Juniper Networks Certified Internet Specialist, SEC (JNCIS-SEC) - JN0-332 FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

Which two statements are true about route-based VPNs? (Choose two.)

A. Route-based VPNs cannot be used to configure remote access or dialup VPNs. B. The from-zone and to-zone, for a security policy to permit traffic over a route-based VPN, are derived from the zone in which the protected network lies and the zone in which the IKE interface lies. C. system services ike must be enabled on the st0.x interface. D. You cannot re-write the DSCP bits on the inner IP header of an ESP packet that was created or forwarded using a route-based VPN.

Discussion 0

Correct Answer: A,D Vote an answer

Question 2

Which feature on the SRX Series device would be processed first for transit traffic?

A. Zone B. NAT C. Screens D. Security policies

Discussion 0

Correct Answer: C Vote an answer

Question 3

You are required to configure a SCREEN option that enables IP source route option detection. Which two configurations meet this requirement? (Choose two.)

A. [edit security screen]
user@host# show
ids-option protectFromFlood {
ip {
loose-source-route-option;
strict-source-route-option;
}
} B. [edit security screen]
user@host# show
ids-option protectFromFlood {
ip {
source-route-option;
}
} C. [edit security screen]
user@host# show
ids-option protectFromFlood {
ip {
record-route-option;
security-option;
}
} D. [edit security screen]
user@host# show
ids-option protectFromFlood {
ip {
strict-source-route-option;
record-route-option;
}
}

Discussion 0

Correct Answer: A,B Vote an answer

Question 4

Which type of Web filtering by default builds a cache of server actions associated with each URL it has checked?

A. Websense Redirect Web filtering B. enhanced Web filtering C. local Web filtering D. integrated Web filtering

Discussion 0

Correct Answer: D Vote an answer

Question 5

Referring to the exhibit, you see that Node 0 is currently primary for redundancy Group 0. You have not yet configured any chassis cluster parameters. You want to ensure that Node 1 is always the primary node for this redundancy group if both nodes reboot at same time.
Which configuration step would accomplish this task?
user@host>show chassis cluster status cluster ID: 1 Node Priority Status Preempt Manual Failover Redundancy group: 0 ,Failover count: 1 Node0 1 primary no no Node1 1 secondary no no

A. user@host# set chassis cluster redundancy-group 0 preempt B. user@host# set chassis cluster redundancy-group 0 node 1 priority 1 C. user@host# set chassis cluster redundancy-group 0 node 0 priority 255 D. user@host# set chassis cluster redundancy-group 0 node 1 E. user@host# set chassis cluster redundancy-group 0 node 1 priority 254

Discussion 0

Correct Answer: E Vote an answer

Question 6

Which antivirus protection feature uses virus patterns and a malware database that are located on external servers?

A. express scan B. Kaspersky C. Sophos D. full file-based

Discussion 0

Correct Answer: C Vote an answer

Question 7

Which statement is true regarding proxy ARP?

A. Proxy ARP is enabled by default on chassis clusters. B. JUNOS security devices can reply to ARP requests intended for a remote device when proxy ARP is enabled. C. Proxy ARP is enabled by default on stand-alone JUNOS security devices. D. JUNOS security devices can forward ARP requests to a remote device when proxy ARP is enabled.

Discussion 0

Correct Answer: B Vote an answer

Question 8

Which statement describes the behavior of a security policy?

A. Traffic destined to the device's incoming interface does not require a security policy. B. The implicit default security policy permits all traffic. C. The factory-default configuration permits all traffic from all interfaces. D. Traffic destined to the device itself always requires a security policy.

Discussion 0

Correct Answer: A Vote an answer

Question 9

Click the Exhibit button.

You are the responder for an IPsec tunnel and you see the error messages shown in the exhibit. What is the problem?

A. One or more of the phase 1 proposals such as authentication algorithm, encryption algorithm, or pre-shared key does not match. B. There is no route for 2.2.2.2. C. There is no IKE definition in the configuration for peer 2.2.2.2. D. system services ike is not enabled on the interface with IP 1.1.1.2.

Discussion 0

Correct Answer: C Vote an answer

Question 10

Which two statements are correct regarding reth interfaces? (Choose two.)

A. Child interfaces do not need to be in the same slot on both nodes. B. Child interfaces must be in the same slot on both nodes C. Child interfaces must be the same Ethernet interface type. D. Child interfaces can be a mixture of Ethernet interface types.

Discussion 0

Correct Answer: A,C Vote an answer

Question 11

For which network anomaly does Junos provide a SCREEN?

A. an SNMP getnext request B. an ICMP packet larger than 1024 bytes C. a TCP packet with the SYN and ACK flags set D. a telnet to port 80

Discussion 0

Correct Answer: B Vote an answer

Question 12

Which two types of attacks are considered to be denial of service? (Choose two.)

A. SYN flood B. IP packet fragments C. WinNuke D. zombie agents

Discussion 0

Correct Answer: A,C Vote an answer