[Jan-2024] JN0-636 Dumps are Available for Instant Access from Exams4sures [Q12-Q30]

Posted On January 25, 2024

[Jan-2024] JN0-636 Dumps are Available for Instant Access from Exams4sures

Study resources for the Valid JN0-636 Braindumps!

QUESTION 12
Referring to the exhibit. You are asked to establish an IBGP peering between the SRX Series device and the router, but the session is not being established. In the security flow trace on the SRX device, packet drops are observed as shown in the exhibit.
What is the correct action to solve the problem on the SRX device?

Create a firewall filter to accept the BGP traffic

Configure destination NAT for BGP traffic.

Add BGP to the Allowed host-inbound-traffic for the interface

Modify the security policy to allow the BGP traffic.

QUESTION 13
Exhibit

You configure Source NAT using a pool of addresses that are in the same subnet range as the external ge-0/0/0 interface on your vSRX device. Traffic that is exiting the internal network can reach external destinations, but the return traffic is being dropped by the service provider router.
Referring to the exhibit, what must be enabled on the vSRX device to solve this problem?

STUN

Proxy ARP

Persistent NAT

DNS Doctoring

QUESTION 14
Exhibit

You are using traceoptions to verity NAT session information on your SRX Series device Referring to the exhibit, which two statements are correct? (Choose two.)

This packet is part of an existing session.

The SRX device is changing the source address on this packet from

This is the first packet in the session

The SRX device is changing the destination address on this packet 10.0.1 1 to 172 20.101.10.

QUESTION 15
Which two modes are supported on Juniper ATP Cloud? (Choose two.)

global mode

transparent mode

private mode

Layer 3 mode

According to the Juniper documentation, Juniper ATP Cloud supports the following modes:
Layer 3 mode: In this mode, the SRX Series device acts as a Layer 3 gateway and routes traffic between different subnets. The SRX Series device performs NAT and security policy enforcement on the traffic and sends a copy of the traffic to Juniper ATP Cloud for analysis. This mode is suitable for networks that have multiple subnets and require NAT and firewall functions1 Transparent mode: In this mode, the SRX Series device acts as a Layer 2 bridge and forwards traffic between the same subnet. The SRX Series device does not perform NAT or security policy enforcement on the traffic, but sends a copy of the traffic to Juniper ATP Cloud for analysis. This mode is suitable for networks that have a single subnet and do not require NAT or firewall functions1 The other two modes, global mode and private mode, are not supported by Juniper ATP Cloud. Global mode is a configuration option for Juniper ATP Appliance, which is an on-premises solution that provides threat detection and prevention. Private mode is a configuration option for Juniper ATP Private Cloud, which is a cloud-based solution that provides threat detection and prevention within a private network23 Reference:
1: Juniper Advanced Threat Prevention Cloud | ATP Cloud | Juniper Networks 2: Juniper Advanced Threat Prevention Appliance | ATP Appliance | Juniper Networks 3: [Juniper Advanced Threat Prevention Private Cloud | ATP Private Cloud | Juniper Networks]

QUESTION 16
You want to route traffic between two newly created virtual routers without the use of logical systems using the configuration options on the SRX5800.
Which two methods of forwarding, between virtual routers, would you recommend? (Choose two.)

Use a static route to forward traffic across virtual routers using the next-table option.
Enable the return route by using a RIB group.

Create static routes in each virtual router using thenext-tablecommand.

Use a RIB group to share the internal routing protocol routes from the master routing instance.

Connect a direct cable between boo physical interfaces, one in each virtual router and use static routes with thenext-hopcommand.

QUESTION 17
Click the Exhibit button.

Referring to the exhibit, which three topologies are supported by Policy Enforcer? (Choose three.)

Topology 3

Topology 5

Topology 2

Topology 4

Topology 1

QUESTION 18
What are two valid modes for the Juniper ATP Appliance? (Choose two.)

flow collector

event collector

all-in-one

core

QUESTION 19
You are asked to deploy filter-based forwarding on your SRX Series device for incoming traffic sourced from the 10.10 100 0/24 network in this scenario, which three statements are correct? (Choose three.)

You must create a forwarding-type routing instance.

You must create and apply a firewall filter that matches on the source address 10.10.100.0/24 and then sends this traffic to your routing

You must create and apply a firewall filter that matches on the destination address 10 10.100.0/24 and then sends this traffic to your routing instance.

You must create a RIB group that adds interface routes to your routing instance.

You must create a VRF-type routing instance.

QUESTION 20
You are validating bidirectional traffic flows through your IPsec tunnel. The 4546 session represents traffic being sourced from the remote end of the IPsec tunnel. The 4547 session represents traffic that is sourced from the local network destined to the remote network.
Which statement is correct regarding the output shown in the exhibit?

The remote gateway address for the IPsec tunnel is 10.20.20.2

The session information indicates that the IPsec tunnel has not been established

The local gateway address for the IPsec tunnel is 10.20.20.2

NAT is being used to change the source address of outgoing packets

QUESTION 21
You are asked to implement the session cache feature on an SRX5400.
In this scenario, what information does a session cache entry record? (Choose two.)

The type of processing to do for ingress traffic

The type of processing to do for egress traffic

To which SPU the traffic of the session should be forwarded

To which NPU the traffic of the session should be forwarded

https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-packet-based- forwarding.html

QUESTION 22
Exhibit

Referring to the exhibit, which statement is true?

This custom block list feed will be used before the Juniper Seclntel

This custom block list feed cannot be saved if the Juniper Seclntel block list feed is configured.

