合格させるJuniper JN0-636試験には保証が付きます。更新されたのは140問があります [Q16-Q38]

合格させるJuniper JN0-636試験には保証が付きます。更新されたのは140問があります

最新のJN0-636合格保証付き試験問題集の認定サンプル問題

質問 # 16
Referring to the exhibit, an internal host is sending traffic to an Internet host using the 203.0.113.1 reflexive address with source port 54311.
Which statement is correct in this situation?

A. Only the Internet host that the internal host originally communicated with can initiate traffic to reach the internal host using the 203.0.113.1 address, a random source port, and destination port
54311.
B. Only the Internet host that the internal host originally communicated with can initiate traffic to reach the internal host using the 203.0.113.1 address, source port 54311, and a random destination port.
C. Any host on the Internet can initiate traffic to reach the internal host using the 203.0.113.1 address, a random source port, and destination port 54311.
D. Any host on the Internet can initiate traffic to reach the internal host using the 203.0.113.1 address, source port 54311, and a random destination port.

正解：D

質問 # 17
You have designed the firewall filter shown in the exhibit to limit SSH control traffic to yours SRX Series device without affecting other traffic.
Which two statement are true in this scenario? (Choose two.)

A. The filter should be applied as an input filter on the loopback interface.
B. The filter should be applied as an output filter on the loopback interface.
C. Applying the filter will achieve the desired result.
D. Applying the filter will not achieve the desired result.

正解：A、D

解説：
https://www.juniper.net/documentation//en_US/junos/topics/concept/firewall-filter-ex-series-evaluation-understanding.html

質問 # 18
Exhibit

Referring to the exhibit, which three protocols will be allowed on the ge-0/0/5.0 interface? (Choose three.)

A. IBGP
B. IPsec
C. DHCP
D. NTP
E. OSPF

正解：B、D、E

質問 # 19
You are asked to ensure that your IPS engine blocks attacks. You must ensure that your system continues to drop additional malicious traffic without additional IPS processing for up to 30 minutes. You must ensure that the SRX Series device does send a notification packet when the traffic is dropped.
Which statement is correct?

A. Use the Drop Connection action.
B. Use the IP-Close action.
C. Use the Drop Packet action.
D. Use the IP-Block action.

正解：B

質問 # 20
You are not able to activate the SSH honeypot on the all-in-one Juniper ATP appliance.
What would be a cause of this problem?

A. The collector must have a minimum of two interfaces.
B. The collector must have a minimum of five interfaces.
C. The collector must have a minimum of four interfaces.
D. The collector must have a minimum of three interfaces.

正解：C

解説：
https://www.juniper.net/documentation/en_US/release-
independent/jatp/topics/task/configuration/jatp-traffic-collectorsetting-ssh-honeypot-detection.html

質問 # 21
Exhibit

Referring to the exhibit, which three statements are true? (Choose three.)

A. The packet originated within the Trust zone.
B. The packet is dropped before making an SSH connection.
C. The packet's destination is to a server in the DMZ zone.
D. The packet is allowed to make an SSH connection.
E. The packet's destination is to an interface on the SRX Series device.

正解：A、B、E

質問 # 22
What are two important function of the Juniper Networks ATP appliance solution? (Choose two.).

A. Detection
B. Filtration
C. Analysis
D. Statistics

正解：A、C

質問 # 23
The exhibit shows a snippet of a security flow trace. In this scenario, which two statements are correct? (Choose two.)

A. The capture is a packet from the source address 172.20.101.10 destined to 10.0.1.129.
B. Destination NAT occurs.
C. An existing session is found in the table.
D. This packet arrived on interface ge-0/0/4.0.

正解：A、C

質問 # 24
An administrator wants to configure an SRX Series device to log binary security events for tenant systems.
Referring to the exhibit, which statement would complete the configuration?

A. Configure the tenant as TSYS1 for the pi security profile.
B. Configure the tenant as local for the pi security profile
C. Configure the tenant as root for the pi security profile.
D. Configure the tenant as master for the pi security profile.

正解：C

質問 # 25
What are two valid modes for the Juniper ATP Appliance? (Choose two.)

