JN0-635 Self-Study Guide for Becoming an Security, Professional (JNCIP-SEC) Expert
JN0-635 Study Guide Realistic Verified JN0-635 Dumps
NEW QUESTION 22
You have initiated the download of the IPS signature database on your SRX Series device.
Which command would you use to confirm the download has completed?
- A. request security idp security-package install
- B. request security idp security-package download status
- C. request security idp security-package install status
- D. request security idp security-package download
Answer: B
NEW QUESTION 23
You are connecting two remote sites to your corporate headquarters site, you must ensure that all traffic is secured and only uses a single Phase 2 SA for both sites.
In this scenario, which VPN should be used?
- A. Full mesh IPsec VPNs with tunnels between all sites.
- B. A hub-and-spoke IPsec VPN with the corporate firewall acting as the hub device.
- C. A full mesh Layer 3 VPN with the corporate firewall acting as the hub device.
- D. An IPsec group VPN with the corporate firewall acting as the hub device.
Answer: D
Explanation:
https://www.juniper.net/us/en/local/pdf/app-notes/3500202-en.pdf
NEW QUESTION 24
You have set up Security Director with Policy Enforcer and have configured 12 third-party feeds and a Sky ATP feed. You are also injecting 16 feeds using the available open API. You want to add another compatible feed using the available open API, but Policy Enforcer is not receiving the new feed.
What is the problem in this scenario?
- A. You cannot add more than 16 feeds through the available open API
- B. You have reached the maximum limit of 29 total feeds
- C. You must wait 48 hours for the feed to update
- D. You cannot add more than 16 feeds with the available open API
Answer: B
Explanation:
https://www.juniper.net/documentation/en_US/release-independent/sky-atp/information- products/pathway-pages/sky-atp-admin-guide.pdf page 110
NEW QUESTION 25
A hub member of an ADVPN is not functioning correctly.
Referring the exhibit, which action should you take to solve the problem?
- A. [edit security]
user@hub-1# delete ike gateway advpn-gateway advpn partner - B. [edit security]
user@hub-1# set ike gateway advpn-gateway advpn suggester disable - C. [edit interfaces]
root@vSRX-1# delete st0.0 multipoint - D. [edit interfaces]
user@hub-1# delete ipsec vpn advpn-vpn traffic-selector
Answer: D
NEW QUESTION 26
Click the Exhibit button.
A user reports trouble when using SSH to a server outside your organization. The traffic traverses an SRX Series device that is performing NAT and applying security policies.
Referring to the exhibit, which configuration will allow you to see the bidirectional flow through the SRX Series device?
- A.
- B.
- C.
- D.
Answer: D
NEW QUESTION 27
A local user complains that they cannot connect to an FTP server on the DMZ network.
You investigate and confirm that the security policy allows FTP traffic from the trust zone to the DMZ zone.
What are two reasons for this problem? (Choose two.)
- A. No security policy exists for traffic from the DMZ zone to the trust zone.
- B. The FTP server has no route back to the local network.
- C. No route is configured to the DMZ network.
- D. The FTP ALG is disabled.
Answer: B,D
NEW QUESTION 28
You are asked to configure a security policy on the SRX Series device. After committing the policy, you receive the "Policy is out of sync between RE and PFE <SPU-name(s)>." error.
Which command would be used to solve the problem?
- A. request security polices check
- B. request security polices resync
- C. restart security-intelligence
- D. request service-deployment
Answer: B
Explanation:
Reference:
https://kb.juniper.net/InfoCenter/index?page=content&id=KB30443&cat=SRX_SERIES&actp=LIST
NEW QUESTION 29
Click the Exhibit button.
A user is trying to reach a company's website, but the connection errors out. The security policies are configured correctly.
Referring to the exhibit, what is the problem?
- A. DNS ALG must be disabled
- B. Persistent NAT must be enabled
- C. Static NAT is missing a rule for DNS server
- D. The action for rule 1 must change to static-nat inet
Answer: C
NEW QUESTION 30
Which three roles or protocols are required when configuring an ADVPN? (Choose three.)
- A. BGP
- B. OSPF
- C. IKEv1
- D. shortcut suggester
- E. shortcut partner
Answer: B,D,E
NEW QUESTION 31
You are asked to configure a security policy on the SRX Series device. After committing the policy, you receive the "Policy is out of sync between RE and PFE <SPU-name(s)>." error.
Which command would be used to solve the problem?
- A. request security polices check
- B. request security polices resync
- C. restart security-intelligence
- D. request service-deployment
Answer: B
Explanation:
Explanation
https://kb.juniper.net/InfoCenter/index?page=content&id=KB30443&cat=SRX_SERIES&actp=LIST
NEW QUESTION 32
Click the Exhibit button.
Your company has purchased a competitor and now must connect the new network to the existing one. The competitor's gateway device is receiving its ISP address using DHCP. Communication between the two sites must be secured; however, obtaining a static public IP address for the new site gateway is not an option at this time. The company has several requirements for this solution:
* A site-to-site IPsec VPN must be used to secure traffic between the two sites;
* The IKE identity on the new site gateway device must use the hostname option; and
* Internet traffic from each site should exit through its local Internet connection.
The configuration shown in the exhibit has been applied to the new site's SRX, but the secure tunnel is not working.
In this scenario, what configuration change is needed for the tunnel to come up?
