Juniper Security

Number: JN)-230
Passing Score: 800
Time Limit: 120 min
File Version: 1.0

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
Exam A

QUESTION 1
You configure and applied several global policies and some of the policies have overlapping match criteria.
In this scenario, how are these global policies applies?

A. The first matched policy is the only policy applied.

B. The most restrictive that matches is applied.
C. The least restrictive policy that matches is applied.

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 2
Which statement is correct regarding the interface configuration shown in the exhibit?

A. The IP address has an invalid subnet mask.

B. The interface MTU has been increased.
C. The IP address is assigned to unit 0.
D. The interface is assigned to the trust zone by default.

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 3
The Sky ATP premium or basic-Threat Feed license is needed for which two features? (Choose two.)

A. Outbound protection
B. C&C feeds
C. Executable inspection
D. Custom feeds

Correct Answer: BD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 4
Which statement is correct about IKE?

A. IKE phase 1 is used to establish the data path

B. IKE phase 1 only support aggressive mode.
C. IKE phase 1 negotiates a secure channel between gateways.
D. IKE phase 1 establishes the tunnel between devices

Correct Answer: C
Section: (none)
Explanation

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
Explanation/Reference:

QUESTION 5
Which two segments describes IPsec VPNs? (Choose two.)

A. IPsec VPN traffic is always authenticated.

B. IPsec VPN traffic is always encrypted.
C. IPsec VPNs use security to secure traffic over a public network between two remote sites.
D. IPsec VPNs are dedicated physical connections between two private networks.

Correct Answer: AC
Section: (none)
Explanation

Explanation/Reference:

QUESTION 6
Users on the network are restricted from accessing Facebook, however, a recent examination of the logs
show that users are accessing Facebook. Why is this problem happening?

A. Global rules are honored before zone-based rules.

B. The internet-Access rule has a higher precedence value
C. The internet-Access rule is listed first
D. Zone-based rules are honored before global rules

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 7
You have created a zones-based security policy that permits traffic to a specific webserver for the
marketing team. Other groups in the company are not permitted to access the webserver. When marketing
users attempt to access the server they are unable to do so. What are two reasons for this access failure?
(Choose two.)

A. You failed to change the source zone to include any source zone.
B. You failed to position the policy after the policy that denies access to the webserver.
C. You failed to commit the policy change.
D. You failed to position the policy before the policy that denies access the webserver

Correct Answer: CD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 8
Which two match conditions would be used in both static NAT and destination NAT rule sets? (Choose
two.)

A. Destination zone
B. Destination address
C. Source interface

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
D. Source zone

Correct Answer: BD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 9
Which statements is correct about global security policies?

A. Global policies allow you to regulate traffic with addresses and applications, regardless of their security
zones.
B. Traffic matching global is not added to the session table.
C. Global policies eliminate the need to assign interface to security zones.
D. Global security require you to identify a source and destination zone.

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 10
You have configured a Web filtering UTM policy. Which action must be performed before the Web filtering
UTM policy takes effect?

A. The UTM policy must be linked to an egress interface

B. The UTM policy be configured as a routing next hop.
C. The UTM policy must be linked to an ingress interface.
D. The UTM policy must be linked to a security policy.

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 11
By default, revenue interface are placed into which system-defined security zone on an SRX series device?

A. Trust
B. Null
C. Junos-trust
D. untrust

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 12
What is the purpose of the Shadow Policies workspace in J-Web?

A. The Shadow Policies workspace shows unused security policies due to policy overlap.

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
B. The Shadow Policies workspace shows unused IPS policies due to policy overlap.
C. The Shadow Policies workspace shows used security policies due to policy overlap .
D. The Shadow Policies workspace shows used IPS policies due to policy overlap.

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 13
Referring to the exhibit. Which type of NAT is being performed?

A. Source NAT with PAT

B. Source NAT without PAT
C. Destination NAT without PAT
D. Destination NAT with PAT

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 14
Your company uses SRX Series devices to secure the edge of the network. You are asked protect the
company from ransom ware attacks.
Which solution will satisfy this requirement?

A. Sky ATP
B. AppSecure
C. Unified security policies
D. screens

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 15
Which type of security policy protect restricted services from running on non-standard ports?

