You have an initial setup of ADVPN with two spokes and a hub. A host at partner Spoke-1 is sending traffic to a host at partner Spoke-2.In this scenario, which statement is true?

Spoke-1 will establish a VPN to Spoke-2 when this is first deployed, so traffic will be sent immediately to Spoke-2.

Spoke-1 will send the traffic through the hub and not use a direct VPN to Spoke-2.

Spoke-1 will establish the tunnel to Spoke-2 before sending any of the host traffic.

Spoke-1 will send the traffic destined to Spoke-2 through the hub until the VPN is established between the spokes.

Referring to the exhibit, which two statements about User1 are true? (Choose two.)

User1 has access to the configuration specific to their assigned logical system.

User1 is logged in to logical system LSYS-1.

User1 has access to the configuration specific to their assigned logical system.

User1 is logged in to logical system LSYS-1.

User1 can add logical units to an interface that a primary administrator has not previously assigned.

User1 can view outputs from other user logical systems.

Exhibit: You are asked to ensure that Internet users can access the company's internal webserver using its FQDN. However, the internal DNS server's A record only points to the webserver's private address.Referring to the exhibit, which two actions are required to complete this task? (Choose two.)

Configure static NAT for both the DNS server and the webserver.

Configure proxy ARP on ge-0/0/3.

Configure static NAT for both the DNS server and the webserver.

Configure destination NAT for both the DNS server and the webserver.

Configure proxy ARP on ge-0/0/3.

How does an SRX Series device examine exception traffic?

The device examines the host-inbound traffic for the ingress interface and zone.

The device examines the host-outbound traffic for the ingress interface and zone.

The device examines the host-inbound traffic for the egress interface and zone.

The device examines the host-outbound traffic for the egress interface and zone.

Exhibit: Referring to the exhibit, a default static route on SRX-1 sends all traffic to ISP-

Enable AppTrack to keep track of the sessions and zones for the streaming video traffic.

You have configured APBR to send all requests for streaming video traffic to ISP-B. However, the return traffic from the streaming video server is coming through ISP-A, and the traffic is being dropped by SRX-1. You can only make changes on SRX-1. How do you solve this problem?

Place both ISP-facing interfaces in the same zone.

Change the APBR routing instance from a forwarding instance to a virtual router instance.

Enable AppTrack to keep track of the sessions and zones for the streaming video traffic.

Configure BGP to control the return path of the streaming video traffic.

You are configuring an interconnect logical system that is configured as a VPLS switch to allow two logical systems to communicate.Which two parameters are required when configuring the logical tunnel interfaces? (Choose two.)

The logical tunnel interfaces should be configured with two logical unit pairs per logical system interconnect.

Encapsulation ethernet-vpls must be used.

Encapsulation ethernet must be used.

The virtual tunnel interfaces should only be configured with two logical unit pairs per logical system interconnect.

The logical tunnel interfaces should be configured with two logical unit pairs per logical system interconnect.

Encapsulation ethernet-vpls must be used.

Exhibit: You have configured a CoS-based VPN that is not functioning correctly.Referring to the exhibit, which action will solve the problem?

You must delete one forwarding class.

You must change the loss priorities of the forwarding classes to low.

You must use inet precedence instead of DSCP.

You must change the code point for the DB-data forwarding class to 10000.

Exhibit: Referring to the exhibit, which two statements are true? (Choose two.)

Hosts in the Local zone can be enabled for control plane access to the SRX.

Hosts in the Local zone can communicate with hosts in the Trust zone with a security policy.

Hosts in the Local zone can be enabled for control plane access to the SRX.

An IRB interface is required to enable communication between the Trust and the Untrust zones.

You can configure security policies for traffic flows between hosts in the Local zone.

Hosts in the Local zone can communicate with hosts in the Trust zone with a security policy.

Your customer needs embedded security in an EVPN-VXLAN solution.What are two benefits of adding an SRX Series device in this scenario? (Choose two.)

It enhances tunnel inspection for VXLAN encapsulated traffic with Layer 4-7 security services.

It adds extra security with the capabilities of an enterprise-grade firewall in the EVPN-VXLAN overlay.

It enhances tunnel inspection for VXLAN encapsulated traffic with Layer 4-7 security services.

It adds extra security with the capabilities of an enterprise-grade firewall in the EVPN-VXLAN underlay.

It adds extra security with the capabilities of an enterprise-grade firewall in the EVPN-VXLAN overlay.

It enhances tunnel inspection for VXLAN encapsulated traffic with only Layer 4 security services.

