Home / Juniper / JN0-636

Juniper JN0-636 Practice Test - Questions Answers, Page 9

Question list

List of questions

Question 81

(0)

You have a webserver and a DNS server residing in the same internal DMZ subnet. The public Static NAT addresses for the servers are in the same subnet as the SRX Series devices internet-facing inter

Question 82

(0)

You are not able to activate the SSH honeypot on the all-in-one Juniper ATP appliance. What would be a cause of this problem?

Question 83

(0)

You must implement an IPsec VPN on an SRX Series device using PKI certificates for authentication. As part of the implementation, you are required to ensure that the certificate submission, renewal

Question 84

(0)

Exhibit. Referring to the exhibit, which two statements are true? (Choose two.)

Question 85

(0)

You are asked to configure a security policy on the SRX Series device. After committing the policy, you receive the "Policy is out of sync between RE and PFE <SPU-name(s)>." error. Which comm

Question 86

(0)

Exhibit. Referring to the exhibit, a spoke member of an ADVPN is not functioning correctly. Which two commands will solve this problem? (Choose two.)

Question 87

(0)

You are connecting two remote sites to your corporate headquarters site; you must ensure that all traffic is secured and only uses a single Phase 2 SA for both sites. In this scenario, which VPN sh

Question 88

(0)

You have the NAT rule, shown in the exhibit, applied to allow communication across an IPsec tunnel between your two sites with identical networks. Which statement is correct in this scenario?

Question 89

(0)

You are asked to share threat intelligence from your environment with third party tools so that those tools can be identify and block lateral threat propagation from compromised hosts. Which two st

Question 90

(0)

You want to enable inter-tenant communica on with tenant system. In this Scenario, Which two solutions will accomplish this task?

Question 81

You have a webserver and a DNS server residing in the same internal DMZ subnet. The public Static NAT addresses for the servers are in the same subnet as the SRX Series devices internet-facing interface. You implement DNS doctoring to ensure remote users can access the webserver.Which two statements are true in this scenario?

(Choose two.)

The DNS doctoring ALG is not enabled by default.

The Proxy ARP feature must be configured.

The DNS doctoring ALG is enabled by default.

The DNS CNAME record is translated.

Show Answer Comment (0)

Question 82

You are not able to activate the SSH honeypot on the all-in-one Juniper ATP appliance.

What would be a cause of this problem?

The collector must have a minimum of two interfaces.

The collector must have a minimum of three interfaces.

The collector must have a minimum of five interfaces.

The collector must have a minimum of four interfaces.

Show Answer Comment (0)

Question 83

You must implement an IPsec VPN on an SRX Series device using PKI certificates for authentication.

As part of the implementation, you are required to ensure that the certificate submission, renewal, and retrieval processes are handled automatically from the certificate authority.

In this scenario, which statement is correct.

You can use CRL to accomplish this behavior.

You can use SCEP to accomplish this behavior.

You can use OCSP to accomplish this behavior.

You can use SPKI to accomplish this behavior.

Show Answer Comment (0)

Question 84

Exhibit.

Referring to the exhibit, which two statements are true? (Choose two.)

Juniper Networks will not investigate false positives generated by this custom feed.

The custom infected hosts feed will not overwrite the Sky ATP infected host's feed.

The custom infected hosts feed will overwrite the Sky ATP infected host's feed.

Juniper Networks will investigate false positives generated by this custom feed.

Show Answer Comment (0)

Question 85

You are asked to configure a security policy on the SRX Series device. After committing the policy, you receive the "Policy is out of sync between RE and PFE <SPU-name(s)>." error.

Which command would be used to solve the problem?

request security polices resync

request service-deployment

request security polices check

restart security-intelligence

Show Answer Comment (0)

Question 86

Exhibit.

Referring to the exhibit, a spoke member of an ADVPN is not functioning correctly.

Which two commands will solve this problem? (Choose two.)

