Question 1

Click the Exhibit button.  The exhibit shows a snippet of a security flow trace. A user cannot open an SSH session to a server. Which action will solve the problem?
A) Create a security policy that matches the traffic parameters
B) Edit the source NAT to correct the translated address
C) Create a route entry to direct traffic into the configured tunnel
D) Create a route to the desired server

Accepted Answer

A

Question 2

Click the Exhibit button.  The IKE policy and proposal are configured properly on both devices as shown in the exhibit. Which configuration snippet will complete the IKE configuration on the branch SRX Series device?
A) 
B) 
C) 
D)

Accepted Answer

D

Question 3

Which feature of Sky ATP is deployed with Policy Enforcer?
A) zero-day threat mitigation
B) software image snapshot support
C) device inventory management
D) service redundancy daemon configuration support

Accepted Answer

Sky ATP's zero-day threat mitigation is deployed with Policy Enforcer to provide advanced threat protection by identifying and blocking new, unknown threats.

Question 4

Which three types of peer devices are supported for CoS-based IPsec VPNs? (Choose three.)
A) branch SRX Series device
B) third-party device
C) cSRX
D) high-end SRX Series device
E) vSRX

Accepted Answer

Branch SRX Series devices, high-end SRX Series devices, and vSRX are supported for CoS-based IPsec VPNs.

Question 5

Click the Exhibit button.  While configuring the SRX345, you review the MACsec connection between devices and note that it is not working. Referring to the exhibit, which action would you use to identify problem?
A) Verify that the formatting settings are correct between the devices and that the software supports the version of MACsec in use
B) Verify that the connectivity association key and the connectivity association key name match on both devices
C) Verify that the transmission path is not replicating packets or correcting frame check sequence error packets
D) Verify that the interface between the two devices is up and not experiencing errors

Accepted Answer

The answer of Click the Exhibit button.  While configuring...

Question 6

Which three roles or protocols are required when configuring an ADVPN? (Choose three.)
A) OSPF
B) shortcut partner
C) shortcut suggester
D) IKEv1
E) BGP

Accepted Answer

The answer of Which three roles or protocols are required...

Question 7

Click the Exhibit button.  Referring to the exhibit, which two statements are true? (Choose two.)
A) The SRX Series device is enrolled and communicating with a JATP Appliance
B) The JATP Appliance cannot download the security feeds from the GSS servers
C) The SRX Series device cannot download the security feeds from the JATP Appliance
D) The SRX Series device is not enrolled but can communicate with the JATP Appliance

Accepted Answer

The answer of Click the Exhibit button.  Referring to...

Question 8

Click the Exhibit button.  You have configured tenant systems on your SRX Series device. Referring to the exhibit, which two actions should you take to facilitate inter-TSYS communication? (Choose two.)
A) Place the logical tunnel interfaces in a virtual router routing instance in the interconnect switch
B) Place the logical tunnel interfaces in a VPLS routing instance in the interconnect switch
C) Connect each TSYS with the interconnect switch by configuring INET configured logical tunnel interfaces in the interconnect switch
D) Connect each TSYS with the interconnect switch by configuring Ethernet VPLS configured logical tunnel interfaces in the interconnect switch

Accepted Answer

The answer of Click the Exhibit button.  You have...

Question 9

Which interface family is required for Layer 2 transparent mode on SRX Series devices?
A) LLDP
B) Ethernet switching
C) inet
D) VPLS

Accepted Answer

Ethernet switching is required for Layer 2 transparent mode on SRX Series devices, as it allows the device to operate at Layer 2, forwarding traffic based on MAC addresses.

Question 10

Click the Exhibit button.  You deployed a site-to-site IPsec VPN connecting two data centers together using SRX5800s. After examining the performance of the IPsec VPN, you decide to enable IPsec performance acceleration to increase the rate of traffic that can be sent through the tunnel. Referring to the exhibit, which two statements should you add to the configuration to accomplish this task? (Choose two.)
A) [edit security flow] user@srx# set tcp-mss ipsec-vpn mss 65535
B) user@srx# set ipsec-performance-acceleration
C) user@srx# set power-mode-ipsec
D) user@srx# set load-distribution session-affinity ipsec

Accepted Answer

The answer of Click the Exhibit button.  You deployed...

Question 11

When would you use the port-overloading-factor 1 setting?
A) to enable the port-overloading
B) to disable the port-overloading
C) to map ports with 1:1 ratio for port-overloading
D) to set the maximum port-overloading capacity to 65,536

Accepted Answer

To disable the port-overloading

Question 12

You are asked to implement the session cache feature on an SRX5400. In this scenario, what information does a session cache entry record? (Choose two.)
A) The type of processing to do for ingress traffic
B) The type of processing to do for egress traffic
C) To which SPU the traffic of the session should be forwarded
D) To which NPU the traffic of the session should be forwarded

Accepted Answer

The answer of You are asked to implement the session...

Question 13

Click the Exhibit button.  Referring to the exhibit, which statement is true?
A) ARP security is securing data across the control interface
B) IPsec is securing data across the control interface
C) SSH is securing data across the control interface
D) MACsec is securing data across the control interface

Accepted Answer

The answer of Click the Exhibit button.  Referring to...

