JN0-332 by Juniper Valid Free Exam Practice Test

Question 1

Which two statements are true about IPsec traffic? (Choose two.)

A. IPsec traffic can be forwarded when no IKE SA is present. B. For traffic that has to be encrypted, the security policy must be crafted based on the IP addresses in the inner IP header of the final ESP packet. C. For traffic that has to be encrypted, the security policy must be crafted based on the IP addresses in the outer IP header of the final ESP packet. D. IPsec traffic can be forwarded when no IPsec SA is present.

Correct Answer: A,B

Question 2

-- Exhibit -

-- Exhibit -
Click the Exhibit button.
Referring to the exhibit, failover to Node 0 occurred for Redundancy Group 2 because of an interface failure. The interface has since been restored, but Node 0 is still the primary node for Redundancy Group 2.
Which two actions will restore Node 1 as the primary node for Redundancy Group 2? (Choose two.)

A. Decrease the priority of Node 1 to 100. B. Manually fail over to Redundancy Group 2. C. Configure preempt under Redundancy Group 2. D. Increase the priority of Node 1 to 255.

Correct Answer: B,C

Question 3

Which statement is true about a logical interface?

A. A logical interface can belong to only one routing instance B. All logical interfaces in a routing instance must belong to a single zone C. A logical interface can belong to multiple zones D. A logical interface can belong to multiple routing instances

Correct Answer: A

Question 4

Which two criteria does the enhanced Web filtering solution use to make decisions? (Choose two.)

A. keyword in the document B. site reputation C. results of antivirus scan D. category

Correct Answer: B,D

Question 5

A network administrator repeatedly receives support calls about network issues. After investigating the issues, the administrator finds that the source NAT pool is running out of addresses. To be notified that the pool is close to exhaustion, what should the administrator configure?

A. Use an external script that will run a show command on the SRX Series device to see when the pool is close to exhaustion. B. Configure a syslog message to trigger a notification when the pool is close to exhaustion. C. Use the pool-utilization-alarm raise-threshold under the security nat source stanza. D. Use a trap-group with a category of services under the SNMP stanza.

Correct Answer: C

Question 6

You are asked to establish an IPsec VPN to a remote device whose IP address is dynamically assigned by the ISP.
Which IKE Phase 1 mode must you use?

A. quick B. passive C. aggressive D. main

Correct Answer: C

Question 7

Which two statements are true about pool-based source NAT? (Choose two.)

A. It supports the address-persistent configuration option. B. PAT is enabled by default. C. PAT is not supported. D. It supports the junos-global configuration option.

Correct Answer: A,B

Question 8

Which Web-filtering technology can be used at the same time as integrated Web filtering on a single branch SRX Series device?

A. firewall user authentication B. ICAP C. local Web filtering (blacklist or whitelist) D. Websense redirect Web filtering

Correct Answer: C

Question 9

Click the Exhibit button.
user@host> show interfaces ge-0/0/0.0 | match host-inbound
Allowed host-inbound traffic : bgp ospf
Which configuration would result in the output shown in the exhibit?

A. [edit security zones security-zone trust]
user@host# show
interfaces {
ge-0/0/0.0 {
host-inbound-traffic {
protocols {
ospf;
bgp;
}}}} B. [edit security zones functional-zone management]
user@host# show
host-inbound-traffic {
protocols {
bgp;
ospf;
}} C. [edit security zones security-zone trust]
user@host# show
host-inbound-traffic {
protocols {
bgp;
}}
interfaces {
all {
host-inbound-traffic {
protocols {
ospf;
}}}} D. [edit security zones functional-zone management]
user@host# show
interfaces {
ge-0/0/0.0 {
host-inbound-traffic {
protocols {
bgp;
ospf;
vrrp;
}}}}
host-inbound-traffic {
protocols {
all;
vrrp {
except;
}}}

Correct Answer: A

Question 10

For a route-based VPN, which statement is true?

A. host-inbound-traffic system services ike must be enabled on both the st0.x interface and the logical interface on which ike terminates B. host-inbound-traffic system services ike must be enabled on the logical interface on which ike terminates. C. host-inbound-traffic system services ike must be enabled on the st0.x interface D. host-inbound-traffic system services ike is not mandatory for route based VPNs.

Correct Answer: B

Question 11

Which high availability feature is supported only on Junos security platforms?

A. graceful restart B. VRRP C. Virtual Chassis D. chassis clustering

Correct Answer: D

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 12

A network administrator is using source NAT for traffic from source network 10.0.0.0/8. The administrator must also disable NAT for any traffic destined to the 202.2.10.0/24 network.Which configuration would accomplish this task?

A. [edit security nat source rule-set test]
user@host# show
from zone trust;
to zone untrust;
rule A {
match {
source-address 10.0.0.0/8;
}
then {
source-nat {
pool {
A;
}
}
}
} B. [edit security nat source rule-set test]
user@host# show
from zone trust;
to zone untrust;
rule A {
match {
source-address 202.2.10.0/24;
}
then {
source-nat {
pool {
A;
}
}
}
}
rule B {
match {
destination-address 10.0.0.0/8;
}
then {
source-nat {
off;
}
}
} C. [edit security nat source rule-set test]
user@host# show
from zone trust;
to zone untrust;
rule A {
match {
source-address 10.0.0.0/8;
}
then {
source-nat {
pool {
A;
}
}
}
}
rule B {
match {
destination-address 202.2.10.0/24;
} then { source-nat { off; } } } D. [edit security nat source]
user@host# show rule-set test
from zone trust;
to zone untrust;
rule 1 {
match {
destination-address 202.2.10.0/24;
}
then {
source-nat {
off;
}
}
}
rule 2 {
match {
source-address 10.0.0.0/8;
}
then {
source-nat {
pool {
A;
}
}
}
}

Correct Answer: D

Juniper Networks Certified Internet Specialist, SEC (JNCIS-SEC) - JN0-332 Exam Practice Test