A. Application firewall
B. IDP
C. Sky ATP
D. antivirus

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 16
Which statements is correct about Junos security zones?
https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
A. User-defined security must contain at least one interface.
B. Security policies are referenced within a user-defined security zone.
C. Logical interface are added to user defined security zones.
D. User-defined security must contains the key word ‘’zone’’

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 17
A new SRX Series device has been delivered to your location. The device has the factory-default
configuration loaded. You have powered on the device and connected to the console port. What would you
use to log into the device to begin the initial configuration?

A. Root with a password of juniper’’

B. Root with no password
C. Admin with password
D. Admin with a password ‘’juniper’’

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 18
Which two statements are true about UTM on an SRX340? (Choose two.)

A. A default UTM policy is created.

B. No default profile is created.
C. No default UTM policy is created
D. A default UTM profile is created

Correct Answer: BC
Section: (none)
Explanation

Explanation/Reference:

QUESTION 19
What must you do first to use the Monitor/Events workspace in the j-Web interface?

A. You must enable stream mode security logging on the SRX Series device
B. You must enable event mode security logging on the SRX Series device.
C. You must enable security logging that uses the SD-Syslog format.
D. You must enable security logging that uses the TLS transport mode.

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
QUESTION 20
Which statements about NAT are correct? (Choose two.)

A. When multiple NAT rules have overlapping match conditions, the rule listed first is chosen.
B. Source NAT translates the source port and destination IP address.
C. Source NAT translates the source IP address of packet.
D. When multiple NAT rules have overlapping match conditions, the most specific rule is chosen.

Correct Answer: AC
Section: (none)
Explanation

Explanation/Reference:

QUESTION 21
We are configuring the antispam UTM feature on an SRX Series device. Which two actions would be
performed by the SRX Series device for e-mail that is identified as spam? (Choose two.)

A. Tag the e-mail

B. Queue the e-mail
C. Block the e-mail
D. Quarantine e-mail

Correct Answer: AC
Section: (none)
Explanation

Explanation/Reference:

QUESTION 22
You are concerned that unauthorized traffic is using non-standardized ports on your network. In this
scenario, which type of security feature should you implement?

A. Application firewall
B. Sky ATP
C. Firewall filters
D. Zone-based policies

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 23
What are two characteristic of static NAT SRX Series devices? (Choose two.)

A. Source and destination NAT rules take precedence over static NAT rules.
B. A reverse mapping rule is automatically created for the source translation.
C. Static NAT rule take precedence over source and destination NAT rules.
D. Static rules cannot coexist with destination NAT rules on the same SRX Series device configuration.

Correct Answer: BC
Section: (none)
Explanation

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
Explanation/Reference:

QUESTION 24
Exhibit.
Which two statements are true? (Choose two.)

A. Logs for this security policy are generated.

B. Logs for this security policy are not generated.
C. Traffic statistics for this security policy are not generated.
D. Traffic statistics for this security policy are generated.

Correct Answer: AD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 25
You have configured antispam to allow e-mail from example.com, however the logs you see that
jcart@example.com is blocked
Referring to the exhibit. What are two ways to solve this problem?

A. Verify connectivity with the SBL server.

B. Add jcart@exmple.com to the profile antispam address whitelist.
C. Delete jcart@example.com from the profile antispam address blacklist
D. Delete jcart@example.com from the profile antispam address whitelist

Correct Answer: BC
Section: (none)
Explanation

Explanation/Reference:

QUESTION 26
Which statement about IPsec is correct?

A. IPsec can be used to transport native Layer 2 packets.

B. IPsec can provide encapsulation but not encryption
C. IPsec is a standards-based protocol.
D. IPsec is used to provide data replication

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 27
Your company has been assigned one public IP address. You want to enable internet traffic to reach
multiple servers in your DMZ that are configured with private address.
In this scenario, which type of NAT would be used to accomplish this tasks?

A. Static NAT
B. Destination NAT
C. Source NAT

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
D. NAT without PAT

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 28
Which method do VPNs use to prevent outside parties from viewing packet in clear text?

A. Integrity
B. Authentication
C. Encryption
D. NAT_T

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 29
What should you configure if you want to translate private source IP addresses to a single public IP
address?

A. Source NAT
B. Destination NAT
C. Content filtering
D. Security Director

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 30
Which security object defines a source or destination IP address that is used for an employee
Workstation?

A. Zone
B. Screen
C. Address book entry
D. Scheduler

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 31
What is the correct order of processing when configuring NAT rules and security policies?

