Prepare Top Juniper JN0-335 Exam Study Guide Practice Questions Edition
Go to JN0-335 Questions - Try JN0-335 dumps pdf
The Security, Specialist (JNCIS-SEC) certification exam is ideal for those who want to pursue a career in network security and want to demonstrate their expertise in this area. JN0-335 exam requires candidates to have a solid understanding of security technologies, including security policies and zones, stateful firewall services, IPsec VPNs, Network Address Translation (NAT), and high availability (HA) clustering.
NEW QUESTION # 42
Which two statements about SRX chassis clustering are correct? (Choose two.)
- A. SRX chassis clustering supports active/passive for the control plane.
- B. SRX chassis clustering supports active/active for the control plane.
- C. SRX chassis clustering only supports active/passive for the data plane.
- D. SRX chassis clustering supports active/passive and active/active for the data plane.
Answer: B,D
Explanation:
SRX chassis clustering supports active/passive and active/active for the data plane. In an active/active configuration, both cluster members process and forward traffic, which increases throughput and provides redundancy. For the control plane, SRX chassis clustering supports active/active, meaning that both cluster members can process and forward control traffic, providing redundancy and improved scalability
NEW QUESTION # 43
You want to deploy vSRX in Amazon Web Services (AWS) virtual private clouds (VPCs).
Which two statements are true in this scenario? (Choose two.)
- A. IPsec tunnels can be used to connect vSRX in different VPCs.
- B. The vSRX devices serving as local enforcement points for VPCs can be managed by a centralized Junos Space Security Director instance.
- C. The vSRX devices serving as local enforcement points for VPCs can be managed by a centralized Junos Space Network Director instance.
- D. MPLS LSPs can be used to connect vSRXs in different VPCs.
Answer: A,B
NEW QUESTION # 44
You want to deploy a virtualized SRX in your environment. In this scenario, why would you use a vSRX instead of a cSRX? (Choose two.)
- A. The vSRX supports Layer 2 and Layer 3 configurations.
- B. The vSRX has faster boot times.
- C. Only the vSRX provides NAT, IPS, and UTM services
- D. Only the vSRX provides clustering.
Answer: A,B
Explanation:
The vSRX supports both Layer 2 and Layer 3 configurations, while the cSRX is limited to Layer 3 configurations. Additionally, the vSRX has faster boot times, which is advantageous in certain scenarios. The vSRX and cSRX both provide NAT, IPS, and UTM services.
NEW QUESTION # 45
What are three capabilities of AppQoS? (Choose three.)
- A. assign a forwarding class
- B. re-write DSCP values
- C. re-write the TTL
- D. reserve bandwidth
- E. rate-limit traffic
Answer: A,B,D
Explanation:
AppQoS (Application Quality of Service) is a Junos OS feature that provides advanced control and prioritization of application traffic. With AppQoS, you can classify application traffic, assign a forwarding class to the traffic, and apply quality of service (QoS) policies to the traffic. You can also re-write DSCP values and reserve bandwidth for important applications. However, AppQoS does not re-write the TTL or rate-limit traffic.
NEW QUESTION # 46
Which default protocol and port are used for JIMS to SRX client communication?
- A. ADSI over TCP; port 389
- B. RPC over TCP, port 135
- C. WMI over TCP; port 389
- D. HTTPS over TCP: port 443
Answer: D
NEW QUESTION # 47
Which two statements are true about Juniper ATP Cloud? (Choose two.)
- A. Juniper ATP Cloud uses multiple antivirus software packages to analyze files.
- B. Juniper ATP Cloud only uses one antivirus software package to analyze files.
- C. Juniper ATP Cloud does not use antivirus software packages to protect against zero-day threats.
- D. Juniper ATP Cloud uses antivirus software packages to protect against zero-day threats.
Answer: A,C
Explanation:
Explanation
Juniper ATP Cloud is a cloud-based threat detection service that protects all hosts in your network against evolving security threats. Juniper ATP Cloud performs the following tasks:
It extracts potentially malicious objects and files from the traffic and sends them to the cloud for analysis.
It uses multiple antivirus software packages to analyze files and identify known malicious files quickly.
It also uses other techniques, such as machine learning, sandboxing, and behavioral analysis, to identify new malware and add it to the known list of malware.
It correlates between newly identified malware and known command and control (C&C) sites to aid analysis.
It blocks known malicious file downloads and outbound C&C traffic.
It provides features such as DNS, Encrypted Traffic Insights (ETI) and IoT security if you have ATP Cloud premium license.