- A. Remove the quotes around the hostname
- B. Change the IKE policy mode to aggressive
- C. Bind interface st0 to the gateway
- D. Apply a static address to ge-0/0/2
Answer: A
NEW QUESTION 33
The monitor traffic interface command is being used to capture the packets destined to and the from the SRX Series device.
In this scenario, which two statements related to the feature are true? (Choose two.)
- A. This feature is supported on both branch and high-end SRX Series devices.
- B. This feature is supported on high-end SRX Series devices only.
- C. This feature captures ICMP traffic to and from the SRX Series device.
- D. This feature does not capture transit traffic.
Answer: A,D
Explanation:
https://forums.juniper.net/t5/Ethernet-Switching/monitor-traffic-interface/td-p/462528
NEW QUESTION 34
Click the Exhibit button.
Referring to the exhibit, which two statements are true? (Choose two.)
- A. The device cannot pass Layer 2 and Layer 3 traffic at the same time.
- B. You can secure inter-VLAN traffic with a security policy on this device.
- C. You can secure intra-VLAN traffic with a security policy on this device.
- D. The device can pass Layer 2 and Layer 3 traffic at the same time.
Answer: B,D
NEW QUESTION 35
Click the Exhibit button.
[edit protocols ospf area 0.0.0.0]
user@host# run show security ike security-associations
Index State Initiator cookie Responder cookie Mode Remote
Address
3289542 UP 48d928408940de28 e418fc7702fe483b Main
172.31.50.1
3289543 UP eb45940484082b14 428086b100427326 Main 10.10.50.1
[edit protocols ospf area 0.0.0.0]
user@host# run show security ipsec; security-associations
Total active tunnels: 2
ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway
<131073 ESP:des/ shal 6d40899b 1360/ unlim - root 500 10.10.50.1
>131073 ESP:des/ shal 5a89400e 1360/ unlim - root 500 10.10.50.1
<131074 ESP:des/ shal c04046f 1359/ unlim - root 500 172.31.50.1
>131074 ESP:des/ shal 5508946c 1359/ unlim - root 500 172.31.50.1
[edit protocols ospf area 0.0.0.0]
user@host# run show ospf neighbor
Address Interface State ID Pri Dead 10.40.60.1 st0.0 Init 10.30.50.1
128 35
10.40.60.2 st0.0 Full 10.30.50.1 128 31
[edit protocols ospf area 0.0.0.0]
user@host# show
interface st0.0;
You have already configured a hub-and-spoke VPN with one hub device and two spoke devices. However, the hub device has one neighbor in the Init state and one neighbor in the Full state.
What would you do to resolve this problem?
- A. Configure the st0.0 interface under OSPF as a point-to-point interface.
- B. Configure the st0.0 interface under OSPF as a point-to-multipoint interface.
- C. Configure the st0.0 interface under OSPF as a nonbroadcast multiple access interface.
- D. Configure the st0.0 interface under OSPF as an unnumbered interface.
Answer: B
NEW QUESTION 36
What is the required when deploying a log collector in Junos Space?
- A. a shared log file directory on the log collector
- B. a distributed deployment of the log collector nodes
- C. root user access to the log collector
- D. the IP address of interface eth1 on the log collector
Answer: C
NEW QUESTION 37
You opened a support ticket with JTAC for your Juniper ATP appliance. JTAC asks you to set up access to the device using the reverse SSH connection.Which three setting must be configured to satisfy this request? (Choose three.)
- A. Create a temporary admin account.
- B. Enable a JATP support account.
- C. Create a temporary root account.
- D. Enable JTAC remote access
- E. Enable remote support.
Answer: A,B,E
Explanation:
Reference:
https://kb.juniper.net/InfoCenter/index?page=content&id=TN326&cat=&actp=LIST&showDraft=false
NEW QUESTION 38
Click the Exhibit button.
The exhibit shows a snippet of a security flow trace. A user cannot open an SSH session to a server. Which action will solve the problem?
- A. Create a route to the desired server
- B. Create a security policy that matches the traffic parameters
- C. Edit the source NAT to correct the translated address
- D. Create a route entry to direct traffic into the configured tunnel
Answer: B
NEW QUESTION 39
Click the Exhibit button.
You deployed a site-to-site IPsec VPN connecting two data centers together using SRX5800s. After examining the performance of the IPsec VPN, you decide to enable IPsec performance acceleration to increase the rate of traffic that can be sent through the tunnel.
Referring to the exhibit, which two statements should you add to the configuration to accomplish this task?
(Choose two.)
- A. [edit security flow]
user@srx# set ipsec-performance-acceleration - B. [edit security flow]
user@srx# set power-mode-ipsec - C. [edit security flow]
user@srx# set tcp-mss ipsec-vpn mss 65535 - D. [edit security flow]
user@srx# set load-distribution session-affinity ipsec
Answer: A,D
NEW QUESTION 40
Click the Exhibit button.
Referring to the exhibit, which three topologies are supported by Policy Enforcer? (Choose three.)
- A. Topology 1
- B. Topology 2
- C. Topology 4
- D. Topology 3
- E. Topology 5
Answer: A,C,D
NEW QUESTION 41
......
Valid JN0-635 Exam Dumps Ensure you a HIGH SCORE: https://www.vcedumps.com/JN0-635-examcollection.html
JN0-635 Questions & Practice Test are Available On-Demand: https://drive.google.com/open?id=1rl98Hx1QLPOZHpaS_3PuZbTvnnWXkuxV
