[Jan 30, 2024] Valid JN0-335 Test Answers & JN0-335 Exam PDF
Valid JNCIS-SEC JN0-335 Dumps Ensure Your Passing
NEW QUESTION # 30
Which two statements are correct about security policy changes when using the policy rematch feature? (Choose two.)
- A. When a policy change includes changing the policy's action from permit to deny, all existing sessions are maintained
- B. When a policy change includes changing the policy's source or destination address match condition, all existing sessions are dropped.
- C. When a policy change includes changing the policy's action from permit to deny, all existing sessions are dropped.
- D. When a policy change includes changing the policy's source or destination address match condition, all existing sessions are reevaluated.
Answer: C,D
Explanation:
Policy rematch is a feature that enables the device to reevaluate an active session when its associated security policy is modified. The session remains open if it still matches the policy that allowed the session initially. The session is closed if its associated policy is renamed, deactivated, or deleted.
NEW QUESTION # 31
You want to show interface-specific zone information and statistics. Which operational command would be used to accomplish this?
- A. show interfaces terse
- B. show interfaces ge-0/0/3.0 extensive
- C. show security zones detail
- D. show interfaces ge-0/0/3.0
Answer: B
NEW QUESTION # 32
You want to collect events and flows from third-party vendors.
Which solution should you deploy to accomplish this task?
- A. Policy Enforcer
- B. JSA
- C. Log Director
- D. Contrail
Answer: B
NEW QUESTION # 33
You are building a VPN tunnel between two SRX Series devices. You want the tunnel to always be established, even if there is no traffic to send. Which action would be used to achieve this goal?
- A. Configure an RPM probe to constantly ping across the links.
- B. Configure establish-tunnels with the immediately parameter.
- C. Configure the OSPF demand-circuit feature on the tunnel interface.
- D. Configure vpn-monitor with the optimized parameter on the tunnel.
Answer: B
NEW QUESTION # 34
You administer a JSA host and want to include a rule that sets a threshold for excessive firewall denies and sends an SNMP trap after receiving related syslog messages from an SRX Series firewall.
Which JSA rule type satisfies this requirement?
- A. common
- B. event
- C. flow
- D. offense
Answer: B
Explanation:
To include a rule that sets a threshold for excessive firewall denies and sends an SNMP trap after receiving related syslog messages from an SRX Series firewall, you need to use an event rule type in JSA. An event rule type allows you to create custom rules based on the events that are collected and normalized by JSA from various sources, such as firewalls, routers, switches, servers, and so on. You can define the conditions, tests, and actions for an event rule, such as matching a specific event name, setting a threshold for the number of occurrences, and sending an SNMP trap to a specified host. Reference := Creating a Custom Rule, Customizing the SNMP Trap Output
NEW QUESTION # 35
Which solution should you use if you want to detect known attacks using signature-based methods?
- A. IPS
- B. SSL proxy
- C. JIMS
- D. ALGs
Answer: A
NEW QUESTION # 36
Exhibit
You just finished setting up your command-and-control (C&C) category with Juniper ATP Cloud. You notice that all of the feeds have zero objects in them.
Which statement is correct in this scenario?
- A. Set the maximum C&C entries within the Juniper ATP Cloud GUI.
- B. The security intelligence policy must be configured; on a unified security policy
- C. No action is required, the feeds take a few minutes to download.
- D. Use the commit full command to start the download.
Answer: C
Explanation:
According to the Juniper Networks JNCIS-SEC Study Guide, when you set up your command-and-control (C&C) category with Juniper ATP Cloud, all of the feeds will initially have zero objects in them. This is normal, as it can take a few minutes for the feeds to download. No action is required in this scenario and you will notice the feeds start to populate with objects once the download is complete.
NEW QUESTION # 37
When referencing a SSL proxy profile in a security policy, which two statements are correct? (Choose two.)
- A. If you apply an SSL proxy profile to a security policy and forget to apply any Layer7 services to the security policy, any encrypted traffic that matches the security policy is not decrypted.
- B. A security policy can reference both a client-protection SSL proxy profile and a server-protection proxy profile.
- C. If you apply an SSL proxy profile to a security policy and forget to apply any Layer7 services to the security policy, any encrypted traffic that matches the security policy is decrypted.
- D. A security policy can only reference a client-protection SSL proxy profile or a server-protection SSL proxy profile.
Answer: A,D
NEW QUESTION # 38
Exhibit
Referring to the exhibit, which two statements describe the type of proxy used? (Choose two.)
