Exam Code : JN0-335
Exam Name : Security, Specialist (JNCIS-SEC)
Vendor Name :
"Juniper"
JN0-335 Dumps
JN0-335 Braindumps JN0-335 Real Questions JN0-335 Practice Test
JN0-335 Actual Questions
Security, Specialist (JNCIS-SEC)
https://killexams.com/pass4sure/exam-detail/JN0-335
What are three capabilities of AppQoS? (Choose three.)
re-write DSCP values
assign a forwarding class
re-write the TTL
rate-limit traffic
reserve bandwidth
Explanation:
AppQoS (Application Quality of Service) is a Junos OS feature that provides advanced control and prioritization of application traffic. With AppQoS, you can classify application traffic, assign a forwarding class to the traffic, and apply quality of service (QoS) policies to the traffic. You can also re-write DSCP values and reserve bandwidthfor important applications. However, AppQoS does not re-write the TTL or rate-limit traffic.
Source: Juniper Networks, Security, Specialist (JNCIS-SEC) Study Guide. Chapter 3: AppSecure. Page 66-67.
You are asked to find systems running applications that increase the risks on your network. You must ensure these systems are processed through IPS and Juniper ATP Cloud for malware and virus protection.
Which Juniper Networks solution will accomplish this task?
JIMS
Encrypted Traffic Insights
UTM
Adaptive Threat Profiling
Explanation:
Adaptive Threat Profiling (ATP) is a Juniper Networks solution that enables organizations to detect malicious activity on their networks and process it through IPS and Juniper ATP Cloud for malware and virus protection. ATP is powered by Juniperâs advanced Machine Learning and Artificial Intelligence (AI) capabilities, allowing it to detect and block malicious activity in real-time. ATP is integrated with Juniperâs Unified Threat Management (UTM) and Encrypted Traffic Insights (ETI) solutions, providing an end-to-end network protection solution.
Which statement about security policy schedulers is correct?
Multiple policies can use the same scheduler.
A policy can have multiple schedulers.
When the scheduler is disabled, the policy will still be available.
A policy without a defined scheduler will not become active
Explanation:
Schedulers can be defined and reused by multiple policies, allowing for more efficient management of policy activation and deactivation. This can be particularly useful for policies that need to be activated during specific time periods, such as business hours or maintenance windows.
Exhibit
Referring to the SRX Series flow module diagram shown in the exhibit, where is application security processed?
Forwarding Lookup
Services ALGs
Security Policy
Screens
What information does encrypted traffic insights (ETI) use to notify SRX Series devices about known malware sites?
certificates
dynamic address groups
MAC addresses
domain names
Explanation:
Encrypted traffic insights (ETI) uses domain names to notify SRX Series devices about known malware sites. ETI is a feature of the SRX Series firewall that can detect and block malware that is hidden in encrypted traffic. It works by analyzing the domain names of the websites that the encrypted traffic is attempting to access. If the domain name matches a known malware site, ETIwill send an alert to the SRX Series device, which can then take appropriate action to block the traffic. ETI is a useful tool for protecting against threats that attempt to evade detection by hiding in encrypted traffic.
Your manager asks you to provide firewall and NAT services in a private cloud.
Which two solutions will fulfill the minimum requirements for this deployment? (Choose two.)
a single vSRX
a vSRX for firewall services and a separate vSRX for NAT services
a cSRX for firewall services and a separate cSRX for NAT services
a single cSRX
Explanation:
A single vSRX or cSRX cannot provide both firewall and NAT services simultaneously. To meet the minimum requirements for this deployment, you need to deploy a vSRX for firewall services and a separate vSRX for NAT services (option B), or a cSRX for firewall services and a separate cSRX for NAT services (option C). This is according to the Juniper Networks Certified Security Specialist (JNCIS-SEC) Study Guide.
You want to deploy a virtualized SRX in your environment.
In this scenario, why would you use a vSRX instead of a cSRX? (Choose two.)
The vSRX supports Layer 2 and Layer 3 configurations.
Only the vSRX provides clustering.
