cluster redundancy-group 1 preempt

  D. user@host> request chassis cluster failover reset redundancy-group 1

  Correct Answer: B

• Question 49:

  Click the Exhibit button.

  

  Users at a remote office are unable to access an FTP server located at the remote corporate data center as expected. The remote FTP server is listening on the non-standard TCP port 2121.

  Referring to the exhibit, what is causing the problem?

  A. The FTP clients must be configured to listen on non-standard client ports for the FTP data channel negotiations to succeed.

  B. Two custom FTP applications must be defined to allow bidirectional FTP communication through the SRX Series device.

  C. The custom FTP application definition does not have the FTP ALG enabled.

  D. A new security policy must be defined between the untrust and trust zones.

  Correct Answer: D

• Question 50:

  Which SRX5400 component is responsible for performing first pass security policy inspection?

  A. Routing Engine

  B. Switch Control Board

  C. Services Processing Unit

  D. Modular Port Concentrator

  Correct Answer: C