You want to use a security profile to limit the system resources allocated to user logical systems.In this scenario, which two statements are true? (Choose two.)

If you do not specify anything for a resource, no resource is reserved for a specific logical system, but the entire system can compete for resources up to the maximum available.

One security profile can be applied to multiple logical systems.

If nothing is specified for a resource, a default reserved resource is set for a specific logical system.

If you do not specify anything for a resource, no resource is reserved for a specific logical system, but the entire system can compete for resources up to the maximum available.

One security profile can only be applied to one logical system.

One security profile can be applied to multiple logical systems.

You are asked to configure tenant systems.Which two statements are true in this scenario? (Choose two.)

Tenant systems have their own configuration database.

You can commit multiple tenant systems at a time.

A tenant system can have only one administrator.

After successful configuration, the changes are merged into the primary database for each tenant system.

Tenant systems have their own configuration database.

You can commit multiple tenant systems at a time.

You need to set up source NAT so that external hosts can initiate connections to an internal device, but only if a connection to the device was first initiated by the internal device.Which type of NAT solution provides this functionality?

Persistent NAT with target host

Persistent NAT with any remote host

Persistent NAT with target host

Which two statements are correct about automated threat mitigation with Security Director? (Choose two.)

Infected hosts are tracked by their IP address.

Infected hosts are tracked by their MAC address.

Infected hosts are tracked by their IP address.

Infected hosts are tracked by their chassis serial number.

Infected hosts are tracked by their MAC address.

Infected hosts are tracked by their user identity.

You have deployed two SRX Series devices in an active/passive multimode HA scenario.In this scenario, which two statements are correct? (Choose two.)

Services redundancy group 0 (SRG0) is used for services that do not have a control plane state.

Services redundancy group 1 (SRG1) is used for services that have a control plane state.

Services redundancy group 1 (SRG1) is used for services that do not have a control plane state.

Services redundancy group 0 (SRG0) is used for services that have a control plane state.

Services redundancy group 0 (SRG0) is used for services that do not have a control plane state.

Services redundancy group 1 (SRG1) is used for services that have a control plane state.

Which two statements are true regarding NAT64? (Choose two.)

An SRX Series device should be in packet-based forwarding mode for IPv6.

An SRX Series device should be in flow-based forwarding mode for IPv4.

An SRX Series device should be in packet-based forwarding mode for IPv4.

An SRX Series device should be in packet-based forwarding mode for IPv6.

An SRX Series device should be in flow-based forwarding mode for IPv4.

An SRX Series device should be in flow-based forwarding mode for IPv6.

What is the advantage of using separate st0 logical units for each spoke connection?

It enables assignments of different settings to each logical unit.

It is easy to configure even when managing many st0 units.

Junos devices can exchange NHTB data automatically using this method.

It enables assignments of different settings to each logical unit.

You are asked to establish IBGP between two nodes, but the session is not established. To troubleshoot this problem, you configured trace options to monitor BGP protocol message exchanges. Referring to the exhibit, which action would solve the problem?

Add BGP to the lo0 host-inbound-traffic configuration.

Add the junos-host zone policy to permit the BGP packets.

Add a firewall filter to lo0 that permits the BGP packets.

Modify the security policy to permit the BGP packets.

Add BGP to the lo0 host-inbound-traffic configuration.

You are using trace options to troubleshoot a security policy on your SRX Series device. Referring to the exhibit, which two statements are true? (Choose two.)

The SSH traffic matches an existing session.

The security policy controls traffic destined to the SRX device.

The SSH traffic matches an existing session.

No entries are created in the SRX session table.

The traffic is not destined for the root logical system.

The security policy controls traffic destined to the SRX device.

Referring to the exhibit, which three statements about the multinode HA environment are true? (Choose three.)

Two services redundancy groups are available.

Node 1 will host services redundancy group 1 unless it is unavailable.

Session state is synchronized on both nodes.

Two services redundancy groups are available.

IP monitoring has failed for the services redundancy group.

Node 1 will host services redundancy group 1 unless it is unavailable.

Session state is synchronized on both nodes.

Node 2 will process transit traffic that it receives for services redundancy group 1.

A company has acquired a new branch office that has the same address space of one of its local networks, 192.168.100/24. The offices need to communicate with each other.Which two NAT configurations will satisfy this requirement? (Choose two.)

