[2024年06月22日] 365日無料更新JN0-335知能問題集をゲット
ベスト品質のJuniper JN0-335試験問題
JN0-335認証試験の準備をするために、候補者は、TCP/IPプロトコル、ルーティング、切り替えなどのネットワーキングの概念を強く理解することをお勧めします。また、Juniper Networks Security SolutionsとJunos OSの経験も必要です。候補者は、ジュニパーネットワークのトレーニングコースに参加し、ジュニパーネットワークのドキュメントを読み、ジュニパーネットワークの機器を練習することにより、試験の準備をすることができます。
Juniper Networksは、ネットワークおよびセキュリティソリューションの有名なプロバイダーです。彼らの認定プログラムの中で、Juniper JN0-335試験はセキュリティスペシャリストになりたい人を対象として設計されています。この認定は、Juniper Networks Certified Internet Specialist Securityとしても知られています。
質問 # 15
Which two statements are correct about the cSRX? (Choose two.)
- A. The cSRX has three default zones: trust, untrust, and management
- B. The cSRX supports BGP, OSPF. and IS-IS routing services.
- C. The cSRX supports firewall, NAT, IPS, and UTM services.
- D. The cSRX only supports Layer 2 "bump-in-the-wire" deployments.
正解：A、C
解説：
The two statements that are correct about the cSRX are that it supports firewall, NAT, IPS, and UTM services, and that it has three default zones: trust, untrust, and management. The cSRX is a software-defined security solution that provides comprehensive network security capabilities and is designed for virtualized environments. It supports firewall, NAT, IPS, and UTM services to protect against threats, as well as BGP, OSPF, and IS-IS routing services for routing functionality. Additionally, the cSRX has three default zones: trust, untrust, and management. The trust zone is used to define traffic that is allowed to enter the network, the untrust zone is used to define traffic that should be blocked from entering the network, and the management zone is used to manage the device itself. The cSRX does not support Layer 2 "bump-in-the-wire" deployments.
質問 # 16
Which statement about security policy schedulers is correct?
- A. A policy without a defined scheduler will not become active
- B. When the scheduler is disabled, the policy will still be available.
- C. Multiple policies can use the same scheduler.
- D. A policy can have multiple schedulers.
正解：C
解説：
Explanation
Security policy schedulers are a feature that allows you to activate or deactivate a policy for a specified time period. You can create schedulers for a single or recurrent time slot, and apply them to one or more policies. A policy can only have one scheduler associated with it, but a scheduler can have multiple policies associated with it. When a scheduler is active, the policy is available for policy lookup. When a scheduler is inactive, the policy is unavailable for policy lookup. A policy without a defined scheduler will always be active, unless it is explicitly disabled. References:
Scheduling Security Policies
schedulers (Security Policies)
Security Policy Schedulers
scheduler (Security Policies)
質問 # 17
Click the Exhibit button.
You have configured your SRX Series device to receive authentication information from a JIMS server. However, the SRX is not receiving any authentication information.
Referring to the exhibit, how would you solve the problem?
- A. Update the IP address of the JIMS server
- B. Generate an access token on the SRX device that matches the access token on the JIMS server.
- C. Change the SRX configuration to connect to the JIMS server using HTTP.
- D. Use the JIMS Administrator user interface to add the SRX device as client.
正解：D
質問 # 18
You are asked to create an IPS-exempt rule base to eliminate false positives from happening.
Which two configuration parameters are available to exclude traffic from being examined? (Choose two.)
- A. source port
- B. destination port
- C. destination IP address
- D. source IP address
正解：D
解説：
Explanation
You can create an exempt rule to skip detection of a set of attacks in certain traffic. You can specify the source and destination IP addresses as the match criteria for the exempt rule. This allows you to exclude traffic from specific hosts or networks from being examined by the IPS rulebase. You can also specify other parameters such as protocol, application, and attack objects for the exempt rule, but source and destination IP addresses are the most common ones. References: = Create IPS or Exempt Rules and rulebase-exempt
質問 # 19
Which two statements are correct about the configuration shown in the exhibit? (Choose two.)
- A. Replacing the session-init parameter with session-lose will log unidentified flows.
- B. The others 300 parameter means unidentified traffic flows will be dropped in 300 milliseconds.
- C. Every session that enters the SRX Series device will generate an event
- D. The session-class parameter in only used when troubleshooting.
正解：B、C
解説：
The configuration shown in the exhibit is for a Juniper SRX Series firewall. The session-init parameter is used to control how the firewall processes unknown traffic flows. With the session- init parameter set to 300, any traffic flows that the firewall does not recognize will be dropped after 300 milliseconds. Additionally, every session that enters the device, whether it is known or unknown, will generate an event, which can be used for logging and troubleshooting purposes.
