Best Preparations of JN0-635 Exam 2021 Junos Security Unlimited 90 Questions [Q44-Q68]

Best Preparations of JN0-635 Exam 2021 Junos Security Unlimited 90 Questions

Focus on JN0-635 All-in-One Exam Guide For Quick Preparation.

NEW QUESTION 44
Click the Exhibit button.

A user is trying to reach a company's website, but the connection errors out. The security policies are configured correctly.
Referring to the exhibit, what is the problem?

A. Static NAT is missing a rule for DNS server
B. The action for rule 1 must change to static-nat inet
C. Persistent NAT must be enabled
D. DNS ALG must be disabled

Answer: A

Explanation:
Explanation

NEW QUESTION 45
You are asked to configure an IPsec VPN between two SRX Series devices that allows for processing of CoS on the intermediate routers.
What will satisfy this requirement?

A. route-based VPN
B. policy-based VPN
C. remote access VPN
D. OpenVPN

Answer: A

Explanation:
Explanation/Reference: https://www.juniper.net/documentation/en_US/junos/topics/topic-map/secuirty-cos-based-ipsec- vpns.html

NEW QUESTION 46
Exhibit.

Referring to the exhibit, which two statements are true? (Choose two.)

A. The IPv6 address is invalid.
B. External hosts cannot initiate contact.
C. The configured solution allows IPv6 to IPv4 translation.
D. The configured solution allows IPv4 to IPv6 translation.

Answer: A,C

NEW QUESTION 47
Click the Exhibit button.

When attempting to enroll an SRX Series device to JATP, you receive the error shown in the exhibit. What is the cause of the error?

A. The SRX Series device certificate does not match the JATP certificate
B. The SRX Series device does not have an IP address assigned to the interface that accesses JATP
C. A firewall is blocking HTTPS on fxp0
D. The fxp0 IP address is not routable

Answer: B

NEW QUESTION 48
Your organization has multiple Active Directory domain to control user access. You must ensure that security polices are passing traffic based upon the user's access rights.
What would you use to assist your SRX series devices to accomplish this task?

A. Junos Space
B. JATP Appliance
C. JIMS
D. JSA

Answer: C

Explanation:
https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-user-auth-configure-jims.html

NEW QUESTION 49
You have a remote access VPN where the remote users are using the NCP client. The remote users can access the internal corporate resources as intended; however, traffic that is destined to all other Internet sites is going through the remote access VPN. You want to ensure that only traffic that is destined to the internal corporate resources use the remote access VPN.
Which two actions should you take to accomplish this task? (Choose two.)

A. Enable IKEv2 within the VPN configuration on the SRX Series device
B. Configure the necessary traffic selectors within the VPN configuration on the SRX Series device
C. Enable the split tunneling feature within the VPN configuration on the SRX Series device
D. Configure split tunneling on the NCP profile on the remote client

Answer: B,D

NEW QUESTION 50
Click the Exhibit button.

Referring to the exhibit, which two statements are true? (Choose two.)

A. SRX Series devices will block traffic based on this third-party feed
B. Events based on this third-party feed will not affect a host's threat score
C. SRX Series devices will not block traffic based on this third-party feed
D. Events based on this third-party feed will affect a host's threat score

Answer: A,B

NEW QUESTION 51
Exhibit.

A hub member of an ADVPN is not functioning correctly.
Referring the exhibit, which action should you take to solve the problem?

A. [edit security]
user@hub-1# delete ike gateway advpn-gateway advpn partner
B. [edit interfaces]
user@hub-1# delete ipsec vpn advpn-vpn traffic-selector
C. [edit interfaces]
root@vSRX-1# delete st0.0 multipoint
D. [edit security]
user@hub-1# set ike gateway advpn-gateway advpn suggester disable

Answer: B

NEW QUESTION 52
Click the Exhibit button.

Referring to the exhibit, you are attempting to enable IPsec power mode to improve IPsec VPN performance. However, you are unable to use IPsec power mode.
What is the problem?

A. IPsec power mode requires that you configure a policy-based VPN
B. IPsec power mode cannot be used with advanced services
C. IPsec power mode cannot be used with high IPsec maximum segment size values
D. IPsec power mode cannot be used with IPsec performance acceleration

Answer: B

Explanation:
Explanation/Reference: https://www.juniper.net/documentation//en_US/junos/topics/reference/configuration-statement/ security-flow-power-mode-ipsec.html

NEW QUESTION 53
You have downloaded and initiated the installation of the application package for the JATP Appliance on an SRX1500. You must confirm that the installation of the application package has completed successfully.
In this scenario, which command would you use to accomplish this task?

A. show services application-identification status
B. show services application-identification version
C. show services application-identification application detail
D. show services application-identification application version

Answer: A

NEW QUESTION 54
Click the Exhibit button.

You have configured an ADVPN that is operational. However, OSPF will not establish correctly across the ADVPN tunnels.
Referring to the exhibit, which two commands will solve the problem? (Choose two.)

A. [edit protocols ospf area 0.0.0.0]
user@srx# set interface st0.0 interface-type nbma
B. [edit protocols ospf area 0.0.0.0]
user@srx# set interface st0.0 demand-circuit
C. [edit protocols ospf area 0.0.0.0]
user@srx# set interface st0.0 topology advpn
D. [edit protocols ospf area 0.0.0.0]
user@srx# set interface st0.0 dynamic-neighbors

Answer: B,D

NEW QUESTION 55
Which interface family is required for Layer 2 transparent mode on SRX Series devices?

