Juniper JNCIS-SEC JN0-333 Study Guide Updated

1. What are two supported hypervisors for hosting a vSRX? (Choose two.)

2. You are asked to change when your SRX high availability failover occurs. One network interface is considered more important than others in the high availability configuration. You want to prioritize failover based on the state of that interface.

Which configuration would accomplish this task?

3. Which three Encapsulating Security Payload protocols do the SRX Series devices support with IPsec? (Choose three.)

4. What are three characteristics of session-based forwarding, compared to packet-based forwarding, on an SRX Series device? (Choose three.)

5. You have configured source NAT with port address translation. You also need to guarantee that the same IP address is assigned from the source NAT pool to a specific host for multiple concurrent sessions.

Which NAT parameter would meet this requirement?

6. 168.150.111 using HTTP?

7. Click the Exhibit button.

Which feature is enabled with destination NAT as shown in the exhibit?

8. Which two statements about security policy actions are true? (Choose two.)

9. Which two statements are true about global security policies? (Choose two.)

10. Which statement is true about functional zones?

11. You have recently configured an IPsec tunnel between two SRX Series devices. One of the devices is assigned an IP address using DHCP with an IP address that changes frequently. Initial testing indicates that the IPsec tunnel is not working. Troubleshooting has revealed that Phase 1 negotiations are failing.

Which two actions would solve the problem? (Choose two.)

12. Click the Exhibit button.

Which statement would explain why the IP-monitoring feature is functioning incorrectly?

13. Click the Exhibit button.

You have configured NAT on your network so that Host A can communicate with Server B. You want to ensure that Host C can initiate communication with Host A using Host A’s reflexive address.

Referring to the exhibit, which parameter should you configure on the SRX Series device to satisfy this requirement?

14. Which feature is used when you want to permit traffic on an SRX Series device only at specific times?

15. Which two modes are supported during the Phase 1 IKE negotiations used to establish an IPsec tunnel? (Choose two.)

16. Which statement describes the function of NAT?

17. Click the Exhibit button.

You are monitoring traffic, on your SRX300 that was configured using the factory default security parameters. You notice that the SRX300 is not blocking traffic between Host A and Host B as expected.

Referring to the exhibit, what is causing this issue?

18. What is the function of redundancy group 0 in a chassis cluster?

19. Which statement describes the function of screen options?

20. You want to protect your SRX Series device from the ping-of-death attack coming from the untrust security zone.

How would you accomplish this task?

21. After an SRX Series device processes the first packet of a session, how are subsequent packets for the same session processed?

22. You must verify if destination NAT is actively being used by users connecting to an internal server from the Internet.

Which action will accomplish this task on an SRX Series device?

23. Which interface is used exclusively to forward Ethernet-switching traffic between two chassis cluster nodes?

24. Which three statements describes traditional firewalls? (Choose three.)

25. Which SRX5400 component is responsible for performing first pass security policy inspection?

26. 100.75.75. The external DNS server address is 75.75.76.76. Traffic from the inside server to the DNS server fails.

Referring to the exhibit, what is causing the problem?

27. Click the Exhibit button.

Users at a remote office are unable to access an FTP server located at the remote corporate data center as expected. The remote FTP server is listening on the non-standard TCP port 2121.

Referring to the exhibit, what is causing the problem?

28. You want to trigger failover of redundancy group 1 currently running on node 0 and make node 1 the primary node the redundancy group 1.

Which command would be used accomplish this task?

29. You need to configure an IPsec tunnel between a remote site and a hub site. The SRX Series device at the remote site receives a dynamic IP address on the external interface that you will use for IPsec.

Which feature would you need to configure in this scenario?

30. Which statement is true about high availability (HA) chassis clusters for the SRX Series device?