The session-lose parameter is used to control how the firewall handles established sessions that are terminated.
質問 # 20
How many nodes are configurable in a chassis cluster using SRX Series devices?
- A. 0
- B. 1
- C. 2
- D. 3
正解：B
質問 # 21
You want to use IPS signatures to monitor traffic.
Which module in the AppSecure suite will help in this task?
- A. AppQoS
- B. AppFW
- C. APPID
- D. AppTrack
正解：B
解説：
The AppFW module in the AppSecure suite provides IPS signatures that can be used to monitor traffic and detect malicious activities. AppFW also provides other security controls such as Web application firewall, URL filtering, and application-level visibility.
質問 # 22
Click the Exhibit button.
You are validating the configuration template for device access. The commands in the exhibit have been entered to secure IP access to an SRX Series device.
Referring to the exhibit, which two statements are true? (Choose two.)
- A. The loopback interface blocks invalid traffic on its exit from the device.
- B. The device manager can access the device from 10.253.1.2.
- C. The device manager can access the device from 192.168.11.248.
- D. The loopback interface blocks invalid traffic on its entry into the device.
正解：B、D
解説：
The commands in the exhibit show how to configure a firewall filter on the loopback interface (lo0) of an SRX Series device. The loopback interface is a gateway for all the control traffic that enters the Routing Engine of the device. The firewall filter can be used to monitor and protect this control traffic from various attacks. Two statements that are true based on the exhibit are:
The loopback interface blocks invalid traffic on its entry into the device: The firewall filter applied on lo0 has a term that matches any packet with an invalid source address (such as 0.0.0.0/8 or 127.0.0.0/8) and discards it. This prevents spoofing or DoS attacks using invalid source addresses.
The device manager can access the device from 10.253.1.2: The firewall filter applied on lo0 has a term that matches any packet with a source address of 10.253.1.2 and accepts it. This allows the device manager to access the device from this IP address using protocols such as SSH, Telnet, HTTP, or HTTPS.
質問 # 23
Which three statements are true about the difference between cSRX-based virtual security deployments and vSRX-based virtual security deployments? (Choose three.)
- A. cSRX-based solutions are more scalable than vSRX-based solutions.
- B. vSRX and cSRX both provide Layer 2 to Layer 7 secure services.
- C. vSRX provides faster deployment time and faster reboots compared to cSRX.
- D. vSRX provides Layer 2 to Layer 7 secure services and cSRX provides Layer 4 to Layer 7 secure services.
- E. cSRX requires less storage and memory space for a given deployment than vSRX-based solutions.
正解：A、D、E
解説：
https://www.juniper.net/documentation/en_US/day-one-books/topics/concept/juniper-vsrx-versus- csrx.html
質問 # 24
Your manager asks you to provide firewall and NAT services in a private cloud.
Which two solutions will fulfill the minimum requirements for this deployment? (Choose two.)
- A. a cSRX for firewall services and a separate cSRX for NAT services
- B. a vSRX for firewall services and a separate vSRX for NAT services
- C. a single cSRX
- D. a single vSRX
正解：D
解説：
Explanation
A vSRX is a virtualized security platform that runs on various hypervisors and cloud environments. It provides firewall and NAT services, as well as other security features, such as IPS, VPN, UTM, and AppSecure. A single vSRX can fulfill the minimum requirements for providing firewall and NAT services in a private cloud, as it can be deployed as a gateway or an edge device, and can scale up or down as needed. A vSRX can also interoperate with other Juniper and third-party products, such as Contrail Networking, Junos Space Security Director, and Sky ATP. A single vSRX is more cost-effective and simpler to manage than having separate vSRX instances for firewall and NAT services. A cSRX is a containerized version of vSRX that runs on Linux-based platforms. It provides similar security features as vSRX, but with a smaller footprint and faster deployment. However, a cSRX is not yet supported on all cloud environments, and it may have some limitations compared to vSRX, such as lower throughput and fewer interfaces. Therefore, a single cSRX may not be able to fulfill the minimum requirements for providing firewall and NAT services in a private cloud, depending on the specific cloud platform and the performance and scalability needs. A cSRX for firewall services and a separate cSRX for NAT services would also introduce more complexity and overhead than a single vSRX. References: vSRX Overview, cSRX Overview, JNCIP-SEC Certification
質問 # 25
You must deploy AppSecure in your network to block risky applications.
In this scenario, which two AppSecure features are required? (Choose two.)
- A. AppID
- B. AppTrack
- C. AppFW
- D. APBR
正解：A、B
質問 # 26
What is the default session timeout value for ICMP and UDP traffic?
