Question 1

You are trying to get a SSH honeypot set up on a Juniper ATP Appliance collector. The collector is running on hardware with two physical interfaces and two physical CPU cores. The honeypot feature is not working. Which statement is true in this scenario?
A) The collector must have at least three physical interfaces
B) The collector must have at least four physical cores
C) The collector must have at least four physical interfaces
D) The collector must have at least six physical cores

Accepted Answer

The Juniper ATP Appliance collector requires at least three physical interfaces to set up a SSH honeypot, as one interface is typically used for management and the others for honeypot traffic.

Question 2

Click the Exhibit button.  You have configured tenant systems on your SRX Series device. Referring to the exhibit, which two actions should you take to facilitate inter-TSYS communication? (Choose two.)
A) Place the logical tunnel interfaces in a virtual router routing instance in the interconnect switch
B) Place the logical tunnel interfaces in a VPLS routing instance in the interconnect switch
C) Connect each TSYS with the interconnect switch by configuring INET configured logical tunnel interfaces in the interconnect switch
D) Connect each TSYS with the interconnect switch by configuring Ethernet VPLS configured logical tunnel interfaces in the interconnect switch

Accepted Answer

The answer of Click the Exhibit button.  You have...

Question 3

Which interface family is required for Layer 2 transparent mode on SRX Series devices?
A) LLDP
B) Ethernet switching
C) inet
D) VPLS

Accepted Answer

Layer 2 transparent mode on SRX Series devices requires the Ethernet switching interface family, as it allows the device to pass traffic between interfaces without performing any Layer 3 routing or processing. LLDP is a protocol used for discovering network topology, inet is the interface family used for Layer 3 routing, and VPLS is a technology used for creating Layer 2 VPNs.

Question 4

Click the Exhibit button.  A user reports trouble when using SSH to a server outside your organization. The traffic traverses an SRX Series device that is performing NAT and applying security policies. Referring to the exhibit, which configuration will allow you to see the bidirectional flow through the SRX Series device?
A) 
B) 
C) 
D)

Accepted Answer

The answer of Click the Exhibit button.  A user...

Question 5

Click the Exhibit button.  You are asked to look at a configuration that is designed to take all traffic with a specific source IP address and forward the traffic to a traffic analysis server for further evaluation. The configuration is not working as intended. Referring to the exhibit, which change must be made to correct the configuration?
A) Apply the filter as an input filter on interface xe-0/2/1.0
B) Create a routing instance named default
C) Apply the filter as an input filter on interface xe-0/0/1.0
D) Apply the filter as an output filter on interface xe-0/1/0.0

Accepted Answer

The answer of Click the Exhibit button.  You are...

Question 6

You have configured three logical tunnel interfaces in a tenant system on an SRX1500 device. When committing the configuration, the commit fails. In this scenario, what would cause this problem?
A) There is no GRE tunnel between the tenant system and master system allowing SSH traffic
B) There is no VPLS switch on the tenant system containing a peer It-0/0/0 interface
C) The SRX1500 device does not support more than two logical interfaces per tenant system
D) The SRX1500 device requires a tunnel PIC to allow for logical tunnel interfaces

Accepted Answer

The answer of You have configured three logical tunnel interfaces...

Question 7

Click the Exhibit button.  A user is trying to reach a company's website, but the connection errors out. The security policies are configured correctly. Referring to the exhibit, what is the problem?
A) Persistent NAT must be enabled
B) The action for rule 1 must change to static-nat inet The action for rule 1 must change to static-nat inet
C) DNS ALG must be disabled
D) Static NAT is missing a rule for DNS server

Accepted Answer

The answer of Click the Exhibit button.  A user...

Question 8

Click the Exhibit button.  Referring to the exhibit, what is the maximum number of zones that are able to be created within all logical systems?
A) 74
B) 34
C) 40
D) 17

Accepted Answer

The answer of Click the Exhibit button.  Referring to...

Question 9

You are asked to configure an SRX Series device to bypass all security features for IP traffic from the engineering department. Which firewall filter will accomplish this task?
A) 
B) 
C) 
D)

Accepted Answer

The answer of You are asked to configure an SRX...

Question 10

You are asked to configure a new SRX Series CPE device at a remote office. The device must participate in forwarding MPLS and IPsec traffic. Which two statements are true regarding this implementation? (Choose two.)
A) Host inbound traffic must not be processed by the flow module
B) Host inbound traffic must be processed by the flow module
C) The SRX Series device can process both MPLS and IPsec with default traffic handling
D) A firewall filter must be configured to enable packet mode forwarding

Accepted Answer

The answer of You are asked to configure a new...

Question 11

Click the Exhibit button.  Referring to the exhibit, which two statements are true? (Choose two.)
A) You can secure intra-VLAN traffic with a security policy on this device
B) You can secure inter-VLAN traffic with a security policy on this device
C) The device can pass Layer 2 and Layer 3 traffic at the same time
D) The device cannot pass Layer 2 and Layer 3 traffic at the same time

Accepted Answer

The answer of Click the Exhibit button.  Referring to...

Question 12

Click the Exhibit button.  You deployed a site-to-site IPsec VPN connecting two data centers together using SRX5800s. After examining the performance of the IPsec VPN, you decide to enable IPsec performance acceleration to increase the rate of traffic that can be sent through the tunnel. Referring to the exhibit, which two statements should you add to the configuration to accomplish this task? (Choose two.)
A) [edit security flow] user@srx# set tcp-mss ipsec-vpn mss 65535
B) user@srx# set ipsec-performance-acceleration
C) user@srx# set power-mode-ipsec
D) user@srx# set load-distribution session-affinity ipsec

Accepted Answer

The answer of Click the Exhibit button.  You deployed...

