JN0-637 Certification - Valid Exam Dumps Questions Study Guide! (Updated 125 Questions) [Q52-Q75]

NEW QUESTION 52
You are connecting two remote sites to your corporate headquarters site.You must ensure that all traffic is secured and sent directly between sites In this scenario, which VPN should be used?

IPsec ADVPN

hub-and-spoke IPsec VPN

Layer 2 VPN

full mesh Layer 3 VPN with EBGP

NEW QUESTION 53
Which two statements are correct about automated threat mitigation with Security Director?
(Choose two.)

Infected hosts are tracked by their IP address.

Infected hosts are tracked by their chassis serial number.

Infected hosts are tracked by their MAC address.

Infected hosts are tracked by their user identity.

NEW QUESTION 54
You have deployed a new site as shown in the exhibit. Hosts in the 10.10.10.0/24 network must access the DB1 server. The DB1 server must also have internet access the DB1 server encrypted.
Which two configuration statements will be required as part of the configuration on SRX1 to satisfy this requirement? (Choose two)

set security macsec interfaces ge-0/0/1 connectivity association access-sw

set security forwarding-options secure-wire access-sw interface ge-0/0/1.0

set security macsec connectivity-association access-sw security-mode static-cak

set protocols 12-learning global mode transparent-bridge

NEW QUESTION 55
Exhibit

You are trying to configure an IPsec tunnel between SRX Series devices in the corporate office and branch1. You have committed the configuration shown in the exhibit, but the IPsec tunnel is not establishing.
In this scenario, what would solve this problem.

Add multipoint to the st0.0 interface configuration on the branch1 device.

Change the IKE proposal-set to compatible on the branch1 and corporate devices.

Change the local identity to inet advpn on the branch1 device.

Change the IKE mode to aggressive on the branch1 and corporate devices.

NEW QUESTION 56
You are required to deploy a security policy on an SRX Series device that blocks all known Tor network IP addresses.
Which two steps will fulfill this requirement? (Choose two.)

Enroll the devices with Juniper ATP Appliance.

Enroll the devices with Juniper ATP Cloud.

Enable a third-party Tor feed.

Create a custom feed containing all current known MAC addresses.

NEW QUESTION 57
You have configured the backup signal route IP for your multinode HA deployment, and the ICL link fails.
Which two statements are correct in this scenario? (Choose two.)

The current active node retains the active role.

The active node removes the active signal route.

The backup node changes the routing preference to the other node at its medium priority.

The active node keeps the active signal route.

NEW QUESTION 58
You have designed the firewall filter shown in the exhibit to limit SSH control traffic to yours SRX Series device without affecting other traffic.
Which two statement are true in this scenario? (Choose two.)

The filter should be applied as an output filter on the loopback interface.

Applying the filter will achieve the desired result.

Applying the filter will not achieve the desired result.

The filter should be applied as an input filter on the loopback interface.

NEW QUESTION 59
Exhibit:

You have deployed an SRX Series device as shown in the exhibit. The devices in the Local zone have recently been added, but their SRX interfaces have not been configured. You must configure the SRX to meet the following requirements:
* Devices in the 10.1.1.0/24 network can communicate with other devices in the same network but not with other networks or the SRX.
* You must be able to apply security policies to traffic flows between devices in the Local zone.
Which three configuration elements will be required as part of your configuration? (Choose three.)

set security zones security-zone Local interfaces ge-0/0/1.0

set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan-members 10

set protocols l2-learning global-mode switching

set protocols l2-learning global-mode transparent-bridge

set security zones security-zone Local interfaces irb.10

NEW QUESTION 60
You have a multinode HA default mode deployment and the ICL is down. In this scenario, what are two ways that the SRX Series devices verify the activeness of their peers? (Choose two.)

Custom IP addresses may be configured for the activeness probe.

Fabric link heartbeats are used to verify the activeness of the peers.

Each peer sends a probe with the virtual IP address as the destination IP address.

Each peer sends a probe with the virtual IP address as the source IP address and the upstream router as the destination IP address.

NEW QUESTION 61
Referring to the exhibit,

which two statements are correct about the NAT configuration? (Choose two.)

Both the internal and the external host can initiate a session after the initial translation.

Only a specific host can initiate a session to the reflexive address after the initial session.

Any external host will be able to initiate a session to the reflexive address.

The original destination port is used for the source port for the session.

NEW QUESTION 62
Exhibit

You are using traceoptions to verity NAT session information on your SRX Series device Referring to the exhibit, which two statements are correct? (Choose two.)

This packet is part of an existing session.

The SRX device is changing the source address on this packet from

This is the first packet in the session

The SRX device is changing the destination address on this packet 10.0.1 1 to 172 20.101.10.

NEW QUESTION 63
Exhibit:

Which two statements are correct about the output shown in the exhibit. (Choose Two)

The data shown requires a traceoptions flag of basic-datapath.

