Guide (New 2023) Actual Juniper JN0-636 Exam Questions
JN0-636 Exam Dumps Pass with Updated 2023 Certified Exam Questions
Juniper JN0-636 certification exam is designed to validate the skills and knowledge of security professionals in the Juniper Networks security platform. Security, Professional (JNCIP-SEC) certification exam is targeted towards professionals who have already earned the Juniper JNCIS-SEC certification and who are looking to further their knowledge and expertise in the field of security. The JN0-636 exam is the second-level certification in the Juniper Networks security track and serves as a stepping stone to the Juniper JNCIE-SEC certification.
NEW QUESTION # 52
Which statement is true about persistent NAT types?
- A. The target-host parameter cannot be used with IPv6 addressee in NAT64.
- B. The target-host parameter cannot be used with IPv4 addresses inNAT46
- C. The target-host-port parameter cannot be used with IPv6 addresses in NAT64
- D. The target-host-port parameter cannot be used with IPv4 addresses in NAT46.
Answer: B
NEW QUESTION # 53
You are asked to configure a new SRX Series CPE device at a remote office. The device must participate in forwarding MPLS and IPsec traffic.
Which two statements are true regarding this implementation? (Choose two.)
- A. Host inbound traffic must not be processed by the flow module
- B. A firewall filter must be configured to enable packet mode forwarding
- C. The SRX Series device can process both MPLS and IPsec with default traffic handling
- D. Host inbound traffic must be processed by the flow module
Answer: A,B
Explanation:
https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-packet-based- forwarding.html
NEW QUESTION # 54
Exhibit
Which two statements are correct about the output shown in the exhibit? (Choose two.)
- A. The packet is silently discarded.
- B. The packet is part of a new session.
- C. The packet is part of an existing session.
- D. The packet is explicitly rejected.
Answer: B,D
NEW QUESTION # 55
Which two features would be used for DNS doctoring on an SRX Series firewall? (Choose two.)
- A. static NAT
- B. source NAT
- C. The DNS ALG must be disabled.
- D. The DNS ALG must be enabled.
Answer: B,C
NEW QUESTION # 56
Exhibit
You are using traceoptions to verify NAT session information on your SRX Series device. Referring to the exhibit, which two statements are correct? (Choose two.)
- A. The SRX Series device is performing only source NAT on this session.
- B. The SRX Series device is performing both source and destination NAT on this session.
- C. This is the first packet in the session.
- D. This is the last packet in the session.
Answer: B,D
NEW QUESTION # 57
Exhibit
Which statement is true about the output shown in the exhibit?
- A. The SRX Series device is configured with flow-based IPv6 forwarding options.
- B. The SRX Series device is configured to disable IPv6 packet forwarding.
- C. The SRX Series device is configured with default security forwarding options.
- D. The SRX Series device is configured with packet-based IPv6 forwarding options.
Answer: C
NEW QUESTION # 58
You are asked to look at a configuration that is designed to take all traffic with a specific source ip address and forward the traffic to a traffic analysis server for further evaluation. The configuration is no longer working as intended.
Referring to the exhibit which change must be made to correct the configuration?
- A. Apply the filter as in input filter on interface xe-0/0/1.0
- B. Apply the filter as in input filter on interface xe-0/2/1.0
- C. Create a routing instance named default
- D. Apply the filter as in output filter on interface xe-0/1/0.0
Answer: A
NEW QUESTION # 59
You are asked to set up notifications if one of your collector traffic feeds drops below 100 kbps.
Which two configuration parameters must be set to accomplish this task? (Choose two.)
- A. Set a logging notification on the JATP appliance
- B. Set a general triggered notification on the JATP appliance
- C. Set a traffic system alert on the JATP appliance
- D. Set a traffic SNMP trap on the JATP appliance
Answer: A,C
NEW QUESTION # 60
You must ensure that your Layer 2 traffic is secured on your SRX Series device in transparent mode.
What must be considered when accomplishing this task?
- A. Layer 2 interfaces must use theethernet-switchingprotocol family.
- B. You must reboot your device after configuring transparent mode.
- C. Security policies are not supported when operating in transparent mode.
- D. Screens are not supported in your security zones with transparent mode.
Answer: B
NEW QUESTION # 61
Exhibit.
Referring to the exhibit, which two statements are true? (Choose two.)
- A. The configured solution allows IPv4 to IPv6 translation.
- B. External hosts cannot initiate contact.
- C. The IPv6 address is invalid.
- D. The configured solution allows IPv6 to IPv4 translation.
Answer: C,D
NEW QUESTION # 62
You opened a support ticket with JTAC for your Juniper ATP appliance. JTAC asks you to set up access to the device using the reverse SSH connection.Which three setting must be configured to satisfy this request? (Choose three.)
- A. Create a temporary admin account.
- B. Enable remote support.
- C. Create a temporary root account.
- D. Enable JTAC remote access
- E. Enable a JATP support account.
Answer: A,B,E
Explanation:
https://kb.juniper.net/InfoCenter/index?page=content&id=TN326&cat=&actp=LIST&showDraft=false
NEW QUESTION # 63
You are asked to determine if the 203.0.113.5 IP address has been added to the third-party security feed, DS hield, from Juniper Seclnte1. You have an SRX Series device that is using Seclnte1 feeds from Juniper ATP Cloud Which command will return this information?
