JN0-636 Online Practice Questions and Answers

Exhibit

Referring to the exhibit, an internal host is sending traffic to an Internet host using the 203.0.113.1 reflexive address with source port 54311. Which statement is correct in this situation?

A. Only the Internet host that the internal host originally communicated with can initiate traffic to reach the internal host using the 203.0.113.1 address, source port 54311, and a random destination port.

B. Only the Internet host that the internal host originally communicated with can initiate traffic to reach the internal host using the 203.0 113.1 address, a random source port, and destination port 54311.

C. Any host on the Internet can initiate traffic to reach the internal host using the 203.0.113.1 address, source port 54311, and a random destination port.

D. Any host on the Internet can initiate traffic to reach the internal host using the 203.0.113.1 address, a random source port, and destination port 54311.

You want to enroll an SRX Series device with Juniper ATP Appliance. There is a firewall device in the path between the devices. In this scenario, which port should be opened in the firewall device?

A. 8080

B. 443

C. 80

D. 22

Click the Exhibit button.

When attempting to enroll an SRX Series device to JATP, you receive the error shown in the exhibit. What is the cause of the error?

A. The fxp0 IP address is not routable

B. The SRX Series device certificate does not match the JATP certificate

C. The SRX Series device does not have an IP address assigned to the interface that accesses JATP

D. A firewall is blocking HTTPS on fxp0

Exhibit

You are implementing filter-based forwarding to send traffic from the 172.25.0.0/24 network through ISP-1 while sending all other traffic through your connection to ISP-2. Your ge- 0/0/1 interface connects to two networks, including the 172.25.0.0/24 network. You have implemented the configuration shown in the exhibit. The traffic from the 172.25.0.0/24 network is being forwarded as expected to 172.20.0.2, however traffic from the other network (172.25.1.0/24) is not being forwarded to the upstream 172.21.0.2 neighbor.

In this scenario, which action will solve this problem?

A. You must specify that the 172.25.1.1/24 IP address is the primary address on the ge- 0/0/1 interface.

B. You must apply the firewall filter to the lo0 interface when using filter-based forwarding.

C. You must add another term to the firewall filter to accept the traffic from the 172.25.1.0/24 network.

D. You must create the static default route to neighbor 172.21 0.2 under the ISP-1 routing instance hierarchy.

Exhibit.

Referring to the exhibit, a spoke member of an ADVPN is not functioning correctly.

Which two commands will solve this problem? (Choose two.)

A. [edit interfaces] user@srx# delete st0.0 multipoint

B. [edit security ike gateway advpn-gateway] user@srx# delete advpn partner

C. [edit security ike gateway advpn-gateway] user@srx# set version v1-only

D. [edit security ike gateway advpn-gateway] user@srx# set advpn suggester disable

What are two important function of the Juniper Networks ATP appliance solution? (Choose two.).

A. Statistics

B. Analysis

C. Detection

D. Filtration

Exhibit.

Referring to the exhibit, which two statements are true? (Choose two.)

A. The c-1 TSYS has a reservation for the security flow resource.

B. The c-1 TSYS can use security flow resources up to the system maximum.

C. The c-1 TSYS cannot use any security flow resources.

D. The c-1 TSYS has no reservation for the security flow resource.

You have noticed a high number of TCP-based attacks directed toward your primary edge device. You are asked to configure the IDP feature on your SRX Series device to block this attack. Which two IDP attack objects would you configure to solve this problem? (Choose two.)

A. Network

B. Signature

C. Protocol anomaly

D. host

Exhibit You are using ATP Cloud and notice that there is a host with a high number of ETI and CandC hits sourced from the same investigation and notice that some of the events have not been automatically mitigated. Referring to the exhibit, what is a reason for this behavior?

A. The CandC events are false positives.

B. The infected host score is globally set bellow a threat level of 5.

C. The infected host score is globally set above a threat level of 5.

D. The ETI events are false positives.

Which statement is true about persistent NAT types?

A. The target-host-port parameter cannot be used with IPv4 addresses in NAT46.

B. The target-host parameter cannot be used with IPv6 addressee in NAT64.

C. The target-host parameter cannot be used with IPv4 addresses in NAT46

D. The target-host-port parameter cannot be used with IPv6 addresses in NAT64

Exhibit

Which two statements are correct about the output shown in the exhibit. (Choose two.)

A. The source address is translated.

B. The packet is an SSH packet

C. The packet matches a user-configured policy

D. The destination address is translated.

Which method does an SRX Series device in transparent mode use to learn about unknown devices in a network?

A. LLDP-MED

B. IGMP snooping

C. RSTP

D. packet flooding

Exhibit

The show network-access aaa radius-servers command has been issued to solve authentication issues.

Referring to the exhibit, to which two authentication servers will the SRX Series device continue to send requests? (Choose TWO)

A. 200l:DB8:0:f101;:2

B. 192.168.30.191

C. 192.168.30.190

D. 192.168.30.188

You configured a chassis cluster for high availability on an SRX Series device and enrolled this HA cluster with the Juniper ATP Cloud. Which two statements are correct in this scenario? (Choose two.)

A. You must use different license keys on both cluster nodes.

B. When enrolling your devices, you only need to enroll one node.

C. You must set up your HA cluster after enrolling your devices with Juniper ATP Cloud

D. You must use the same license key on both cluster nodes.

You want to use selective stateless packet-based forwarding based on the source address.

In this scenario, which command will allow traffic to bypass the SRX Series device flow daemon?

A. set firewall family inet filter bypaa3_flowd term t1 then skip--services accept

B. set firewall family inet filter bypass_flowd term t1 then routing-instance stateless

C. set firewall family inet filter bypas3_flowd term t1 then virtual-channel stateless

D. set firewall family inet filter bypass__f lowd term t1 then packet--mode