- A. client protection proxy
- B. server protection proxy
- C. reverse proxy
- D. forward proxy
Answer: A,B
Explanation:
B) Client protection proxy: This statement is correct because a forward proxy can also be called a client protection proxy since it protects the user's identity and computer information from the web server4.
C) Server protection proxy: This statement is correct because a reverse proxy can also be called a server protection proxy since it protects the web server's identity and location from the user4.
NEW QUESTION # 39
Which three statements about SRX Series device chassis clusters are true? (Choose three.)
- A. Recovery from a control link failure requires that the secondary member device be rebooted.
- B. Chassis cluster member devices synchronize configuration using the control link.
- C. Chassis cluster control links must be configured using RFC 1918 IP addresses.
- D. Heartbeat messages verify that the chassis cluster control link is working.
- E. A control link failure causes the secondary cluster node to be disabled.
Answer: B,D,E
Explanation:
1. Chassis cluster member devices synchronize configuration using the control link: This statement is correct because the control link is used for configuration synchronization among other functions.
2. A control link failure causes the secondary cluster node to be disabled: This statement is correct because a control link failure causes the secondary node to become ineligible for primary role and remain in secondary role until the control link is restored.
3. Heartbeat messages verify that the chassis cluster control link is working: This statement is correct because heartbeat messages are sent periodically over the control link to monitor its status.
NEW QUESTION # 40
Referring to the exhibit, which statement is true?
- A. IDP blocks all users.
- B. IDP ignores the connection on matched sessions.
- C. IDP closes the connection on matched sessions.
- D. IDP blocks root users.
Answer: B
NEW QUESTION # 41
How does the SSL proxy detect if encryption is being used?
- A. It uses application identity services.
- B. It looks at the destination port number.
- C. It queries the client device.
- D. It verifies the length of the packet
Answer: B
Explanation:
The SSL proxy can detect if encryption is being used by looking at the destination port number of the packet. If the port number is 443, then the proxy can assume that the packet is being sent over an encrypted connection. If the port number is different, then the proxy can assume that the packet is not encrypted. For more information, please refer to the Juniper Networks JNCIS-SEC Study Guide.
Reference:
The SSL proxy is a security feature that provides visibility and control over SSL/TLS encrypted traffic. When SSL proxy is enabled, it intercepts SSL/TLS traffic and decrypts it to allow visibility into the content of the encrypted traffic. However, before decrypting the traffic, the SSL proxy must first determine if the traffic is encrypted.
To detect if encryption is being used, the SSL proxy looks at the destination port number. If the destination port number is a known SSL/TLS port (e.g., TCP port 443), the SSL proxy assumes that encryption is being used and intercepts the traffic. If the destination port is not a known SSL/TLS port, the SSL proxy does not intercept the traffic and allows it to pass through the device unmodified.
NEW QUESTION # 42
What are two types of system logs that Junos generates? (Choose two.)
- A. data plane logs
- B. control plane logs
- C. system core dump files
- D. SQL log files
Answer: A,B
Explanation:
The two types of system logs that Junos generates are control plane logs and data plane logs.
Control plane logs are generated by the Junos operating system and contain system-level events such as system startup and shutdown, configuration changes, and system alarms. Data plane logs are generated by the network protocol processes and contain messages about the status of the network and its components, such as routing, firewall, NAT, and IPS. SQL log files and system core dump files are not types of system logs generated by Junos.
NEW QUESTION # 43
Which two statements describe application-layer gateways (ALGs)? (Choose two.)
- A. ALGs are designed for specific protocols that use a single TCP session.
- B. ALGs can only be configured using Security Director.
- C. ALGs are used with protocols that use multiple ports.
- D. ALGs are designed for specific protocols that require multiple sessions.
Answer: C,D
NEW QUESTION # 44
Which two settings must be enabled on the hypervisor in a vSRX deployment to ensure proper chassis cluster operation? (Choose two.)
- A. Fabric links must have an MTU of 9000.
- B. Control links must have an MTU of 9000.
- C. Control links must operate in promiscuous mode.
- D. Fabric links must operate in promiscuous mode.
Answer: A,C
NEW QUESTION # 45
Which two statements are correct when considering IPS rule base evaluation? (Choose two.)
- A. IPS evaluates rules concurrently.
- B. IPS applies the least severe action to traffic matching multiple rules.