A. flow collector
B. all-in-one
C. core
D. event collector

正解：A、B

質問 # 26
You are validating bidirectional traffic flows through your IPsec tunnel. The 4546 session represents traffic being sourced from the remote end of the IPsec tunnel. The 4547 session represents traffic that is sourced from the local network destined to the remote network.
Which statement is correct regarding the output shown in the exhibit?

A. NAT is being used to change the source address of outgoing packets
B. The session information indicates that the IPsec tunnel has not been established
C. The local gateway address for the IPsec tunnel is 10.20.20.2
D. The remote gateway address for the IPsec tunnel is 10.20.20.2

正解：D

質問 # 27
Click the Exhibit button.

You are implementing a new branch site and want to ensure Internet traffic is sent directly to your ISP and other traffic is sent to your company headquarters. You have configured filter-based forwarding to accomplish this objective. You verify proper functionality using the outputs shown in the exhibit.
Which two statements are true in this scenario? (Choose two.)

A. The session utilizes two routing instances
B. The ge-0/0/5 and ge-0/0/1 interfaces can reside in different security zones
C. The ge-0/0/5 and ge-0/0/1 interfaces must reside in a single security zone
D. The session utilizes one routing instance

正解：B、D

質問 # 28
Referring to the exhibit. You configure a traceoptions file called radius on your returns the output shown in the exhibit. What is the source of the problem?

A. The RADIUS server suffered a hardware failure.
B. The RADIUS server IP address is unreachable.
C. An incorrect password is being used.
D. The authentication order is misconfigured.

正解：A

質問 # 29
You are asked to download and install the IPS signature database to a device operating in chassis cluster mode.
Which statement is correct in this scenario?

A. You must download and install the IPS signature package on the primary node.
B. The first time you synchronize the IPS signature package from the primary node to the backup node, the primary node must be rebooted.
C. The IPS signature package must be downloaded and installed on the primary and backup nodes.
D. The first synchronization of the backup node and the primary node must be performed manually.

正解：C

質問 # 30
You are asked to merge to corporate network with the network from a recently acquired company.
Both networks use the same private IPv4 address space (172.25.126.0/24). An SRX Series device servers as the gateway for each network.
Which solution allows you to merge the two networks without modifying the current address assignments?

A. NAT46
B. persistent NAT
C. double NAT
D. source NAT

正解：C

解説：
https://kb.juniper.net/InfoCenter/index?page=content&id=KB21286

質問 # 31
You are asked to allocate security profile resources to the interconnect logical system for it to work properly.
In this scenario, which statement is correct?

A. The flow-session resource must be defined in the security profile for the interconnect logical system.
B. The resources must be calculated based on the amount of traffic that will flow between the logical systems.
C. The NAT resources must be defined in the security profile for the interconnect logical system.
D. No resources are needed to be allocated to the interconnect logical system.

正解：B

質問 # 32
Exhibit

Which two statements are correct about the output shown in the exhibit? (Choose two.)

A. The packet is part of a new session.
B. The packet is explicitly rejected.
C. The packet is part of an existing session.
D. The packet is silently discarded.

正解：A、B

質問 # 33
You issue the command shown in the exhibit.
Which policy will be active for the identified traffic?

A. Policy p1
B. Policy p12
C. Policy p4
D. Policy p7

正解：D

質問 # 34
Click the Exhibit button.

The exhibit shows a snippet of a security flow trace. A user cannot open an SSH session to a server.
Which action will solve the problem?

A. Edit the source NAT to correct the translated address
B. Create a route to the desired server
C. Create a security policy that matches the traffic parameters
D. Create a route entry to direct traffic into the configured tunnel

正解：C

質問 # 35
You have noticed a high number of TCP-based attacks directed toward your primary edge device. You are asked to configure the IDP feature on your SRX Series device to block this attack.
Which two IDP attack objects would you configure to solve this problem? (Choose two.)

A. Protocol anomaly
B. Signature
C. host
D. Network

正解：A、B

質問 # 36
You have recently configured Adaptive Threat Profiling and notice 20 IP address entries in the monitoring section of the Juniper ATP Cloud portal that do not match the number of entries locally on the SRX Series device, as shown in the exhibit.
What is the correct action to solve this problem on the SRX device?