Question 14

You have set up Security Director with Policy Enforcer and have configured 12 third-party feeds and a Sky ATP feed. You are also injecting 16 feeds using the available open API. You want to add another compatible feed using the available open API, but Policy Enforcer is not receiving the new feed. What is the problem in this scenario?
A) You must wait 48 hours for the feed to update
B) You cannot add more than 16 feeds through the available open API
C) You have reached the maximum limit of 29 total feeds
D) You cannot add more than 16 feeds with the available open API

Accepted Answer

The maximum limit of total feeds that can be configured is 29, and you have already reached this limit with 12 third-party feeds, 1 Sky ATP feed, and 16 feeds through the open API.

Question 15

Click the Exhibit button.  You are implementing a new branch site and want to ensure Internet traffic is sent directly to your ISP and other traffic is sent to your company headquarters. You have configured filter-based forwarding to accomplish this objective. You verify proper functionality using the outputs shown in the exhibit. Which two statements are true in this scenario? (Choose two.)
A) The session utilizes one routing instance
B) The ge-0/0/5 and ge-0/0/1 interfaces must reside in a single security zone
C) The ge-0/0/5 and ge-0/0/1 interfaces can reside in different security zones
D) The session utilizes two routing instances

Accepted Answer

The answer of Click the Exhibit button.  You are...

Question 16

Click the Exhibit button.  You have recently committed the IPS policy shown in the exhibit. When evaluating the expected behavior, you notice that you have a session that matches all the rules in your IPS policy. In this scenario, which action would be taken?
A) drop packet
B) no-action
C) close-client-and-server
D) ignore-connection

Accepted Answer

The answer of Click the Exhibit button.  You have...

Question 17

You are asked to configure a new SRX Series CPE device at a remote office. The device must participate in forwarding MPLS and IPsec traffic. Which two statements are true regarding this implementation? (Choose two.)
A) Host inbound traffic must not be processed by the flow module
B) Host inbound traffic must be processed by the flow module
C) The SRX Series device can process both MPLS and IPsec with default traffic handling
D) A firewall filter must be configured to enable packet mode forwarding

Accepted Answer

The answer of You are asked to configure a new...

Question 18

You have configured three logical tunnel interfaces in a tenant system on an SRX1500 device. When committing the configuration, the commit fails. In this scenario, what would cause this problem?
A) There is no GRE tunnel between the tenant system and master system allowing SSH traffic
B) There is no VPLS switch on the tenant system containing a peer It-0/0/0 interface
C) The SRX1500 device does not support more than two logical interfaces per tenant system
D) The SRX1500 device requires a tunnel PIC to allow for logical tunnel interfaces

Accepted Answer

The answer of You have configured three logical tunnel interfaces...

Question 19

You are asked to merge to corporate network with the network from a recently acquired company. Both networks use the same private IPv4 address space (172.25.126.0/24). An SRX Series device servers as the gateway for each network. Which solution allows you to merge the two networks without modifying the current address assignments?
A) persistent NAT
B) NAT46
C) source NAT
D) double NAT

Accepted Answer

Double NAT allows you to translate both the source and destination addresses, enabling the merging of two networks with overlapping IP address spaces without changing the existing address assignments.

Question 20

You are asked to secure your network against TOR network traffic. Which two Juniper products would accomplish this task? (Choose two.)
A) Contrail Edge
B) Contrail Insights
C) Juniper Sky ATP
D) Juniper ATP Appliance

Accepted Answer

Juniper Sky ATP and Juniper ATP Appliance are designed to provide advanced threat protection, which includes the ability to detect and block malicious traffic such as that originating from the TOR network.

Exam 10: Service Provider Routing and Switching, Specialist

Click the Exhibit button. The exhibit shows a snippet of a security flow trace. A user cannot open an SSH session to a server. Which action will solve the problem?

Click the Exhibit button. The IKE policy and proposal are configured properly on both devices as shown in the exhibit. Which configuration snippet will complete the IKE configuration on the branch SRX Series device?

Which feature of Sky ATP is deployed with Policy Enforcer?

Which three types of peer devices are supported for CoS-based IPsec VPNs? (Choose three.)

Click the Exhibit button. While configuring the SRX345, you review the MACsec connection between devices and note that it is not working. Referring to the exhibit, which action would you use to identify problem?

Which three roles or protocols are required when configuring an ADVPN? (Choose three.)

Click the Exhibit button. Referring to the exhibit, which two statements are true? (Choose two.)

Click the Exhibit button. You have configured tenant systems on your SRX Series device. Referring to the exhibit, which two actions should you take to facilitate inter-TSYS communication? (Choose two.)

Which interface family is required for Layer 2 transparent mode on SRX Series devices?

When would you use the port-overloading-factor 1 setting?

You are asked to implement the session cache feature on an SRX5400. In this scenario, what information does a session cache entry record? (Choose two.)

Click the Exhibit button. Referring to the exhibit, which statement is true?

Click the Exhibit button. You have recently committed the IPS policy shown in the exhibit. When evaluating the expected behavior, you notice that you have a session that matches all the rules in your IPS policy. In this scenario, which action would be taken?

You are asked to configure a new SRX Series CPE device at a remote office. The device must participate in forwarding MPLS and IPsec traffic. Which two statements are true regarding this implementation? (Choose two.)

You have configured three logical tunnel interfaces in a tenant system on an SRX1500 device. When committing the configuration, the commit fails. In this scenario, what would cause this problem?

You are asked to secure your network against TOR network traffic. Which two Juniper products would accomplish this task? (Choose two.)