A. LLDP
B. VPLS
C. Ethernet switching
D. inet

Answer: C

NEW QUESTION 56
In which two ways are tenant systems different from logical systems? (Choose two.)

A. Tenant systems have less scalability than logical systems
B. Tenant systems have more routing features than logical systems
C. Tenant systems have fewer routing features than logical systems
D. Tenant systems have higher scalability than logical systems

Answer: C,D

NEW QUESTION 57
Click the Exhibit button.

You are implementing a new branch site and want to ensure Internet traffic is sent directly to your ISP and other traffic is sent to your company headquarters. You have configured filter-based forwarding to accomplish this objective. You verify proper functionality using the outputs shown in the exhibit.
Which two statements are true in this scenario? (Choose two.)

A. The session utilizes one routing instance
B. The ge-0/0/5 and ge-0/0/1 interfaces must reside in a single security zone
C. The session utilizes two routing instances
D. The ge-0/0/5 and ge-0/0/1 interfaces can reside in different security zones

Answer: A,D

NEW QUESTION 58
Which two VPN features are supported with CoS-based IPsec VPNs? (Choose two.)

A. IKEv1
B. IKEv2
C. dead peer detection
D. VPN monitoring

Answer: B,C

Explanation:
Explanation/Reference: https://www.juniper.net/documentation/en_US/junos/topics/topic-map/secuirty-cos-based-ipsec- vpns.html

NEW QUESTION 59
Click the Exhibit button.

You are asked to look at a configuration that is designed to take all traffic with a specific source IP address and forward the traffic to a traffic analysis server for further evaluation. The configuration is not working as intended.
Referring to the exhibit, which change must be made to correct the configuration?

A. Apply the filter as an output filter on interface xe-0/1/0.0
B. Apply the filter as an input filter on interface xe-0/0/1.0
C. Apply the filter as an input filter on interface xe-0/2/1.0
D. Create a routing instance named default

Answer: B

NEW QUESTION 60
Click the Exhibit button.

The IKE policy and proposal are configured properly on both devices as shown in the exhibit. Which configuration snippet will complete the IKE configuration on the branch SRX Series device?
A)

B)

C)

D)

A. Option A
B. Option D
C. Option B
D. Option C

Answer: B

NEW QUESTION 61
The monitor traffic interface command is being used to capture the packets destined to and the from the SRX Series device.
In this scenario, which two statements related to the feature are true? (Choose two.)

A. This feature is supported on both branch and high-end SRX Series devices.
B. This feature is supported on high-end SRX Series devices only.
C. This feature captures ICMP traffic to and from the SRX Series device.
D. This feature does not capture transit traffic.

Answer: A,D

Explanation:
Reference:
https://forums.juniper.net/t5/Ethernet-Switching/monitor-traffic-interface/td-p/462528

NEW QUESTION 62
You are not able to activate the SSH honeypot on the all-in-one Juniper ATP appliance.
What would be a cause of this problem?

A. The collector must have a minimum of three interfaces.
B. The collector must have a minimum of four interfaces.
C. The collector must have a minimum of five interfaces.
D. The collector must have a minimum of two interfaces.

Answer: B

Explanation:
Reference:
https://www.juniper.net/documentation/en_US/release-independent/jatp/topics/task/configuration/jatp-traffic-collectorsetting-ssh-honeypot-detection.html

NEW QUESTION 63
Click the Exhibit button.

Referring to the exhibit, which three topologies are supported by Policy Enforcer? (Choose three.)

A. Topology 3
B. Topology 4
C. Topology 2
D. Topology 1
E. Topology 5

Answer: A,B,D

NEW QUESTION 64
Which feature of Sky ATP is deployed with Policy Enforcer?

A. service redundancy daemon configuration support
B. software image snapshot support
C. zero-day threat mitigation
D. device inventory management

Answer: C

NEW QUESTION 65
Click the Exhibit button.

Which type of NAT is shown in the exhibit?

A. NAT64
B. persistent NAT
C. DS-Lite
D. NAT46

Answer: A

Explanation:
Explanation/Reference:

NEW QUESTION 66
Click the Exhibit button.

You deployed a site-to-site IPsec VPN connecting two data centers together using SRX5800s. After examining the performance of the IPsec VPN, you decide to enable IPsec performance acceleration to increase the rate of traffic that can be sent through the tunnel.
Referring to the exhibit, which two statements should you add to the configuration to accomplish this task?
(Choose two.)

A. [edit security flow]
user@srx# set ipsec-performance-acceleration
B. [edit security flow]
user@srx# set load-distribution session-affinity ipsec
C. [edit security flow]
user@srx# set power-mode-ipsec
D. [edit security flow]
user@srx# set tcp-mss ipsec-vpn mss 65535

Answer: A,B

NEW QUESTION 67
You have a webserver and a DNS server residing in the same internal DMZ subnet. The public Static NAT addresses for the servers are in the same subnet as the SRX Series devices internet-facing interface. You implement DNS doctoring to ensure remote users can access the webserver.Which two statements are true in this scenario? (Choose two.)