Dumps for Free Juniper JN0-636 Practice Exam Questions [Nov 10, 2023]
JN0-636 Dumps PDF And Certification Training
NEW QUESTION # 45
Exhibit
The show network-access aaa radius-servers command has been issued to solve authentication issues.
Referring to the exhibit, to which two authentication servers will the SRX Series device continue to send requests? (Choose TWO)
- A. 192.168.30.188
- B. 192.168.30.191
- C. 192.168.30.190
- D. 200l:DB8:0:f101;:2
Answer: A,B
NEW QUESTION # 46
You are asked to determine if the 203.0.113.5 IP address has been added to the third-party security feed, DS hield, from Juniper Seclnte1. You have an SRX Series device that is using Seclnte1 feeds from Juniper ATP Cloud Which command will return this information?
- A. show security dynamic-address category-name CC | match 203.0.113.5
- B. show security dynamic-address category-name IPFilter I match 203.0.113.5
- C. show security dynamic-address category-name Infected-Hosts | match 203.0.113.5
- D. show Security dynamic-address category-name JWAS | match 203.0.113.5
Answer: D
NEW QUESTION # 47
Which feature of Sky ATP is deployed with Policy Enforcer?
- A. service redundancy daemon configuration support
- B. zero-day threat mitigation
- C. device inventory management
- D. software image snapshot support
Answer: B
NEW QUESTION # 48
Your organization has multiple Active Directory domains to control user access. You must ensure that security policies are passing traffic based upon the users' access rights.
What would you use to assist your SRX Series devices to accomplish this task?
- A. JSA
- B. JIMS
- C. JATP Appliance
- D. Junos Space
Answer: B
Explanation:
https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-user-auth- intergrated-user-firewall-overview.html
NEW QUESTION # 49
Exhibit
You are using ATP Cloud and notice that there is a host with a high number of ETI and C&C hits sourced from the same investigation and notice that some of the events have not been automatically mitigated.
Referring to the exhibit, what is a reason for this behavior?
- A. The ETI events are false positives.
- B. The infected host score is globally set bellow a threat level of 5.
- C. The C&C events are false positives.
- D. The infected host score is globally set above a threat level of 5.
Answer: A
NEW QUESTION # 50
Exhibit
Referring to the exhibit, an internal host is sending traffic to an Internet host using the 203.0.113.1 reflexive address with source port 54311.
Which statement is correct in this situation?
- A. Any host on the Internet can initiate traffic to reach the internal host using the 203.0.113.1 address, source port 54311, and a random destination port.
- B. Only the Internet host that the internal host originally communicated with can initiate traffic to reach the internal host using the 203.0.113.1 address, source port 54311, and a random destination port.
- C. Only the Internet host that the internal host originally communicated with can initiate traffic to reach the internal host using the 203.0 113.1 address, a random source port, and destination port 54311.
- D. Any host on the Internet can initiate traffic to reach the internal host using the 203.0.113.1 address, a random source port, and destination port 54311.
Answer: A
NEW QUESTION # 51
Exhibit
You are validating bidirectional traffic flows through your IPsec tunnel. The 4546 session represents traffic being sourced from the remote end of the IPsec tunnel. The 4547 session represents traffic that is sourced from the local network destined to the remote network.
Which statement is correct regarding the output shown in the exhibit?
- A. The remote gateway address for the IPsec tunnel is 10.20.20.2
- B. The local gateway address for the IPsec tunnel is 10.20.20.2
- C. The session information indicates that the IPsec tunnel has not been established
- D. NAT is being used to change the source address of outgoing packets
Answer: A
NEW QUESTION # 52
Exhibit
You are implementing filter-based forwarding to send traffic from the 172.25.0.0/24 network through ISP-1 while sending all other traffic through your connection to ISP-2. Your ge-0/0/1 interface connects to two networks, including the 172.25.0.0/24 network. You have implemented the configuration shown in the exhibit.
The traffic from the 172.25.0.0/24 network is being forwarded as expected to 172.20.0.2, however traffic from the other network (172.25.1.0/24) is not being forwarded to the upstream 172.21.0.2 neighbor.