- A. 30 seconds
- B. 5 minutes
- C. 60 seconds
- D. 30 minutes
正解：C
質問 # 27
The output shown in the exhibit is displayed in which format?
- A. sd-syslog
- B. binary
- C. WELF
- D. syslog
正解：D
質問 # 28
Which two statements about SRX Series device chassis clusters are correct? (Choose two.)
- A. The chassis cluster can contain a maximum of two devices.
- B. The chassis cluster can contain a maximum of three devices.
- C. The chassis cluster data plane is connected with SPC ports.
- D. The chassis cluster data plane is connected with revenue ports.
正解：A、D
解説：
Explanation
SRX Series device chassis clusters are created by physically connecting two identical cluster-supported SRX Series devices using a pair of the same type of Ethernet connections. The connection is made for both a control link and a fabric (data) link between the two devices. The chassis cluster data plane is connected with revenue ports, which are the ports that carry user traffic. The chassis cluster can contain a maximum of two devices, as only two nodes can form a cluster. The chassis cluster data plane is not connected with SPC ports, which are the ports that provide services processing. The chassis cluster cannot contain more than two devices, as this would violate the cluster design. References: Chassis Cluster Overview, Connecting SRX Series Firewalls to Create a Chassis Cluster
質問 # 29
What are two types of attack objects used by IPS on SRX Series devices? (Choose two.)
- A. signature-based attacks
- B. protocol anomaly-based attacks
- C. DDoS-based attacks
- D. spam-based attacks
正解：A、B
質問 # 30
On an SRX Series firewall, what are two ways that Encrypted Traffic Insights assess the threat of the traffic?
(Choose two.)
- A. It reviews the timing and frequency of the connections.
- B. It decrypts the data to validate the hash.
- C. It decrypts the file in a sandbox.
- D. It validates the certificates used.
正解：A、D
解説：
Explanation
Encrypted Traffic Insights is a feature of Juniper ATP Cloud and SRX Series firewalls that can detect malicious threats that are hidden in encrypted traffic without intercepting and decrypting the traffic. It permits organizations greater visibility and policy control over encrypted traffic, without requiring resource-intensive SSL Decryption1.
Encrypted Traffic Insights assesses the threat of the traffic by using two methods:
It validates the certificates used by the external servers that the internal hosts are trying to connect to. It compares the certificate signatures with a blocklist of known malicious certificates and also checks the certificate validity, issuer, and subject. If the certificate is invalid or matches a malicious signature, the connection is blocked or alerted2.
It reviews the timing and frequency of the connections to the external servers. It uses behavior analysis and machine learning to identify patterns and anomalies that indicate malicious activity, such as command and control (C&C) communications, botnet traffic, or data exfiltration. It also uses threat intelligence feeds to enrich the analysis and provide additional context2.
Encrypted Traffic Insights does not decrypt the file or the data in a sandbox or to validate the hash, as these methods would require breaking the encryption of the traffic, which would violate data privacy laws and introduce latency and performance issues21. References:
3: SRX5400, SRX5600, SRX5800 Firewalls Datasheet - Juniper Networks
2: Encrypted Traffic Insights Overview and Benefits | ATP Cloud | Juniper ...
1: Juniper Networks Expands Connected Security Portfolio with Encrypted ...
質問 # 31
You have just configured source NAT with a pool of addresses within the same subnet as the egress interface. What else must be configured to make the addresses in the pool usable?
- A. proxy ARP
- B. address persistence
- C. destination NAT
- D. static NAT
正解：A
質問 # 32
Which statement describes the AppTrack module in AppSecure?
- A. The AppTrack module provides enforcement with the ability to block traffic, based on specific applications.
- B. The AppTrack module provides control by the routing of traffic, based on the application.
- C. The AppTrack module identifies the applications that are present in network traffic.
- D. The AppTrack module provides visibility and volumetric reporting of application usage on the network.
正解：C
質問 # 33
......
Juniper JN0-335試験は、Juniper Networks Security Technologiesにおける候補者の知識とスキルを評価する包括的な認定試験です。この認定は、セキュリティを専門とし、Juniper Networks Security Devicesと協力したいITの専門家に最適です。 JNCIS-SEC認定は、ジュニパーネットワークのセキュリティテクノロジーを使用する組織によって世界的に認識され、高く評価されています。
Juniper試験練習テスト問題で高得点を目指そう：https://www.passtest.jp/Juniper/JN0-335-shiken.html
検証された材料は決まってこれ！JN0-335：https://drive.google.com/open?id=1yUkrxGkiFTK6S3SYugx1DrpAIv4h3tix