A. Policy lookup > source NAT > static NAT > destination NAT

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
B. Source NAT > static NAT > destination NAT > policy lookup
C. Static NAT > destination NAT> policy lookup > source NAT
D. Destination NAT> policy lookup > source NAT> static NAT

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 32
Firewall filters define which type of security?

A. Stateful
B. Stateless
C. NGFW
D. Dynamic enforcement

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 33
Which statement about IPsec is correct?

A. IPsec can provide encryption but not data integrity.

B. IPsec support packet fragmentation by intermediary devices.
C. IPsec support both tunnel and transport modes.
D. IPsec must use certificates to provide data encryption.

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 34
Which two statements are true regarding zone-based security policies? (Choose two.)

A. Zone-based policies must reference a source address in the match criteria.

B. Zone-based policies must reference a URL category in the match criteria.
C. Zone-based policies must reference a destination address in the match criteria.
D. Zone-based policies must reference a dynamic application in the match criteria.

Correct Answer: AC
Section: (none)
Explanation

Explanation/Reference:

QUESTION 35
Referring to the exhibit.
****Exhibit is Missing****
Which type of NAT is performed by the SRX Series device?
https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
A. Source NAT with PAT
B. Source Nat without PAT
C. Destination NAT without PAT
D. Destination NAT with PAT

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 36
What are the valid actions for a source NAT rule in J-Web? (choose three.)

A. On
B. Off
C. Pool
D. Source
E. interface

Correct Answer: BCE

Section: (none)
Explanation

Explanation/Reference:

QUESTION 37
Which UTM feature should you use to protect users from visiting certain blacklisted websites?

A. Content filtering
B. Web filtering
C. Antivirus
D. antispam

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 38
Which security feature is applied to traffic on an SRX Series device when the device is running on packet
mode?

A. Sky ATP
B. ALGs
C. Firewall filters
D. Unified policies

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
QUESTION 39
Users in your network are downloading files with file extensions that you consider to be unsafe for your
network. You must prevent files with specific file extensions from entering your network. Which UTM
feature should be enable on an SRX Series device to accomplish this task?

A. Content filtering
B. Web filtering
C. Antispam
D. URL filtering

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 40
On an SRX device, you want to regulate traffic base on network segments. In this scenario, what do you
configure to accomplish this task?

A. Screens
B. Zones
C. ALGs
D. NAT

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 41
Which two actions are performed on an incoming packet matching an existing session? (Choose two.)

A. Zone processing
B. Security policy evolution
C. Service ALG processing
D. Screens processing

Correct Answer: CD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 42
Which two statements are correct about using global-based policies over zone-based policies? (Choose
two.)

A. With global-based policies, you do not need to specify a destination zone in the match criteria.
B. With global-based policies,you do not need to specify a source zone in the match criteria.
C. With global-based policies,you do not need to specify a destination address in the match criteria.
D. With global-based policies,you do not need to specify a source address in the match criteria.

Correct Answer: AB

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
Section: (none)
Explanation

Explanation/Reference:

QUESTION 43
Which two statements are true about the null zone? (Choose two.)

A. All interface belong to the null zone by default.

B. All traffic to the null zone is dropped.
C. All traffic to the null zone is allowed
D. The null zone is a user-defined zone

Correct Answer: AB
Section: (none)
Explanation

Explanation/Reference:

QUESTION 44
You want to automatically generate the encryption and authentication keys during IPsec VPN
establishment. What would be used to accomplish this task?

A. IPsec
B. Diffie_Hellman
C. Main mode
D. Aggregate mode

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 45
Which actions would be applied for the pre-ID default policy unified policies?

A. Redirect the session

B. Reject the session
C. Log the session
D. Silently drop the session

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 46
Which two statements are true about security policy actions? (Choose two.)

A. The reject action drops the traffic and sends a message to the source device.
B. The deny action silently drop the traffic.
C. The deny action drops the traffic and sends a message to the source device.
D. The reject action silently drops the traffic.

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
Correct Answer: AB
Section: (none)
Explanation

Explanation/Reference:

QUESTION 47
Which management software supports metadata-based security policies that are ideal for cloud
deployments?

A. Security Director
B. J-Web
C. Network Director
D. Sky Enterprise

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 48
Which three actions would be performed on traffic traversing an IPsec VPN? (Choose three.)

