JN0-635問題集、Juniper実際の試験問題

質問 1

You want to route traffic between two newly created virtual routers without the use of logical systems using the configuration options on the SRX5800.
Which two methods of forwarding, between virtual routers, would you recommend? (Choose two.)

A. Create static routes in each virtual router using thenext-tablecommand.

B. Use a RIB group to share the internal routing protocol routes from the master routing instance.

C. Connect a direct cable between boo physical interfaces, one in each virtual router and use static routes with thenext-hopcommand.

D. Use a static route to forward traffic across virtual routers using the next-table option.
Enable the return route by using a RIB group.

正解: A,C

質問 2

Click the Exhibit button.

While configuring the SRX345, you review the MACsec connection between devices and note that it is not working.
Referring to the exhibit, which action would you use to identify problem?

A. Verify that the transmission path is not replicating packets or correcting frame check sequence error packets

B. Verify that the formatting settings are correct between the devices and that the software supports the version of MACsec in use

C. Verify that the interface between the two devices is up and not experiencing errors

D. Verify that the connectivity association key and the connectivity association key name match on both devices

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 3

You must implement an IPsec VPN on an SRX Series device using PKI certificates for authentication.
As part of the implementation, you are required to ensure that the certificate submission, renewal, and retrieval processes are handled automatically from the certificate authority.
In this scenario, which statement is correct.

A. You can use OCSP to accomplish this behavior.

B. You can use SPKI to accomplish this behavior.

C. You can use CRL to accomplish this behavior.

D. You can use SCEP to accomplish this behavior.

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 4

Which two statements about the integrated user firewall feature of the Junos OS are true?
(Choose two.)

A. IPv6 addresses are not supported.

B. The maximum number of supported active directory servers is ten.

C. IPv6 addresses are supported.

D. The maximum number of supported active directory servers is five.

正解: B,C

解説: (PassTest メンバーにのみ表示されます)

質問 5

You are asked to implement the AppFW feature on an SRX Series device.
Which three tasks must be performed to make the feature work? (Choose three.)

A. Configure a security policy that includes the application-firewall policy.

B. Install an IPS license.

C. Install an AppSecure license.

D. Configure a firewall filter that includes the application-firewall policy.

E. Configure an application-firewall policy.

正解: A,C,E

質問 6

Your manager has identified that employees are spending too much time posting on a social media site. You are asked to block user from posting on this site, but they should still be able to access any other site on the Internet.
In this scenario, which AppSecure feature will accomplish this task?

A. APBR

B. APpFW

C. AppQoS

D. AppTrack

正解: B

質問 7

Referring to the exhibit, which two statements are true? (Choose two.)

A. The IPv6 address is invalid.

B. The configured solution allows IPv4 to IPv6 translation.

C. External hosts cannot initiate contact.

D. The configured solution allows IPv6 to IPv4 translation.

正解: A,D

質問 8

Click the Exhibit button.
user@key-server> show security group-vpn server ike security-
associations Index State Initiator cookie Responder cookie Mode Remote
Address
97 UP bb224408940cc5d 435b9404284083c2 Main 192.168.11.1
98 UP 242c840089404d15 ab19284089408ba8 Main 192.168.11.2
user@key-server> show security group-vpn server ipsec security-
associations Group:
group-1, Group Id: 1
Total IPsec SAs: 1
IPsec SA Algorithm SPI Lifetime
group-l-sa ESP:3des/shal 1343991c 2736
Group: group-2, Group id: 2
Total IPsec SAs: 1
IPsec SA Algorithm SPI Lifetime
group-2-sa ESP:3des/shal 13be9e9 2741
Group: group-3, Group Id: 3
Total IPsec SAs: 1
IPsec SA Algorithm SPI Lifetime
group-3-sa ESP:3des/shal 20709057 2741
Group: group-4, Group Id: 4
Total IPsec SAs: 1
IPsec SA Algorithm SPI Lifetime
group-4-sa ESP:3des/shal 5111c2e1 2741
Which statement is correct regarding the outputs shown in the exhibit?

A. Two established peers are in the group VPNs.

B. One established peer is in the group VPNs.

C. Four established peers are in the group VPNs.

D. No established peer is in the group VPNs.

正解: A

質問 9

A user is unable to reach a necessary resource. You discover the path through the SRX Series device includes several security features. The traffic is not being evaluated by any security policies.
In this scenario, which two components within the flow module would affect the traffic? (Choose two.)

A. destination NAT

B. source NAT

C. services/ALG

D. route lookup

正解: B,C

質問 10

How does secure wire mode differ from transparent mode?

A. In secure wire mode, traffic can be modified using source NAT

B. In secure wire mode, security policies cannot be used to secure intra-VLAN traffic

C. In secure wire mode, no switching lookup takes place to forward traffic

D. In secure wire mode, IRB interfaces can be configured to route inter-VLAN traffic

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 11

When would you use the port-overloading-factor 1 setting?

A. to disable the port-overloading

B. to enable the port-overloading

C. to set the maximum port-overloading capacity to 65,536

D. to map ports with 1:1 ratio for port-overloading

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 12

You have the NAT rule, shown in the exhibit, applied to allow communication across an IPsec tunnel between your two sites with identical networks. Which statement is correct in this scenario?

A. The NAT rule with translate the source and destination addresses.

B. The NAT rule in applied to the N/A routing instance.

C. The NAT rule will only translate two addresses at a time.

D. 10 packets have been processed by the NAT rule.

正解: A

Juniper Security, Professional (JNCIP-SEC) - JN0-635 模擬練習