- C. IPS applies the most severe action to traffic matching multiple rules,
- D. IPS evaluates rules sequentially
Answer: A,C
Explanation:
Reference:
The Intrusion Prevention System (IPS) is a feature that provides protection against network-based threats. The IPS uses a rule base to evaluate network traffic and apply actions based on the rules that match the traffic.
When evaluating the rule base, the IPS evaluates the rules concurrently (option A). This means that the IPS can apply multiple rules to the same traffic simultaneously.
If multiple rules match the same traffic, the IPS applies the most severe action (option B). This means that if there are conflicting actions specified in different rules, the IPS will apply the action that has the highest severity. For example, if one rule specifies a "drop" action and another rule specifies a "log" action for the same traffic, the IPS will drop the traffic because dropping has a higher severity than logging.
NEW QUESTION # 46
When a security policy is deleted, which statement is correct about the default behavior of active sessions allowed by that policy?
- A. The active sessions allowed by the policy will be dropped.
- B. The active sessions allowed by the policy will continue
- C. The active sessions allowed by the policy will be marked as a legacy flow and will continue to be forwarded.
- D. The active sessions allowed by the policy will be reevaluated by the cached
Answer: A
Explanation:
When a security policy is deleted, the active sessions allowed by the policy will be dropped. The default behavior is that all active sessions allowed by the policy will be terminated and the traffic will no longer be forwarded. There is no way to mark the active sessions as a legacy flow or to reevaluate them by the cached rules.
Reference:
According to Juniper Networks Security, Specialist (JNCIS-SEC) Study Guide, when a security policy is deleted, the active sessions allowed by that policy will be dropped. This behavior is the default behavior of the device. There is no way to mark the active sessions as a legacy flow or to re-evaluate them against cached rules. The device will terminate the active sessions and will no longer forward traffic for those sessions.
NEW QUESTION # 47
Which two session parameters would be used to manage space on the session table? (Choose two.)
- A. high watermark
- B. low watermark
- C. TCP MSS
- D. TCP RST
Answer: A,B
Explanation:
https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-flow-based- session-for-srx-series-devices.html
NEW QUESTION # 48
You need to implement Junos Screen options to protect traffic coming through the ge-0/0/0 and ge-0/0/1 interfaces which are located in the trust and DMZ zones, respectively. Where would you enable the Junos Screen options?
- A. in the trust and DMZ zone settings
- B. on the ge-0/0/0 and ge-0/0/1 interfaces
- C. in the global security zone settings
- D. in a security policy
Answer: A
NEW QUESTION # 49
Which two statements describe JSA? (Choose two.)
- A. JSA can be used as a log node with Security Director or as a standalone solution.
- B. Security Director must be used to view third-party events rom JSA flow collectors.
- C. JSA events must be manually imported into Security Directory using an SSH connection.
- D. JSA supports events and flows from Junos devices, including third-party devices.
Answer: A,D
NEW QUESTION # 50
Click the Exhibit button.
Which two statements describe the output shown in the exhibit? (Choose two.)
- A. Node 1 is passing traffic for redundancy group1.
- B. Node 0 is passing traffic for redundancy group 1.
- C. Redundancy group 1 experienced an operational failure.
- D. Redundancy group 1 was administratively failed over.
Answer: A,D
NEW QUESTION # 51
You want to support reth LAG interfaces on a chassis cluster. What must be enabled on the interconnecting switch to accomplish this task?
- A. RSTP
- B. 802.3ad
- C. swfab
- D. LLDP
Answer: B
Explanation:
https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-chassis-cluster- redundant-ethernet-lag-interfaces.html
NEW QUESTION # 52
What are two types of system logs that Junos generates? (Choose two.)
- A. data plane logs
- B. control plane logs
- C. system core dump files
- D. SQL log files
Answer: A,B
Explanation:
The two types of system logs that Junos generates are control plane logs and data plane logs. Control plane logs are generated by the Junos operating system and contain system-level events such as system startup and shutdown, configuration changes, and system alarms. Data plane logs are generated by the network protocol processes and contain messages about the status of the network and its components, such as routing, firewall, NAT, and IPS. SQL log files and system core dump files are not types of system logs generated by Junos.
NEW QUESTION # 53
......
JN0-335 Dumps Real Exam Questions Test Engine Dumps Training: https://www.dumpsactual.com/JN0-335-actualtests-dumps.html
JN0-335 exam dumps and online Test Engine: https://drive.google.com/open?id=1bU-5-2YvYEtVM4fOv_F5lWLfWrjniEsY