A. Port forwarding
B. Authentication
C. Encryption
D. Deep inspection
E. Payload verification

Correct Answer: BCE

Section: (none)
Explanation

Explanation/Reference:

QUESTION 49
You want to generate reports from the J-Web on an SRX Series device. Which logging mode would you
use in this scenario?

A. Syslog
B. Stream
C. Event
D. local

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 50
Which two notifications are available when the antivirus engine detects and infected file? (Choose two.)

A. e-mail notifications

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
B. SNMP notifications
C. SMS notifications
D. Protocol-only notification

Correct Answer: AD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 51
You are designing a new security policy on an SRX Series device. You must block an application and log
all concurrence of the application access attempts.
In this scenario, which two actions must be enabled in the security policy? (Choose two.)

A. Log the session initiations

B. Enable a reject action
C. Log the session closures
D. Enable a deny action

Correct Answer: AD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 52
Host-inbound-traffic is configured on the DMZ zone and the ge-0/0/9.0 interface attached to that zone.
Referring to the exhibit, which two types of management traffic would be performed on the SRX Series
device? (Choose two.)

A. HTTPS
B. SSH
C. Finger
D. HTTP

Correct Answer: BD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 53
Which two statements are correct about functional zones? (Choose two.)

A. A functional zone uses security policies to enforce rules for transit traffic.
B. Traffic received on the management interface in the functional zone cannot transit out other interface.
C. Functional zones separate groups of users based on their function.
D. A function is used for special purpose, such as management interface.

Correct Answer: BD
Section: (none)
Explanation

Explanation/Reference:

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
QUESTION 54
Which flow module components handles processing for UTM?

A. Policy
B. Zones
C. Services
D. Screen options

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 55
Users should not have access to Facebook, however, a recent examination of the logs security show that
users are accessing Facebook.
Referring to the exhibit, what should you do to solve this problem?

A. Change the source address for the Block-Facebook-Access rule to the prefix of the users.
B. Move the Block-Facebook-Access rule before the Internet-Access rule.
C. Move the Block-Facebook-Access rule from a zone policy to a global policy.
D. Change the Internet-Access rule from a zone policy to a global policy.

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 56
Which two elements are needed on an SRX Series device to set up a remote syslog server? (Choose two.)

A. Data type
B. Data throughput
C. IP address
D. Data size

Correct Answer: AC
Section: (none)
Explanation

Explanation/Reference:

QUESTION 57
Which two feature on the SRX Series device are common across all Junos devices? (Choose two.)

A. Stateless firewall filters

B. UTM services
C. The separation of control and forwarding planes
D. screens

Correct Answer: AC
Section: (none)
Explanation

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
Explanation/Reference:

QUESTION 58
You want to integrate an SRX Series device with SKY ATP. What is the first action to accomplish task?

A. Issue the commit script to register the SRX Series device.

B. Copy the operational script from the Sky ATP Web UI.
C. Create an account with the Sky ATP Web UI.
D. Create the SSL VPN tunnel between the SRX Series device and Sky ATP.

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 59
What must you do first to use the Monitor/Alarms/Policy Log workspace in J-Web?

A. You must enable logging that uses the SD-Syslog format.

B. You must enable security logging that uses the TLS transport mode.
C. You must enable stream mode security logging on the SRX Series device.
D. You must enable event mode security logging on the SRX Series device.

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 60
You are configuring an IPsec VPN tunnel between two locations on your network. Each packet must be
encrypted and authenticated.Which protocol would satisfy these requirements?

A. MD5
B. ESP
C. AH
D. SHA

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 61
Which two private cloud solution support vSRX devices? (Choose two.)

A. Microsoft Azure
B. Amazon Web Services (AWS)
C. VMware Web Services (AWS)
D. VMware NSX
E. Contrail Cloud

Correct Answer: AB

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
Section: (none)
Explanation

Explanation/Reference:

QUESTION 62
You verify that the SSH service is configured correctly on your SRX Series device, yet administrators
attempting to connect through a revenue port are not able to connect.
In this scenario, what must be configured to solve this problem?

A. A security policy allowing SSH traffic.

B. A host-inbound-traffic setting on the incoming zone.
C. An MTU value target than the default value .
D. A screen on the internal interface.

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 63
The free licensing model for Sky ATP includes which features? (Choose two.)