Question 13

Which three roles or protocols are required when configuring an ADVPN? (Choose three.)
A) OSPF
B) shortcut partner
C) shortcut suggester
D) IKEv1
E) BGP

Accepted Answer

The answer of Which three roles or protocols are required...

Question 14

You are asked to merge to corporate network with the network from a recently acquired company. Both networks use the same private IPv4 address space (172.25.126.0/24). An SRX Series device servers as the gateway for each network. Which solution allows you to merge the two networks without modifying the current address assignments?
A) persistent NAT
B) NAT46
C) source NAT
D) double NAT

Accepted Answer

The answer of You are asked to merge to corporate...

Question 15

Which feature of Sky ATP is deployed with Policy Enforcer?
A) zero-day threat mitigation
B) software image snapshot support
C) device inventory management
D) service redundancy daemon configuration support

Accepted Answer

Policy Enforcer is a feature of Sky ATP that provides network enforcement of security policies. It includes technologies for zero-day threat mitigation, such as file reputation analysis, advanced malware analysis, and behavior-based analysis. Therefore, the correct feature deployed with Policy Enforcer is A) zero-day threat mitigation.

Question 16

When would you use the port-overloading-factor 1 setting?
A) to enable the port-overloading
B) to disable the port-overloading
C) to map ports with 1:1 ratio for port-overloading
D) to set the maximum port-overloading capacity to 65,536

Accepted Answer

The port-overloading-factor 1 setting will disable port-overloading, meaning that each internal address can only map to a single external port.

Question 17

Click the Exhibit button.  Referring to the exhibit, which statement is true?
A) Source NAT with PAT is occurring
B) Destination NAT is occurring
C) Static NAT without PAT is occurring
D) Source NAT without PAT is occurring

Accepted Answer

The answer of Click the Exhibit button.  Referring to...

Question 18

You are asked to implement the session cache feature on an SRX5400. In this scenario, what information does a session cache entry record? (Choose two.)
A) The type of processing to do for ingress traffic
B) The type of processing to do for egress traffic
C) To which SPU the traffic of the session should be forwarded
D) To which NPU the traffic of the session should be forwarded

Accepted Answer

The answer of You are asked to implement the session...

Question 19

You are asked to configure an IPsec VPN between two SRX Series devices that allows for processing of CoS on the intermediate routers. What will satisfy this requirement?
A) route-based VPN
B) OpenVPN
C) remote access VPN
D) policy-based VPN

Accepted Answer

A route-based VPN is required because it allows for the use of CoS (Class of Service) by creating a virtual tunnel interface, which can be used to apply CoS policies on the traffic passing through the VPN.

Question 20

You must troubleshoot ongoing problems with IPsec tunnels and security policy processing. Your network consists of SRX340s and SRX5600s. In this scenario, which two statements are true? (Choose two.)
A) IPsec logs are written to the kmd log file by default
B) IKE logs are written to the messages log file by default
C) You must enable data plane logging on the SRX340 devices to generate security policy logs
D) You must enable data plane logging on the SRX5600 devices to generate security policy logs

Accepted Answer

The answer of You must troubleshoot ongoing problems with IPsec...

Exam 10: Service Provider Routing and Switching, Specialist

You are trying to get a SSH honeypot set up on a Juniper ATP Appliance collector. The collector is running on hardware with two physical interfaces and two physical CPU cores. The honeypot feature is not working. Which statement is true in this scenario?

Click the Exhibit button. You have configured tenant systems on your SRX Series device. Referring to the exhibit, which two actions should you take to facilitate inter-TSYS communication? (Choose two.)

Which interface family is required for Layer 2 transparent mode on SRX Series devices?

You have configured three logical tunnel interfaces in a tenant system on an SRX1500 device. When committing the configuration, the commit fails. In this scenario, what would cause this problem?

Click the Exhibit button. A user is trying to reach a company's website, but the connection errors out. The security policies are configured correctly. Referring to the exhibit, what is the problem?

Click the Exhibit button. Referring to the exhibit, what is the maximum number of zones that are able to be created within all logical systems?

You are asked to configure an SRX Series device to bypass all security features for IP traffic from the engineering department. Which firewall filter will accomplish this task?

You are asked to configure a new SRX Series CPE device at a remote office. The device must participate in forwarding MPLS and IPsec traffic. Which two statements are true regarding this implementation? (Choose two.)

Click the Exhibit button. Referring to the exhibit, which two statements are true? (Choose two.)

Which three roles or protocols are required when configuring an ADVPN? (Choose three.)

Which feature of Sky ATP is deployed with Policy Enforcer?

When would you use the port-overloading-factor 1 setting?

Click the Exhibit button. Referring to the exhibit, which statement is true?

You are asked to implement the session cache feature on an SRX5400. In this scenario, what information does a session cache entry record? (Choose two.)

You are asked to configure an IPsec VPN between two SRX Series devices that allows for processing of CoS on the intermediate routers. What will satisfy this requirement?

You must troubleshoot ongoing problems with IPsec tunnels and security policy processing. Your network consists of SRX340s and SRX5600s. In this scenario, which two statements are true? (Choose two.)