[edit security nat source] user@OfficeA# show rule-set OfficeBtoA { from zone OfficeB; to zone OfficeA; rule 1 { match { source-address 192.168.210.0/24; destination-address 192.168.200.0/24; } then { source-nat { interface; } } } }

[edit security nat source] user@OfficeB# show rule-set OfficeAtoB { from zone OfficeA; to zone OfficeB; rule 1 { match { source-address 192.168.200.0/24; destination-address 192.168.210.0/24; } then { source-nat { interface; } } } }

[edit security nat source] user@OfficeA# show rule-set OfficeBtoA { from zone OfficeB; to zone OfficeA; rule 1 { match { source-address 192.168.210.0/24; destination-address 192.168.200.0/24; } then { source-nat { interface; } } } }

[edit security nat static] user@OfficeA# show rule-set From-Office-B { from interface ge-0/0/0.0; rule 1 { match { destination-address 192.168.200.0/24; } then { static-nat { prefix 192.168.100.0/24; } } } }

[edit security nat static] user@OfficeB# show rule-set From-Office-A { from interface ge-0/0/0.0; rule 1 { match { destination-address 192.168.210.0/24; } then { static-nat { prefix 192.168.100.0/24; } } } }

[edit security nat source] user@OfficeB# show rule-set OfficeAtoB { from zone OfficeA; to zone OfficeB; rule 1 { match { source-address 192.168.200.0/24; destination-address 192.168.210.0/24; } then { source-nat { interface; } } } }

Referring to the exhibit, which two statements are correct about the NAT configuration? (Choose two.)

Both the internal and the external host can initiate a session after the initial translation.

Only a specific host can initiate a session to the reflexive address after the initial session.

Both the internal and the external host can initiate a session after the initial translation.

Only a specific host can initiate a session to the reflexive address after the initial session.

Any external host will be able to initiate a session to the reflexive address.

The original destination port is used for the source port for the session.

You are asked to establish a hub-and-spoke IPsec VPN using an SRX Series device as the hub. All of the spoke devices are third-party devices.Which statement is correct in this scenario?

You must statically configure the next-hop tunnel binding table entries for each of the third-party spoke devices.

You must ensure that you are using aggressive mode when incorporating third-party devices as your spokes.

You must statically configure the next-hop tunnel binding table entries for each of the third-party spoke devices.

You must create a policy-based VPN on the hub device when peering with third-party devices.

You must always peer using loopback addresses when using non-Junos devices as your spokes.

Exhibit: You are troubleshooting a new IPsec VPN that is configured between your corporate office and the RemoteSite1 SRX Series device. The VPN is not currently establishing. The RemoteSite1 device is being assigned an IP address on its gateway interface using DHCP.Which action will solve this problem?

On both devices, change the IKE policy mode to aggressive.

On the RemoteSite1 device, change the IKE gateway external interface to st0.0.

On both devices, change the IKE version to use version 2 only.

On both devices, change the IKE policy proposal set to basic.

On both devices, change the IKE policy mode to aggressive.

You are asked to see if your persistent NAT binding table is exhausted.Which show command would you use to accomplish this task?

show security nat source persistent-nat-table all

show security nat source persistent-nat-table summary

show security nat source summary

show security nat source pool all

show security nat source persistent-nat-table all

Which two statements are true regarding NAT64? (Choose two.)

An SRX Series device should be in flow-based forwarding mode for IPv4.

An SRX Series device should be in flow-based forwarding mode for IPv6.

An SRX Series device should be in flow-based forwarding mode for IPv4.

An SRX Series device should be in packet-based forwarding mode for IPv4.

An SRX Series device should be in packet-based forwarding mode for IPv6.

An SRX Series device should be in flow-based forwarding mode for IPv6.

Click the Exhibit button. Referring to the exhibit, which two statements are correct? (Choose two.)

You cannot secure intra-VLAN traffic with a security policy on this device.

The device cannot pass Layer 2 and Layer 3 traffic at the same time.

You cannot secure intra-VLAN traffic with a security policy on this device.

You can secure inter-VLAN traffic with a security policy on this device.

The device can pass Layer 2 and Layer 3 traffic at the same time.

The device cannot pass Layer 2 and Layer 3 traffic at the same time.

Which two statements are correct about automated threat mitigation with Security Director? (Choose two.)

It works with third-party switches.

It works with SRX Series devices.

It works with third-party switches.

It provides endpoint protection by running a Juniper ATP Cloud agent on the servers.

It provides endpoint protection by running a Juniper ATP Cloud agent on EX Series devices.

It works with SRX Series devices.

You are deploying OSPF over IPsec with an SRX Series device and third-party device using GRE.Which two statements are correct? (Choose two.)