In this scenario, which action will solve this problem?
- A. You must specify that the 172.25.1.1/24 IP address is the primary address on the ge-0/0/1 interface.
- B. You must add another term to the firewall filter to accept the traffic from the 172.25.1.0/24 network.
- C. You must create the static default route to neighbor 172.21 0.2 under the ISP-1 routing instance hierarchy.
- D. You must apply the firewall filter to the lo0 interface when using filter-based forwarding.
Answer: C
NEW QUESTION # 53
Exhibit
You have recently configured Adaptive Threat Profiling and notice 20 IP address entries in the monitoring section of the Juniper ATP Cloud portal that do not match the number of entries locally on the SRX Series device, as shown in the exhibit.
What is the correct action to solve this problem on the SRX device?
- A. Force a manual download of the Proxy__Nodes feed.
- B. You must configure the DAE in a security policy on the SRX device.
- C. Flush the DNS cache on the SRX device.
- D. Refresh the feed in ATP Cloud.
Answer: C
NEW QUESTION # 54
Exhibit
You are using traceoptions to verity NAT session information on your SRX Series device Referring to the exhibit, which two statements are correct? (Choose two.)
- A. This is the first packet in the session
- B. The SRX device is changing the destination address on this packet 10.0.1 1 to 172 20.101.10.
- C. The SRX device is changing the source address on this packet from
- D. This packet is part of an existing session.
Answer: A,B
NEW QUESTION # 55
You have the NAT rule, shown in the exhibit, applied to allow communication across an IPsec tunnel between your two sites with identical networks. Which statement is correct in this scenario?
- A. The NAT rule with translate the source and destination addresses.
- B. 10 packets have been processed by the NAT rule.
- C. The NAT rule will only translate two addresses at a time.
- D. The NAT rule in applied to the N/A routing instance.
Answer: A
NEW QUESTION # 56
Which statement is true about persistent NAT types?
- A. The target-host-port parameter cannot be used with IPv6 addresses in NAT64
- B. The target-host parameter cannot be used with IPv6 addressee in NAT64.
- C. The target-host parameter cannot be used with IPv4 addresses inNAT46
- D. The target-host-port parameter cannot be used with IPv4 addresses in NAT46.
Answer: C
NEW QUESTION # 57
You are asked to allocate security profile resources to the interconnect logical system for it to work properly.
In this scenario, which statement is correct?
- A. The NAT resources must be defined in the security profile for the interconnect logical system.
- B. The resources must be calculated based on the amount of traffic that will flow between the logical systems.
- C. No resources are needed to be allocated to the interconnect logical system.
- D. The flow-session resource must be defined in the security profile for the interconnect logical system.
Answer: B
NEW QUESTION # 58
You are connecting two remote sites to your corporate headquarters site; you must ensure that all traffic is secured and only uses a single Phase 2 SA for both sites.
In this scenario, which VPN should be used?
- A. Full mesh IPsec VPNs with tunnels between all sites.
- B. An IPsec group VPN with the corporate firewall acting as the hub device.
- C. A hub-and-spoke IPsec VPN with the corporate firewall acting as the hub device.
- D. A full mesh Layer 3 VPN with the corporate firewall acting as the hub device.
Answer: B
Explanation:
https://www.juniper.net/us/en/local/pdf/app-notes/3500202-en.pdf
NEW QUESTION # 59
Exhibit
You configure Source NAT using a pool of addresses that are in the same subnet range as the external ge-0/0/0 interface on your vSRX device. Traffic that is exiting the internal network can reach external destinations, but the return traffic is being dropped by the service provider router.
Referring to the exhibit, what must be enabled on the vSRX device to solve this problem?
- A. Proxy ARP
- B. DNS Doctoring
- C. STUN
- D. Persistent NAT
Answer: B
NEW QUESTION # 60
Exhibit
You are not able to ping the default gateway of 192.168 100 1 (or your network that is located on your SRX Series firewall.
