JN0-633 Online Practice Questions and Answers

You have just created a few hundred application firewall rules on an SRX device and applied them to the appropriate firewall polices. However, you are concerned that the SRX device might become overwhelmed with the increased processing required to process traffic through the application firewall rules.

Which three actions will help reduce the amount of processing required by the application firewall rules? (Choose three.)

A. Use stateless firewall filtering to block the unwanted traffic.

B. Implement AppQoS to drop the unwanted traffic.

C. Implement screen options to block the unwanted traffic.

D. Implement IPS to drop the unwanted traffic.

E. Use security policies to block the unwanted traffic.

You have been asked to configure traffic to flow between two virtual routers (VRs) residing on two unique

logical systems (LSYSs) on the same SRX5800.

How would you accomplish this task?

A. Configure a security policy that contains the context from VR1 to VR2 to permit the relevant traffic.

B. Configure a security policy that contains the context from LSYS1 to LSYS2 and relevant match conditions in the rule set to allow traffic between the IP networks in VR1 and VR2.

C. Configure logical tunnel interfaces between VR1 and VR2 and security policies that allow relevant traffic between VR1 and VR2 over that link.

D. Configure an interconnect LSYS to facilitate a connection between LSYS1 and LSYS2 and relevant policies to allow the traffic.

You are using logical systems to segregate customers. You have a requirement to enable communication between the logical systems. What are two ways to accomplish this goal? (Choose two.)

A. Use a shared DMZ zone to connect the logical systems together.

B. Use a virtual tunnel (vt-) interface to connect the logical systems together.

C. Use an external cable to connect the ports from the two logical systems.

D. Use an interconnect LSYS to connect the logical systems together.

You are asked to implement IPsec tunnels between your SRX devices located at various locations. You will use the public key infrastructure (PKI) to verify the identification of the endpoints. What are two certificate enrollment options available for this deployment? (Choose two.)

A. Manually generating a PKCS10 request and submitting it to an authorized CA.

B. Dynamically generating and sending a certificate request to an authorized CA using OCSP.

C. Manually generating a CRL request and submitting that request to an authorized CA.

D. Dynamically generating and sending a certificate request to an authorized CA using SCEP.

You have an existing group VPN established in your internal network using the group-id 1. You have been asked to configure a second group using the group-id 2. You must ensure that the key server for group 1 participates in group 2 but is not the key server for that group. Which statement is correct regarding the group configuration on the current key server for group 1?

A. You must configure both groups at the [edit security ipsec vpn] hierarchy.

B. You must configure both groups at the [edit security group-vpn member] hierarchy.

C. You must configure both groups at the [edit security ike] hierarchy.

D. You must configure both groups at the [edit security group-vpn] hierarchy.

For an SRX chassis cluster in transparent mode, which action occurs to signal a high availability failover to neighboring switches?

A. the SRX chassis cluster generates Spanning Tree messages

B. the SRX chassis cluster generates gratuitous ARPs

C. the SRX chassis cluster flaps the former active interfaces

D. the SRX chassis cluster uses IP address monitoring

Click the Exhibit button.

Host traffic is traversing through an IPsec tunnel. Users are complaining of intermittent issues with their

connection.

Referring to the exhibit, what is the problem?

Exhibit:

A. The tunnel is down due to a configuration change.

B. The do-not-fragment bit is copied to the tunnel header.

C. The MSS option on the SYN packet is set to 1300.

D. The TCP SYN check option is disabled for tunnel traffic.

user@host> show interfaces routing-instance all ge* terse Interface Admin Link Proto Local Instance ge-0/0/0.0 up up inet 172.16.12.205/24 default ge-0/0/1.0 up up inet 5.0.0.5/24

iso A ge-0/0/2.0 up up inet 25.0.0.5/24 iso B

user@host> show security flow session

Session ID: 82274, Policy name: default-policy-00/2, Timeout: 1770, Valid In: 5.0.0.25/61935 --> 25.0.0.25/23;tcp, If: ge-0/0/1.0, Pkts: 31, Bytes: 1781 Out: 25.0.0.25/23 --> 5.0.0.25/61935;tcp, If: ge-0/0/2.0, Pkts: 23, Bytes: 1452

Total sessions: 3

user@host> show route

inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, + = Both

0.0.0.0/0 *[Static/5] 04:08:52 > to 172.16.12.1 via ge-0/0/0.0 172.16.12.0/24 *[Direct/0] 04:08:52 via ge-0/0/0.0 172.16.12.205/32 *[Local/0] 4w4d 23:04:29 Loca1 via ge-0/0/0.0 224.0.0.5/32 *[OSPF/10] 14:37:35, metric 1 MultiRecv

A.inet.0: 4 destinations, 4 routes {4 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both

5.0.0.0/24 5 *[Direct/0] 00:05:04 > via ge-0/0/1.0 5.0.0.5/32 *[Local/0] 00:05:04 Local via ge-0/0/1.0 25.0.0.0/24 *[Direct/0] 00:02:37 > via ge-0/0/2.0

B.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both

5.0.0.25/32 *[Static/5] 00:02:38 to table A.inet.0 25.0.0.0/24 *[Direct/0] 00:02:37 > via ge-0/0/2.0 25.0.0.5/32 *[Local/0] 00:02:37 Local via ge-0/0/2.0

A. The routing instances A and B are connected using an lt interface.

B. Routing instance A's routes are shared with routing instance B.

C. Routing instance B's routes are shared with routing instance A.

D. The routing instances A and B are connected using a vt interface.

Click the Exhibit button.

Traffic is being sent from Host-1 to Host-2 through an IPsec VPN. In this process, SRX-2 is using NAT to change the destination address of Host-2 from 192.168.1.1 to 10.60.60.1 SRX-1 uses the 172.31.50.1 address for its tunnel endpoint and SRX-2 uses the 10.10.50.1 address for its tunnel endpoint.

Referring to the exhibit, which statement is true?

Exhibit:

A. The security policy on SRX-2 must permit traffic from the 172.31.50.1 destination address.

B. The security policy on SRX-2 must permit traffic from the 10.10.50.1destination address.

C. The security policy on SRX-2 must permit traffic from the 10.60.60.1 destination address.

D. The security policy on SRX-2 must permit traffic from the 192.168.1.1destination address.

You are asked to ensure that your IPS engine blocks attacks. You must ensure that your system continues to drop additional malicious traffic without additional IPS processing for up to 30 minutes. You must ensure that the SRX Series device does send a notification packet when the traffic is dropped.

Which statement is correct?

A. Use the IP-Block action.

B. Use the Drop Packet action.

C. Use the Drop Connection action.

D. Use the IP-Close action.