The vSRX has faster boot times.
Only the vSRX provides NAT, IPS, and UTM services
Explanation:
The vSRX supports both Layer 2 and Layer 3 configurations, while the cSRX is limited to Layer 3 configurations. Additionally, the vSRX has faster boot times, which is advantageous in certain scenarios. The vSRX and cSRX both provide NAT, IPS, and UTM services.
Regarding static attack object groups, which two statements are true? (Choose two.)
Matching attack objects are automatically added to a custom group.
Group membership automatically changes when Juniper updates the IPS signature database.
Group membership does not automatically change when Juniper updates the IPS signature database.
You must manually add matching attack objects to a custom group.
Which statement regarding Juniper Identity Management Service (JIMS) domain PC probes is true?
JIMS domain PC probes analyze domain controller security event logs at60-mmute intervals by default.
JIMS domain PC probes are triggered if no username to IP address mapping is found in the domain security event log.
JIMS domain PC probes are triggered to map usernames to group membership information.
JIMS domain PC probes are initiated by an SRX Series device to verify authentication table information.
Explanation:
Juniper Identity Management Service (JIMS) domain PC probes are used to map usernames to IP addresses in the domain security event log. This allows for the SRX Series device to verify authentication table information, such as group membership. The probes are triggered whenever a username to IP address mapping is not found in the domain security event log. By default, the probes are executed at 60-minute intervals.
Exhibit
Which two statements are correct about the configuration shown in the exhibit? (Choose two.)
The session-class parameter in only used when troubleshooting.
The others 300 parameter means unidentified traffic flows will be dropped in 300 milliseconds.
Every session that enters the SRX Series device will generate an event
Replacing the session-init parameter with session-lose will log unidentified flows.
Explanation:
The configuration shown in the exhibit is for a Juniper SRX Series firewall. The session-init parameter is used to control how the firewall processes unknown traffic flows. With the session-init parameter set to 300, any traffic flows that the firewall does not recognize will be dropped after 300 milliseconds. Additionally, every session that enters the device, whether it is known or unknown, will generate an event, which can be used for logging and troubleshooting purposes. The session-lose parameter is used to control how the firewall handles established sessions that are terminated.
Which two statements are true about the vSRX? (Choose two.)
It does not have VMXNET3 vNIC support.
It has VMXNET3 vNIC support.
UNIX is the base O
Linux is the base O
Which two statements about SRX Series device chassis clusters are true? (Choose two.)
Redundancy group 0 is only active on the cluster backup node.
Each chassis cluster member requires a unique cluster ID value.
Each chassis cluster member device can host active redundancy groups
Chassis cluster member devices must be the same model.
Explanation:
Each chassis cluster member requires a unique cluster ID value: This statement is true. Each chassis cluster member must have a unique cluster ID assigned, which is used to identify each device in the cluster.
Each chassis cluster member device can host active redundancy groups: This statement is true. Both devices in a chassis cluster can host active redundancy groups, allowing for load balancing and failover capabilities.
The two statements about SRX Series device chassis clusters that are true are that each chassis cluster member requires a unique cluster ID value, and that each chassis cluster member device can host active redundancy groups. A unique cluster ID value is necessary so that all members of the cluster can be identified, and each chassis cluster member device can host active redundancy groups to ensure that the cluster is able to maintain high availability and redundancy. Additionally, it is not necessary for all chassis cluster member devices to be the same model, as long as all
devices are running the same version of Junos software.
Which two statements are correct about SSL proxy server protection? (Choose two.)
You do not need to configure the servers to use the SSL proxy the function on the SRX Series device.
You must load the server certificates on the SRX Series device.
The servers must be configured to use the SSL proxy function on the SRX Series device.
You must import the root CA on the servers.
Explanation:
You must load the server certificates on the SRX Series device and configure the servers to use the SSL proxy function on the SRX Series device. This is done to ensure that the SSL proxy is able to decrypt the traffic between the client and server. Additionally, you must import the root CA on the servers in order for the SSL proxy to properly validate the server certificate.