Juniper Juniper Certifications JN0-635 Questions & Answers

• Question 61:

  You are asked to configure an IPsec VPN between two SRX Series devices that allows for processing of

  CoS on the intermediate routers.

  What will satisfy this requirement?

  A. route-based VPN

  B. OpenVPN

  C. remote access VPN

  D. policy-based VPN

  Correct Answer: A

  Reference: https://www.juniper.net/documentation/en_US/junos/topics/topic-map/secuirty-cos-basedipsec-vpns.html

• Question 62:

  Click the Exhibit button.

  

  You are asked to look at a configuration that is designed to take all traffic with a specific source IP address and forward the traffic to a traffic analysis server for further evaluation. The configuration is not working as intended.

  Referring to the exhibit, which change must be made to correct the configuration?

  A. Apply the filter as an input filter on interface xe-0/2/1.0

  B. Create a routing instance named default

  C. Apply the filter as an input filter on interface xe-0/0/1.0

  D. Apply the filter as an output filter on interface xe-0/1/0.0

  Correct Answer: C

• Question 63:

  Click the Exhibit button.

  

  The IKE policy and proposal are configured properly on both devices as shown in the exhibit. Which configuration snippet will complete the IKE configuration on the branch SRX Series device?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: D

• Question 64:

  You are trying to get a SSH honeypot set up on a Juniper ATP Appliance collector. The collector is running on hardware with two physical interfaces and two physical CPU cores. The honeypot feature is not working.

  Which statement is true in this scenario?

  A. The collector must have at least three physical interfaces

  B. The collector must have at least four physical cores

  C. The collector must have at least four physical interfaces

  D. The collector must have at least six physical cores

  Correct Answer: A

• Question 65:

  You correctly configured a security policy to deny certain traffic, but logs reveal that traffic is still allowed.

  Which specific traceoption flag will help you troubleshoot this problem?

  A. lookup

  B. configuration

  C. routing-socket

  D. rules

  Correct Answer: A

• Question 66:

  You are asked to configure an SRX Series device to bypass all security features for IP traffic from the engineering department.

  Which firewall filter will accomplish this task?

  

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: D

• Question 67:

  Click the Exhibit button.

  

  A user is trying to reach a company's website, but the connection errors out. The security policies are configured correctly.

  Referring to the exhibit, what is the problem?

  A. Persistent NAT must be enabled

  B. The action for rule 1 must change to static-nat inet

  C. DNS ALG must be disabled

  D. Static NAT is missing a rule for DNS server

  Correct Answer: D

• Question 68:

  You are asked to implement the session cache feature on an SRX5400.

  In this scenario, what information does a session cache entry record? (Choose two.)

  A. The type of processing to do for ingress traffic

  B. The type of processing to do for egress traffic

  C. To which SPU the traffic of the session should be forwarded

  D. To which NPU the traffic of the session should be forwarded

  Correct Answer: BC

  Reference: https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-packet-basedforwarding.html

• Question 69:

  Which feature of Sky ATP is deployed with Policy Enforcer?

  A. zero-day threat mitigation

  B. software image snapshot support

  C. device inventory management

  D. service redundancy daemon configuration support

  Correct Answer: A

• Question 70:

  Click the Exhibit button.

  

  Referring to the exhibit, which two statements are true? (Choose two.)

  A. The SRX Series device is enrolled and communicating with a JATP Appliance

  B. The JATP Appliance cannot download the security feeds from the GSS servers

  C. The SRX Series device cannot download the security feeds from the JATP Appliance

  D. The SRX Series device is not enrolled but can communicate with the JATP Appliance

  Correct Answer: CD