[edit interfaces]user@srx# delete st0.0 multipoint

[edit security ike gateway advpn-gateway]user@srx# delete advpn partner

[edit security ike gateway advpn-gateway]user@srx# set version v1-only

[edit security ike gateway advpn-gateway]user@srx# set advpn suggester disable

Show Answer Comment (0)

Question 87

You are connecting two remote sites to your corporate headquarters site; you must ensure that all traffic is secured and only uses a single Phase 2 SA for both sites.

In this scenario, which VPN should be used?

An IPsec group VPN with the corporate firewall acting as the hub device.

Full mesh IPsec VPNs with tunnels between all sites.

A hub-and-spoke IPsec VPN with the corporate firewall acting as the hub device.

A full mesh Layer 3 VPN with the corporate firewall acting as the hub device.

Show Answer Comment (0)

Question 88

You have the NAT rule, shown in the exhibit, applied to allow communication across an IPsec tunnel between your two sites with identical networks. Which statement is correct in this scenario?

The NAT rule with translate the source and destination addresses.

The NAT rule will only translate two addresses at a time.

The NAT rule in applied to the N/A routing instance.

10 packets have been processed by the NAT rule.

Show Answer Comment (0)

Question 89

You are asked to share threat intelligence from your environment with third party tools so that those tools can be identify and block lateral threat propagation from compromised hosts.

Which two steps accomplish this goal? (Choose Two)

Configure application tokens in the SRX Series firewalls to limit who has access

Enable Juniper ATP Cloud to share threat intelligence

Configure application tokens in the Juniper ATP Cloud to limit who has access

Enable SRX Series firewalls to share Threat intelligence with third party tool.

Show Answer Comment (0)

Suggested answer: B, C

Explanation:

To share threat intelligence from your environment with third party tools, you need to enable Juniper

ATP Cloud to share threat intelligence and configure application tokens in the Juniper ATP Cloud to limit who has access. The other options are incorrect because:

A) Configuring application tokens in the SRX Series firewalls is not necessary or sufficient to share threat intelligence with third party tools. Application tokens are used to authenticate and authorize requests to the Juniper ATP Cloud API, which can be used to perform various operations such as submitting files, querying C&C feeds, and managing allowlists and blocklists1. However, to share threat intelligence with third party tools, you need to enable the TAXII service in the Juniper ATP Cloud, which is a different protocol for exchanging threat information2.

D) Enabling SRX Series firewalls to share threat intelligence with third party tools is not possible or supported. SRX Series firewalls can send potentially malicious objects and files to the Juniper ATP Cloud for analysis and receive threat intelligence from the Juniper ATP Cloud to block malicious traffic3. However, SRX Series firewalls cannot directly share threat intelligence with third party tools.

You need to use the Juniper ATP Cloud as the intermediary for threat intelligence sharing.

Therefore, the correct answer is B and C. You need to enable Juniper ATP Cloud to share threat intelligence and configure application tokens in the Juniper ATP Cloud to limit who has access. To do so, you need to perform the following steps:

Enable and configure the TAXII service in the Juniper ATP Cloud. TAXII (Trusted Automated eXchange of Indicator Information) is a protocol for communication over HTTPS of threat information between parties. STIX (Structured Threat Information eXpression) is a language used for reporting and sharing threat information using TAXII. Juniper ATP Cloud can contribute to STIX reports by sharing the threat intelligence it gathers from file scanning. Juniper ATP Cloud also uses threat information from STIX reports as well as other sources for threat prevention2. To enable and configure the TAXII service, you need to select Configure > Threat Intelligence Sharing in the Juniper ATP Cloud WebUI, move the knob to the right to Enable TAXII, and move the slidebar to designate a file sharing threshold2.

Configure application tokens in the Juniper ATP Cloud. Application tokens are used to authenticate and authorize requests to the Juniper ATP Cloud API and the TAXII service. You can create and manage application tokens in the Juniper ATP Cloud WebUI by selecting Configure > Application Tokens. You can specify the name, description, expiration date, and permissions of each token. You can also revoke or delete tokens as needed. You can use the application tokens to limit who has access to your shared threat intelligence by granting or denying permissions to the TAXII service1.

Reference:

Threat Intelligence Open API Setup Guide

Configure Threat Intelligence Sharing

About Juniper Advanced Threat Prevention Cloud