Referring to the exhibit, which two commands would correct the configuration of your SRX Series device? (Choose two.) A)
B)
C)
D)
- A. Option D
- B. Option B
- C. Option A
- D. Option C
Answer: D
NEW QUESTION # 61
You are asked to ensure that your IPS engine blocks attacks. You must ensure that your system continues to drop additional malicious traffic without additional IPS processing for up to 30 minutes. You must ensure that the SRX Series device does send a notification packet when the traffic is dropped.
Which statement is correct?
- A. Use the IP-Close action.
- B. Use the Drop Connection action.
- C. Use the Drop Packet action.
- D. Use the IP-Block action.
Answer: A
NEW QUESTION # 62
Which two additional configuration actions are necessary for the third-party feed shown in the exhibit to work properly? (Choose two.)
- A. You must create a dynamic address entry with the C&C category and the cc_offic365 value.
- B. You must apply the dynamic address entry in a security intelligence policy.
- C. You must create a dynamic address entry with the IP filter category and the ipfilter_office365 value.
- D. You must apply the dynamic address entry in a security policy.
Answer: C,D
NEW QUESTION # 63
In Juniper ATP Cloud, what are two different actions available in a threat prevention policy to deal with an infected host? (Choose two.)
- A. Close the connection.
- B. Send a custom message
- C. Drop the connection silently.
- D. Quarantine the host.
Answer: C,D
NEW QUESTION # 64
An administrator wants to configure an SRX Series device to log binary security events for tenant systems.
Referring to the exhibit, which statement would complete the configuration?
- A. Configure the tenant as TSYS1 for the pi security profile.
- B. Configure the tenant as local for the pi security profile
- C. Configure the tenant as master for the pi security profile.
- D. Configure the tenant as root for the pi security profile.
Answer: D
NEW QUESTION # 65
You have set up Security Director with Policy Enforcer and have configured 12 third-party feeds and a Sky ATP feed. You are also injecting 16 feeds using the available open API. You want to add another compatible feed using the available open API, but Policy Enforcer is not receiving the new feed.
What is the problem in this scenario?
- A. You have reached the maximum limit of 29 total feeds
- B. You cannot add more than 16 feeds with the available open API
- C. You must wait 48 hours for the feed to update
- D. You cannot add more than 16 feeds through the available open API
Answer: A
Explanation:
https://www.juniper.net/documentation/en_US/release-independent/sky-atp/information- products/pathway-pages/sky-atp-admin-guide.pdf page 110
NEW QUESTION # 66
You must implement an IPsec VPN on an SRX Series device using PKI certificates for authentication. As part of the implementation, you are required to ensure that the certificate submission, renewal, and retrieval processes are handled automatically from the certificate authority.
In this scenario, which statement is correct.
- A. You can use CRL to accomplish this behavior.
- B. You can use SPKI to accomplish this behavior.
- C. You can use SCEP to accomplish this behavior.
- D. You can use OCSP to accomplish this behavior.
Answer: C
Explanation:
Certificate Renewal The renewal of certificates is much the same as initial certificate enrollment except you are just replacing an old certificate (about to expire) on the VPN device with a new certificate. As with the initial certificate request, only manual renewal is supported. SCEP can be used to re-enroll local certificates automatically before they expire. Refer to Appendix D for more details.
NEW QUESTION # 67
Exhibit
Referring to the exhibit, a spoke member of an ADVPN is not functioning correctly.
Which two commands will solve this problem? (Choose two.)
A)
B)
C)
D)
- A. Option D
- B. Option B
- C. Option A
- D. Option C
Answer: D
NEW QUESTION # 68
Your Source NAT implementation uses an address pool that contains multiple IPv4 addresses.
Your users report that when they establish more than one session with an external application, they are prompted to authenticate multiple times External hosts must not be able to establish sessions with internal network hosts.
What will solve this problem?
- A. Enable address persistence.
- B. Enable persistent NAT
- C. Enable destination NAT.
- D. Disable PAT.
Answer: B
NEW QUESTION # 69
......
Check your preparation for Juniper JN0-636 On-Demand Exam: https://www.testpassking.com/JN0-636-exam-testking-pass.html
Practice Exam JN0-636 Realistic Dumps Verified Questions: https://drive.google.com/open?id=1chfwly03-Vg98ujkYtBZfAvq6ikBy4Fk