Based on this information, we can infer the following:
Option B is correct because Juniper ATP Cloud uses multiple antivirus software packages to analyze files, as well as other techniques, to provide robust coverage against sophisticated, evasive threats.
Option D is correct because Juniper ATP Cloud does not use antivirus software packages to protect against zero-day threats, which are unknown and undetected by traditional antivirus solutions. Instead, it uses other techniques, such as machine learning, sandboxing, and behavioral analysis, to identify and mitigate zero-day threats.
Option A is incorrect because Juniper ATP Cloud does not only use one antivirus software package to analyze files, but multiple ones, as well as other techniques.
Option C is incorrect because Juniper ATP Cloud does not use antivirus software packages to protect against zero-day threats, but other techniques.
References: Juniper Security, Specialist (JNCIS-SEC) Reference Materials and Juniper Security, Professional (JNCIP-SEC) Reference Materials
https://blogs.juniper.net/en-us/security/juniper-strengthens-connected-security-portfolio-with-new-risk-based-acc
https://blogs.juniper.net/en-us/security/juniper-strengthens-connected-security-portfolio-with-new-risk-based-acc
NEW QUESTION # 48
You are asked to block malicious applications regardless of the port number being used.
In this scenario, which two application security features should be used? (Choose two.)
- A. AppQoE
- B. AppFW
- C. AppTrack
- D. APPID
Answer: B,D
Explanation:
you can block applications and users based on network access policies, users and their job roles, time, and application signatures2. You can also use Juniper Advanced Threat Prevention (ATP) to find and block commodity and zero-day cyberthreats within files, IP traffic, and DNS requests1
NEW QUESTION # 49
When working with network events on a Juniper Secure Analytics device, flow records come from which source?
- A. mirror
- B. switch
- C. tap port
- D. SPAN
Answer: D
NEW QUESTION # 50
On which three Hypervisors is vSRX supported? (Choose three.)
- A. KVM
- B. Hyper-V
- C. Oracle VM
- D. VMware ESXi
- E. Citrix Hypervisor
Answer: A,B,D
Explanation:
vSRX is a virtual firewall that runs as a software instance on a hypervisor. A hypervisor is a software layer that allows multiple virtual machines to run on a single physical host. vSRX supports three hypervisors: VMware ESXi, Hyper-V, and KVM. VMware ESXi is a hypervisor that runs on x86 servers and supports various operating systems and applications. Hyper-V is a hypervisor that runs on Windows Server and supports Windows and Linux virtual machines. KVM (Kernel-based Virtual Machine) is a hypervisor that runs on Linux and supports Linux, Windows, and other operating systems.
NEW QUESTION # 51
Which two features are configurable on Juniper Secure Analytics (JSA) to ensure that alerts are triggered when matching certain criteria? (Choose two.)
- A. assets
- B. events
- C. building blocks
- D. tests
Answer: B,D
Explanation:
The two configurable features on Juniper Secure Analytics (JSA) that can be used to ensure that alerts are triggered when matching certain criteria are events and tests. Events refer to the collection of data from different sources, while tests are used to define the criteria for which an alert is triggered. For example, you can use events to collect data from a firewall and tests to define criteria such as IP address, port number, and the type of traffic. The Security, Specialist (JNCIS-SEC) Study guide provides further information on how to configure these features on JSA.
NEW QUESTION # 52
You are preparing a proposal for a new customer who has submitted the following requirements for a vSRX deployment:
-- globally distributed,
-- rapid provisioning,
-- scale based on demand,
-- and low CapEx.
Which solution satisfies these requirements?
- A. AWS
- B. Juniper ATP Cloud
- C. VMWare ESXi
- D. Network Director
Answer: A
Explanation:
The solution that satisfies the requirements for a vSRX deployment is AWS. AWS (Amazon Web Services) is a cloud computing platform that provides on-demand services such as infrastructure, platform, software, and database as a service. AWS is globally distributed, meaning that it has data centers in multiple regions around the world. AWS also allows rapid provisioning, meaning that you can launch vSRX instances in minutes using preconfigured Amazon Machine Images (AMIs) or custom templates. AWS also enables scaling based on demand, meaning that you can adjust the number and size of vSRX instances according to your network traffic and performance needs. AWS also has low CapEx (capital expenditure), meaning that you only pay for what you use and do not need to invest in hardware or maintenance costs.
NEW QUESTION # 53
Click the Exhibit button.
Referring to the exhibit, what will the SRX Series device do in this configuration?