A. C&C feeds
B. Infected host blocking
C. Executable file inspection
D. Compromised endpoint dashboard

Correct Answer: BC
Section: (none)
Explanation

Explanation/Reference:

QUESTION 64
Which statements is correct about SKY ATP ?

A. Sky ATP is an open-source security solution.

B. Sky ATP is used to automatically push out changes to the AppSecure suite.
C. Sky ATP only support sending threat feeds to vSRX Series devices.
D. Sky ATP is a cloud-based security threat analyzer that performs multiple tasks.

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 65
On an SRX Series device, how should you configure your IKE gateway if the remote endpoint is a branch
office-using a dynamic IP address?

A. Configure the IPsec policy to use MDS authentication.

B. Configure the IKE policy to use aggressive mode.
C. Configure the IPsec policy to use aggressive mode.

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
D. Configure the IKE policy to use a static IP address.

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 66
Which statements is correct about Sky ATP ?

A. The Local Sky ATP platform downloads the lastest threat feeds from a managed site.
B. Sky ATP can provide live threat feeds to SRX Services devices.
C. Sky ATP is a local hardware-based security threat analyzer the platform multiple tasks.
D. Sky ATP relies on the SRX Series device to open and analyze suspect file attachments.

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 67
Click the Exhbit button
You are configure an IPSec VPN for the network shown in the Exhbit
Which feature must be enabled for the VPN establish successfully?

A. Main mode must be configured on the IKE gateway.

B. Main mode must be configured on the IPSec VPN.
C. Aggressive mode must be configured on the IPSec VPN
D. Aggressive mode must be configured on the IKE gateway.

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 68
Which source NAT rule set would be used when a packet matches the conditions in multiple rule sets ?

A. The most specific rule set will be used.

B. The least specific rule set will be used
C. The first rule set matched will be used
D. The last rule set matched will be used

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 69
What dose IPSec use to negotiates encryption algorithms ?

A. TLS

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
B. AH
C. ESP
D. IKE

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 70
What is a type of security feed that Sky ATP provides to a vSRX Series device by default ?

A. C & C feeds.
B. malware feeds.
C. RSS feeds
D. ACL feeds

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 71
When configuring IPSec VPNs, setting a hash alogrithm solves which security concern ?

A. encryption
B. integrity
C. availability
D. redundancy

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 72
Which statement describes stateless firewalls on SRX Series devices ?

A. Each packet is analyzed by firewall filters.

B. Each packet is analyzed based on application Layer security.
C. Each packet is analyzed based on source zone.
D. Each packet is analyzed as part of a session.

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 73
What is the behavior of an SRX Series device when UDP and TCP traffic is rejected by a security policy
action ? (Choose two)

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
A. The reject action drop UDP packets sends and ICMP message to the source.
B. The reject action drop TCP packets sends and ICMP message to the source.
C. The reject action drop UDP packets and dose not send any message to the source.
D. The reject action drop TCP packets sends and sends an RST message to the source.

Correct Answer: AD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 74
Click the Exhibit button
You are configured source
being received by the SRX

A. port forwarding
B. destination NAT
C. proxy ARP
D. reverse static NAT

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 75
What is a characteristic of the Junos Enhanced Web filtering solution ?

A. The SRX Series device intercepts HTTP and HTTPS requests and sends the source IP address to the
on-premises Websense server.
B. The Websense Cloud resolves the categorized URLs to IP addresses by performing a DNS reverse
lookup.
C. The Websense Cloud categorizes the URLs and also provides site reputation information.
D. Junos Enhanced Web filtering allows the SRX Series device to categorizes the URLs using an on-
premises Websense server.

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 76
Which two statements are correct about security zone ? (Choose two)

A. Security zone use packets filter to prevent communication between management ports.
B. Security zone use Security policies that enforce rules for the transit traffic.
C. Security zone use a stateful firewall to provide secure network connection.
D. Security zone use address books to link username to IP addresses.

Correct Answer: BC
Section: (none)
Explanation

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF
Explanation/Reference:

QUESTION 77
Which two statements are correct about global security polices ? (Choose two)

A. Global-based polices can reference the destination zone.

B. Global-based polices can reference the source zone.
C. Global-based polices must reference a dynamic application.
D. Global-based polices must reference the source and destination zones.

Correct Answer: AB
Section: (none)
Explanation

Explanation/Reference:

https://www.vceoreteconvert.com/
96929F08FD9856EC1315183A5C5A7DFF