The data shown requires a traceoptions flag of host-traffic.

The packet is dropped by the default security policy.

The packet is dropped by a configured security policy.

NEW QUESTION 64
Which two statements about the differences between chassis cluster and multinode HA on SRX series devices are true? (Choose Two)

Multinode HA member nodes require Layer 2 connectivity.

Multinode HA supports Layer 2 and Layer 3 connectivity between nodes.

Multinode HA requires Layer 3 connectivity between nodes.

Chassis cluster member nodes require Layer 2 connectivity.

NEW QUESTION 65
Exhibit:

You are troubleshooting a new IPsec VPN that is configured between your corporate office and the RemoteSite1 SRX Series device. The VPN is not currently establishing. The RemoteSite1 device is being assigned an IP address on its gateway interface using DHCP.
Which action will solve this problem?

On the RemoteSite1 device, change the IKE gateway external interface to st0.0.

On both devices, change the IKE version to use version 2 only.

On both devices, change the IKE policy proposal set to basic.

On both devices, change the IKE policy mode to aggressive.

NEW QUESTION 66
Exhibit.

Referring to the exhibit, a spoke member of an ADVPN is not functioning correctly.
Which two commands will solve this problem? (Choose two.)

[edit interfaces]
user@srx# delete st0.0 multipoint

[edit security ike gateway advpn-gateway]
user@srx# delete advpn partner

[edit security ike gateway advpn-gateway]
user@srx# set version v1-only

[edit security ike gateway advpn-gateway]
user@srx# set advpn suggester disable

NEW QUESTION 67
The exhibit shows part of the flow session logs.

Which two statements are true in this scenario? (Choose two.)

The existing session is found in the table, and the fast path process begins.

This packet arrives on interface ge-0/0/4.0.

Junos captures a TCP packet from source address 172.20.101.10 destined to 10.0.1.129.

Destination NAT occurs.

NEW QUESTION 68
Your IPsec tunnel is configured with multiple security associations (SAs). Your SRX Series device supports the CoS-based IPsec VPNs with multiple IPsec SAs feature. You are asked to configure CoS for this tunnel.
Which two statements are true in this scenario? (Choose two.)

The local and remote gateways do not need the forwarding classes to be defined in the same order.

A maximum of four forwarding classes can be configured for a VPN with the multi-sa forwarding- classes statement.

The local and remote gateways must have the forwarding classes defined in the same order.

A maximum of eight forwarding classes can be configured for a VPN with the multi-sa forwarding- classes statement.

NEW QUESTION 69
You are connecting two remote sites to your corporate headquarters site; you must ensure that all traffic is secured and only uses a single Phase 2 SA for both sites.
In this scenario, which VPN should be used?

An IPsec group VPN with the corporate firewall acting as the hub device.

Full mesh IPsec VPNs with tunnels between all sites.

A hub-and-spoke IPsec VPN with the corporate firewall acting as the hub device.

A full mesh Layer 3 VPN with the corporate firewall acting as the hub device.

NEW QUESTION 70
Which two statements are correct about DNS doctoring?

The DNS ALG must be disabled.

Proxy ARP is required if your NAT pool for the server is on the same subnet as the uplink interface.

Proxy ARP is required if your NAT pool for the server is on a different subnet as the uplink interface

The DNS ALG must be enabled.

NEW QUESTION 71
Refer to the exhibit,

which two potential violations will generate alarm ? (Choose Two)

the number of policy violations by a source network identifier

the ratio of policy violation traffic compared to accepted traffic.

the number of policy violation by a destination TCP port

the number of policy violation to an application within a specified period

NEW QUESTION 72
You are using ADVPN to deploy a hub-and-spoke VPN to connect your enterprise sites.
Which two statements are true in this scenario? (Choose two.)

ADVPN creates a full-mesh topology.

IBGP routing is required.

OSPF routing is required.

Certificate-based authentication is required.

NEW QUESTION 73
Exhibit:

You are having problems configuring advanced policy-based routing.
What should you do to solve the problem?

Apply a policy to the APBR RIB group to only allow the exact routes you need.

Change the routing instance to a forwarding instance.

Change the routing instance to a virtual router instance.

Remove the default static route from the main instance configuration.

NEW QUESTION 74
Which two elements are necessary to configure a rule under an APBR profile? (Choose Two)

instance type

match condition

then action

RIB group

NEW QUESTION 75
You have deployed an SRX Series device at your network edge to secure Internet-bound sessions for your local hosts using source NAT. You want to ensure that your users are able to interact with applications on the Internet that require more than one TCP session for the same application session.
Which two features would satisfy this requirement? (Choose two.)

address persistence

STUN

persistent NAT

double NAT

JN0-637 Certification – Valid Exam Dumps Questions Study Guide! (Updated 125 Questions) [Q52-Q75]

Leave a Reply Cancel reply