- A. Packets from the infected hosts with a threat level of 8 will be dropped and a log message will be generated.
- B. Packets from the infected hosts with a threat level of 8 or above will be dropped and a log message will be generated.
- C. Packets from the infected hosts with a threat level of 8 or above will be dropped and no log message will be generated.
- D. Packets from the infected hosts with a threat level of 8 will be dropped and no log message will be generated.
Answer: C
Explanation:
The exhibit shows a configuration snippet for security intelligence on an SRX Series device. Security intelligence is a feature that allows you to block or monitor traffic from malicious sources based on threat intelligence feeds from Juniper ATP Cloud or other providers. The configuration defines a profile for ATP Infected-Hosts, which is a feed that contains IP addresses of hosts that are infected with malware and communicate with command-and-control servers. The configuration also defines a rule for threat level 8, which is a parameter that indicates the severity of the threat. Based on this configuration, the SRX Series device will do the following:
Packets from the infected hosts with a threat level of 8 or above will be dropped: The action block-and-drop under the rule means that the device will block any traffic from the infected hosts that have a threat level equal to or higher than 8. This will prevent the hosts from sending or receiving malicious commands or data.
No log message will be generated: The absence of any log option under the rule means that the device will not generate any log message for the blocked traffic. This may reduce the load on the device and the logging server, but it may also limit the visibility and analysis of the security events.
NEW QUESTION # 54
Where is AppSecure executed in the flow process on an SRX Series device?
- A. services
- B. zones
- C. security policy
- D. screens
Answer: A
NEW QUESTION # 55
Exhibit
You are trying to create a security policy on your SRX Series device that permits HTTP traffic from your private 172 25.11.0/24 subnet to the Internet You create a policy named permit-http between the trust and untrust zones that permits HTTP traffic. When you issue a commit command to apply the configuration changes, the commit fails with the error shown in the exhibit.
Which two actions would correct the error? (Choose two.)
- A. Issue the rollback 1 command from the top of the configuration hierarchy and attempt the commit again.
- B. Execute the Junos commit full command to override the error and apply the configuration.
- C. Modify the security policy to use the built-in Junos-http applications.
- D. Create a custom application named http at the [edit applications] hierarchy.
Answer: C,D
Explanation:
Explanation
The error occurred because the "http" application is not defined in this context of Juniper SRX Series device configuration. One solution is to create a custom application named "http" at the [edit applications] hierarchy level (Option C). Another solution is to modify the security policy to use the built-in "junos-http" application which is predefined and doesn't need an explicit definition (Option D). Options A and B are not correct because they do not address the root cause of the error, which is the undefined application "http". References:
The answers can be verified from Juniper's official documentation on security policies and applications available on their website. Here are some relevant links:
Security Policies Feature Guide for Security Devices
Understanding Applications and Application Sets for SRX Series Devices
Configuring Custom Applications for SRX Series Devices
Predefined Applications for SRX Series Devices
NEW QUESTION # 56
You must configure JSA to accept events from an unsupported third-party log source.
In this scenario, what should you do?
- A. Configure a universal device service module.
- B. Configure an RPM for a third-party device service module.
- C. Configure JSA to silently discard unsupported log types.
- D. Separate event collection and flow collection on separate collectors.
Answer: A
NEW QUESTION # 57
Exhibit
Referring to the exhibit, what do you determine about the status of the cluster.
- A. Node 1 is down
- B. Node 2 is down.
- C. There are no issues with the cluster.
- D. Both nodes determine that they are in a primary state.
Answer: D
Explanation:
Explanation
Referring to the exhibit, we can see that the output of the show chassis cluster status command on both nodes shows that they have the same cluster ID, node ID, priority, and status. The status for both nodes is primary, which means that they are both active and ready to process traffic for all redundancy groups1.
This situation can occur when the control link between the two nodes is down or not configured properly, and the heartbeat messages cannot be exchanged. Without the heartbeat messages, each node assumes that the other node is down and takes over the primary role for all redundancy groups12.
This is not a desirable state for the cluster, as it can cause traffic disruption, configuration inconsistency, and split-brain scenarios. To resolve this issue, the control link should be checked and fixed, and the cluster should be synchronized12.
References:
1: Troubleshooting an SRX Chassis Cluster with One Node in the Primary State and the Other Node in the Disabled State
2: SRX Series Chassis Cluster Configuration Overview
NEW QUESTION # 58
......
Free JNCIS-SEC JN0-335 Exam Question: https://tesking.pass4cram.com/JN0-335-dumps-torrent.html