The GRE interface should use lo0 as endpoints.

The GRE interface must be configured under the OSPF protocol.

The GRE interface should use lo0 as endpoints.

The OSPF protocol must be enabled under the VPN zone.

Overlapping addresses are allowed between remote networks.

The GRE interface must be configured under the OSPF protocol.

Click the Exhibit button. Referring to the exhibit, which two statements are correct? (Choose two.)

This device is the active node for SRG1.

The ge-0/0/3.0 and ge-0/0/4.0 interfaces are active and will respond to ARP requests to the virtual IP MAC address.

This device is the backup node for SRG1.

The ge-0/0/3.0 and ge-0/0/4.0 interfaces are not active and will not respond to ARP requests to the virtual IP MAC address.

This device is the active node for SRG1.

The ge-0/0/3.0 and ge-0/0/4.0 interfaces are active and will respond to ARP requests to the virtual IP MAC address.

Click the Exhibit button. Referring to the exhibit. SRX-1 and SRX-3 have to be connected using EBGP. The BGP configuration on SRX-1 and SRX-3 is verified and correct.Which configuration on SRX-2 would establish an EBGP connection successfully between SRX-1 and SRX-3?

The security policy to allow SRX-1 and SRX-3 to communicate on TCP port 179 should be configured.

The host-inbound-traffic statements do not allow EBGP traffic to traverse SRX-2.

The security policy to allow SRX-1 and SRX-3 to communicate on TCP port 79 should be configured.

The security policy to allow SRX-1 and SRX-3 to communicate on TCP port 169 should be configured.

The security policy to allow SRX-1 and SRX-3 to communicate on TCP port 179 should be configured.

You are attempting to ping an interface on your SRX Series device, but the ping is unsuccessful.What are three reasons for this behavior? (Choose three.)

The interface is not assigned to a security zone.

The interface's host-inbound-traffic security zone configuration does not permit ping

The ping traffic is matching a firewall filter.

The interface is not assigned to a security zone.

The interface's host-inbound-traffic security zone configuration does not permit ping

The ping traffic is matching a firewall filter.

The interface has multiple logical units configured.

You are deploying IPsec VPNs to securely connect several enterprise sites with ospf for dynamicrouting. Some of these sites are secured by third-party devices not running Junos.Which two statements are true for this deployment? (Choose two.)

Sites with overlapping address spaces can be supported.

OSPF over GRE over IPsec is required to enable intersite dynamic routing

OSPF over IPsec can be used for intersite dynamic routing.

Sites with overlapping address spaces can be supported.

OSPF over GRE over IPsec is required to enable intersite dynamic routing

Sites with overlapping address spaces cannot be supported.

Exhibit:You have deployed a pair of SRX series devices in a multimode HA environment. You need to enable IPsec encryption on the interchassis link.Referring to the exhibit, which three steps are required to enable ICL encryption? (Choose three.)

Install the Junos IKE package on both nodes.

Configure a VPN profile for the HA traffic and apply to both nodes.

Enable HA link encryption in the IPsec profile on both nodes.

Install the Junos IKE package on both nodes.

Enable OSPF for both interchassis link interfaces and tum on the dynamic-neighbors parameter.

Configure a VPN profile for the HA traffic and apply to both nodes.

Enable HA link encryption in the IPsec profile on both nodes.

Enable HA link encryption in the IKE profile on both nodes,

Exhibit: Which two statements are correct about the output shown in the exhibit. (Choose Two)

The data shown requires a traceoptions flag of basic-datapath.

The packet is dropped by the default security policy.

The data shown requires a traceoptions flag of basic-datapath.

The data shown requires a traceoptions flag of host-traffic.

The packet is dropped by the default security policy.

The packet is dropped by a configured security policy.

Juniper JN0-637 Practice Test 2 - Free Online Exam Prep & Questions

Question 1 / 40

Referring to the exhibit,

Juniper JN0-637 image Question 41 124758 11012024014440000000

which statement about TLS 1.2 traffic is correct?

TLS 1.2 traffic will be sent to routing instance R1 but not forwarded to the next hop.

TLS 1.2 traffic will be sent to routing instance R1 and forwarded to next hop 10.1.0.1.

TLS 1.2 traffic will be sent to routing instance R2 but not forwarded to the next hop.

TLS 1.2 traffic will be sent to routing instance R2 and forwarded to next hop 10.2.0.1.

Comment (0)

Juniper JN0-637 Practice Test 2

Question

Juniper JN0-637 Practice Tests

Practice Tests