This custom block list feed will be used instead of the Juniper Seclntel block list feed

This custom block list feed will be used after the Juniper Seclntel block list feed.

QUESTION 23
You are not able to activate the SSH honeypot on the all-in-one Juniper ATP appliance.
What would be a cause of this problem?

The collector must have a minimum of two interfaces.

The collector must have a minimum of three interfaces.

The collector must have a minimum of five interfaces.

The collector must have a minimum of four interfaces.

https://www.juniper.net/documentation/en_US/release-independent/jatp/topics/task/configuration/jatp-traffic-collectorsetting-ssh-honeypot-detection.html

QUESTION 24
Exhibit:

Referring to the exhibit, the operator user is unable to save configuration files to a usb stick the is plugged into SRX. What should you do to solve this problem?

Add the floppy permission flag to the operations class

Add the system-control permission flag to the operation class

Add the interface-control permission flag to the operation class

Add the system permission flag to the operation class

To solve the problem of the operator user being unable to save configuration files to a USB stick that is plugged into SRX, you need to add the system-control permission flag to the operations class. The other options are incorrect because:
A) Adding the floppy permission flag to the operations class is not sufficient or necessary to save configuration files to a USB stick. The floppy permission flag allows the user to access the floppy drive, but not the USB drive. The USB drive is accessed by the system permission flag, which is already included in the operations class1.
C) Adding the interface-control permission flag to the operations class is also not sufficient or necessary to save configuration files to a USB stick. The interface-control permission flag allows the user to configure and monitor interfaces, but not to save configuration files. The configuration permission flag, which is also already included in the operations class, allows the user to save configuration files1.
D) Adding the system permission flag to the operations class is redundant and ineffective to save configuration files to a USB stick. The system permission flag allows the user to access the system directory, which includes the USB drive. However, the operations class already has the system permission flag by default1. The problem is not the lack of system permission, but the lack of system-control permission.
Therefore, the correct answer is B. You need to add the system-control permission flag to the operations class to solve the problem. The system-control permission flag allows the user to perform system-level operations, such as rebooting, halting, or snapshotting the device1. These operations are required to mount, unmount, and copy files to and from the USB drive2. To add the system-control permission flag to the operations class, you need to perform the following steps:
Enter the configuration mode: user@host> configure
Navigate to the system login class hierarchy: user@host# edit system login class operations Add the system-control permission flag: user@host# set permissions system-control Commit the changes: user@host# commit Reference:
login (System)
How to mount a USB drive on EX/SRX/MX/QFX Series platforms to import/export files

QUESTION 25
You have noticed a high number of TCP-based attacks directed toward your primary edge device. You are asked to configure the IDP feature on your SRX Series device to block this attack.
Which two IDP attack objects would you configure to solve this problem? (Choose two.)

Network

Signature

Protocol anomaly

host

QUESTION 26
Exhibit:
The security trace options configuration shown in the exhibit is committed to your SRX series firewall. Which two statements are correct in this Scenario? (Choose Two)

The file debugger will be readable by all users.

Once the trace has generated 10 log files, older logs will be overwritten.

Once the trace has generated 10 log files, the trace process will halt.

The file debugger will be readable only by the user who committed this configuration

The security trace options configuration shown in the exhibit is committed to your SRX series firewall. The following statements are correct in this scenario:
B) Once the trace has generated 10 log files, older logs will be overwritten. The files option in the traceoptions statement specifies the maximum number of trace files to keep. When a trace file reaches its maximum size, it is renamed with a numeric suffix, such as kmd.0, kmd.1, and so on, until the maximum number of files is reached. Then the oldest trace file is overwritten by the newest one. In this case, the files option is set to 10, which means that the trace will generate 10 log files and then overwrite the older ones1.
D) The file debugger will be readable only by the user who committed this configuration. The file option in the traceoptions statement specifies the name of the trace file and the permissions for the file. The permissions can be either world-readable or owner-readable. In this case, the file option is set to debugger owner-readable, which means that the trace file will be named debugger and will be readable only by the user who committed the configuration1.
The other statements are incorrect because:
A) The file debugger will not be readable by all users, but only by the user who committed this configuration, as explained above.
C) The trace will not halt after generating 10 log files, but will continue to overwrite the older ones, as explained above.
Reference:
traceoptions (Security)

QUESTION 27
Your IPsec VPN configuration uses two CoS forwarding classes to separate voice and data traffic. How many IKE security associations are required between the IPsec peers in this scenario?

QUESTION 28
Your Source NAT implementation uses an address pool that contains multiple IPv4 addresses.
Your users report that when they establish more than one session with an external application, they are prompted to authenticate multiple times External hosts must not be able to establish sessions with internal network hosts.
What will solve this problem?

Disable PAT.

Enable destination NAT.

Enable persistent NAT

Enable address persistence.

QUESTION 29
Your manager asks you to show which attacks have been detected on your SRX Series device using the IPS feature.
Which command would you use to accomplish this task?

show security idp attack detail

show security idp attack table

show security idp memory

show security idp counters

QUESTION 30
Your Source NAT implementation uses an address pool that contains multiple IPv4 addresses Your users report that when they establish more than one session with an external application, they are prompted to authenticate multiple times External hosts must not be able to establish sessions with internal network hosts What will solve this problem?

Disable PAT.

Enable destination NAT.

Enable persistent NAT

Enable address persistence.

The solution to this problem is to enable address persistence. This will ensure that the same external IP address is used for multiple sessions between an internal host and an external host. This will result in only one authentication being required, as the same external IP address will be used for all sessions.

Loading …