- A. show security dynamic-address category-name CC | match 203.0.113.5
- B. show security dynamic-address category-name Infected-Hosts | match 203.0.113.5
- C. show security dynamic-address category-name IPFilter I match 203.0.113.5
- D. show Security dynamic-address category-name JWAS | match 203.0.113.5
Answer: D
NEW QUESTION # 64
As an SRX administrator, you must find all encrypted sessions on an SRX Series device.
Which command would you use to accomplish this task?
- A. show security flow session tunnel
- B. show security flow session encrypted
- C. show security ike security-associations
- D. show security ike tunnel-map
Answer: B
NEW QUESTION # 65
Exhibit
The exhibit shows a snippet of a security flow trace.
In this scenario, which two statements are correct? (Choose two.)
- A. An existing session is found in the table.
- B. The capture is a packet from the source address 172.20.101.10 destined to 10.0.1.129.
- C. This packet arrived on interface ge-0/0/4.0.
- D. Destination NAT occurs.
Answer: A,B
NEW QUESTION # 66
Exhibit
You are using ATP Cloud and notice that there is a host with a high number of ETI and C&C hits sourced from the same investigation and notice that some of the events have not been automatically mitigated.
Referring to the exhibit, what is a reason for this behavior?
- A. The infected host score is globally set above a threat level of 5.
- B. The C&C events are false positives.
- C. The ETI events are false positives.
- D. The infected host score is globally set bellow a threat level of 5.
Answer: C
NEW QUESTION # 67
Exhibit
The highlighted incident (arrow) shown in the exhibit shows a progression level of "Download" in the kill chain.
What are two appropriate mitigation actions for the selected incident? (Choose two.)
- A. Immediate response required: Wipe infected endpoint hosts.
- B. Not an urgent action: Use IVP to confirm if machine is infected.
- C. Immediate response required: Deploy IVP integration (if configured) to confirm if the endpoint has executed the malware and is infected.
- D. Immediate response required: Block malware IP addresses (download server or CnC server)
Answer: A,B
NEW QUESTION # 68
Exhibit
The show network-access aaa radius-servers command has been issued to solve authentication issues.
Referring to the exhibit, to which two authentication servers will the SRX Series device continue to send requests? (Choose TWO)
- A. 192.168.30.191
- B. 200l:DB8:0:f101;:2
- C. 192.168.30.188
- D. 192.168.30.190
Answer: A,C
NEW QUESTION # 69
You are using traceoptions to verity NAT session information on your SRX Series device.
Referring to the exhibit, which two statements are correct? (Choose two.)
- A. The SRX device is changing the destination address on this packet 10.0.1.1 to 172 20.101.10.
- B. This packet is part of an existing session.
- C. This is the first packet in the session
- D. The SRX device is changing the source address on this packet from
Answer: A,C
NEW QUESTION # 70
The highlighted incident (arrow) shown in the exhibit shows a progression level of "Download" in the kill chain.
What are two appropriate mitigation actions for the selected incident? (Choose two.)
- A. Immediate response required: Wipe infected endpoint hosts.
- B. Not an urgent action: Use IVP to confirm if machine is infected.
- C. Immediate response required: Deploy IVP integration (if configured) to confirm if the endpoint has executed the malware and is infected.
- D. Immediate response required: Block malware IP addresses (download server or CnC server)
Answer: A,B
NEW QUESTION # 71
Exhibit
Referring to the exhibit, which three statements are true? (Choose three.)
- A. The packet is allowed to make an SSH connection.
- B. The packet originated within the Trust zone.
- C. The packet's destination is to a server in the DMZ zone.
- D. The packet's destination is to an interface on the SRX Series device.
- E. The packet is dropped before making an SSH connection.
Answer: B,D,E
NEW QUESTION # 72
You are implementing filter-based forwarding to send traffic from the 172.25.0.0/24 network through ISP-1 while sending all other traffic through your connection to ISP-2.
Your ge-0/0/1 interface connects to two networks, including the 172.25.0.0/24 network.
You have implemented the configuration shown in the exhibit. The traffic from the 172.25.0.0/24 network is being forwarded as expected to 172.20.0.2, however traffic from the other network (172.25.1.0/24) is not being forwarded to the upstream 172.21.0.2 neighbor.
In this scenario, which action will solve this problem?
- A. You must specify that the 172.25.1.1/24 IP address is the primary address on the ge-0/0/1 interface.
- B. You must apply the firewall filter to the lo0 interface when using filter-based forwarding.
- C. You must create the static default route to neighbor 172.21.0.2 under the ISP-1 routing instance hierarchy.
- D. You must add another term to the firewall filter to accept the traffic from the 172.25.1.0/24 network.
Answer: C
NEW QUESTION # 73
Referring to the exhibit, which two statements are true? (Choose two.)
- A. The data that traverses the ge-O/0/0 interface is secured by a connectivity association key.
- B. The data that traverses the ge-0/070 interface is secured by a secure association key.
- C. The data that traverses the ge-070/0 interface cannot be intercepted and read by anyone.
- D. The data that traverses the ge-070/0 interface can be intercepted and read by anyone.
Answer: C,D
NEW QUESTION # 74
......
Pass Guaranteed Quiz 2023 Realistic Verified Free Juniper: https://examsboost.validbraindumps.com/JN0-636-exam-prep.html