♥♥ 2021 NEW RECOMMEND ♥♥
Free VCE & PDF File for Juniper JN0-633 Real Exam (Full Version!)
★ Pass on Your First TRY ★ 100% Money Back Guarantee ★ Realistic Practice Exam Questions
Free Instant Download NEW JN0-633 Exam Dumps (PDF & VCE):
Available on:
http://www.surepassexam.com/JN0-633-exam-dumps.html
Q41. Your company is using a dynamic VPN configuration on their SRX device. Your manager asks you to enforce password expiration policies for all VPN users.
Which authentication method meets the requirement?
A. local password database
B. TACACS+
C. RADIUS
D. LDAP
Answer: D
Explanation:
Reference : http://kb.juniper.net/InfoCenter/index?page=content&id=KB17423&actp=RSS
Q42. What are three techniques to mark DSCP values on an SRX Series device? (Choose three.)
A. IDP attack action-based DSCP rewriters
B. 802.11Q
C. VLAN rewrite
D. ALG-based DSCP rewriters
E. Layer 7 application-based DSCP rewriters.
Answer: A,D,E
Q43. You are asked to implement the AppFW feature on an SRX Series device. Which three tasks must be performed to make the feature work? (Choose three.)
A. Configure a firewall filter that includes the application-firewall policy.
B. Install an IPS license.
C. Install an AppSecure license.
D. Configure a security policy that includes the application-firewall policy.
E. Configure an application-firewall policy.
Answer: C,D,E
Q44. Which statement is true about Layer 2 zones when implementing transparent mode security?
A. All interfaces in the zone must be configured with the protocol family mpls.
B. All interfaces in the zone must be configured with the protocol family inet.
C. All interfaces in the zone must be configured with the protocol family bridge.
D. All interfaces in the zone must be configured with the protocol family inet6.
Answer: C
Explanation:
Reference (page no 12) http://www.juniper.net/techpubs/en_US/junos12.1x44/information-products/pathway-pages/security/security-layer2-bridging-transparent-mode.pdf
Q45. You are using logical systems to segregate customers. You have a requirement to enable communication between the logical systems.What are two ways to accomplish this goal? (Choose two.)
A. Use a shared DMZ zone to connect the logical systems together.
B. Use a virtual tunnel (vt-) interface to connect the logical systems together.
C. Use an external cable to connect the ports from the two logical systems.
D. Use an interconnect LSYS to connect the logical systems together.
Answer: C,D
Explanation:
Reference :http://www.juniper.net/techpubs/en_US/junos11.4/information-products/topic-collections/security/software-all/logical-systems-config/index.html?topic-53861.html
Q46. Which two statements are true about persistent NAT? (Choose two.)
A. Thepermit target-host-portstatement allows an external host to initiate a session to an internal host on any port, provided the internal host previously sent a packet to the external host.
B. Thepermit target-hoststatement allows an external host to initiate a session to an internal host on any port, provided the internal host previously sent a packet to the external host.
C. Port overloading must be enabled for Interface-based persistent NAT.
D. Port overloading must be disabled for Interface-based persistent NAT.
Answer: B,D
Q47. You recently implemented application firewall rules on an SRX device to act upon encrypted traffic. However, the encrypted traffic is not being correctly identified.
Which two actions will help the SRX device correctly identify the encrypted traffic? (Choose two.)
A. Enable heuristics to detect the encrypted traffic.
B. Disable the application system cache.
C. Use the junos:UNSPECIFIED-ENCRYPTED application signature.
D. Use the junos:SPECIFIED-ENCRYPTED application signature.
Answer: A,C
Explanation: Reference:http://www.juniper.net/techpubs/en_US/junos12.1x44/topics/concept/encrypted-p2p-heuristics-detection.html
Q48. Your company is providing multi-tenant security services on an SRX5800 cluster. You have been asked to create a new logical system (LSYS) for a customer. The customer must be able to access and manage new resources within their LSYS.
How do you accomplish this goal?
A. Create the new LSYS, allocate resources, and then create the user administrator role so that the customer can manage their allocated resources.
B. Create the new LSYS, and then create the user administrator role so that the customer can allocate and manage resources.
C. Create the new LSYS, and then create the master adminstrator role for the LSYS so that the customer can allocate and manage resources.
D. Create the new LSYS, then request the required resources from the customer, and create the required resources.
Answer: A
Explanation:
Reference
http://www.juniper.net/techpubs/en_US/junos12.1/topics/task/configuration/logical-system-security-user-lsys-overview-configuring.html
Q49. Click the Exhibit button.
[edit]
useu@host# run show log debug
Feb3 22:04:32 22:04:31.983991:CID-0:RT:ge-0/0/1.0:5.0.0.25/59028-
>25.0.0.25/23, tcp, flag 18
Feb3 22:04:32 22:04:31.983997:CID-0:RT: find flow: table 0x582738c0, hash 53561(0xffff), sa 5.0.0.25, da 5.0.0.25, sp 59028, dp 23, proto 6, tok 20489
Feb3 22:04:32 22:04:31.984004:CID-0:RT:Found: session id 0x14f98. sess tok 20489
Feb3 22:04:32 22:04:31.984005:CID-0:RT: flow got session. Feb3 22:04:32 22:04:31.984006:CID-0:RT: flow session id 85912
Feb3 22:04:32 22:04:31.984009:CID-0:RT: vector bits 0x2 vector 0x53a949e8 Feb3 22:04:32 22:04:31.984012:CID-0:RT: tcp sec check.
Feb3 22:04:32 22:04:31.984015:CID-0:RT:mbuf 0x4a82cd80, exit nh 0xa0010
Which two statements are true regarding the output shown in the exhibit? (Choose two.)
A. The outgoing interface is ge-0/0/1.0.
B. The packet is subject to fast-path packet processing.
C. The packet is part of the first-packet path processing.
D. TCP sequence checking is enabled.
Answer: C,D
Q50. You are asked to deploy a group VPN between various sites associated with your company. The gateway devices at the remote locations are SRX240 devices.
Which two statements about the new deployment are true? (Choose two.)
A. The networks at the various sites must use NAT.
B. The participating endpoints in the group VPN can belong to a chassis cluster.
C. The networks at the various sites cannot use NAT.
D. The participating endpoints in the group VPN cannot be part of a chassis cluster.
Answer: C,D
Explanation:
Reference :http://www.thomas-krenn.com/redx/tools/mb_download.php/mid.x6d7672335147784949386f3d/Manual_Confi guring_Group_VPN_Juniper_SRX.pdf http://kb.juniper.net/library/CUSTOMERSERVICE/GLOBAL_JTAC/NT260/SRX_HA_Deployment_Guide_v1.2.pdf