Juniper JN0-335 Exam Questions Instant Access

Question 1

Exhibit

Which two statements are correct about the configuration shown in the exhibit? (Choose two.)

AThe session-class parameter in only used when troubleshooting.

BThe others 300 parameter means unidentified traffic flows will be dropped in 300 milliseconds.

CEvery session that enters the SRX Series device will generate an event

DReplacing the session-init parameter with session-lose will log unidentified flows.

Answer : B, C

The configuration shown in the exhibit is for a Juniper SRX Series firewall. The session-init parameter is used to control how the firewall processes unknown traffic flows. With the session-init parameter set to 300, any traffic flows that the firewall does not recognize will be dropped after 300 milliseconds. Additionally, every session that enters the device, whether it is known or unknown, will generate an event, which can be used for logging and troubleshooting purposes. The session-lose parameter is used to control how the firewall handles established sessions that are terminated.

Question 2

Which two statements are true about Juniper ATP Cloud? (Choose two.)

ADynamic analysis is always performed to determine if a file contains malware.

BIf the cache lookup determines that a file contains malware, performed to verify the results.

CDynamic analysis is not always necessary to determine if a file contains malware.

DIf the cache lookup determines that a file contains malware, static analysis is not performed to verify the results.

Answer : C, D

Dynamic analysis is not always necessary to determine if a file contains malware, as the ATP Cloud uses a cache lookup to quickly identify known malicious files. If the cache lookup determines that a file contains malware, static analysis is not performed to verify the results. This information can be found on the Juniper website here:https://www.juniper.net/documentation/en_US/release-independent/security/jnpr-security-srx-series/information-products/topic-collection/jnpr-security-srx-resources.html#id-jnpr-security-srx-resources-atp-cloud.

Question 3

Which two features are configurable on Juniper Secure Analytics (JSA) to ensure that alerts are triggered when matching certain criteria? (Choose two.)

Abuilding blocks

Bassets

Cevents

Dtests

Answer : C, D

The two configurable features on Juniper Secure Analytics (JSA) that can be used to ensure that alerts are triggered when matching certain criteria are events and tests. Events refer to the collection of data from different sources, while tests are used to define the criteria for which an alert is triggered. For example, you can use events to collect data from a firewall and tests to define criteria such as IP address, port number, and the type of traffic. The Security, Specialist (JNCIS-SEC) Study guide provides further information on how to configure these features on JSA.

Question 4

After JSA receives external events and flows, which two steps occur? (Choose two.)

AAfter formatting the data, the data is stored in an asset database.

BBefore formatting the data, the data is analyzed for relevant information.

CBefore the information is filtered, the information is formatted

DAfter the information is filtered, JSA responds with active measures

Answer : B, C

Before formatting the data, the data is analyzed for relevant information. This is done to filter out any irrelevant data and to extract any useful information from the data. After the information is filtered, it is then formatted so that it can be stored in an asset database. After the data has been formatted, JSA will then respond with active measures.

Question 5

When a security policy is deleted, which statement is correct about the default behavior of active sessions allowed by that policy?

AThe active sessions allowed by the policy will be dropped.

BThe active sessions allowed by the policy will be marked as a legacy flow and will continue to be forwarded.

CThe active sessions allowed by the policy will be reevaluated by the cached

DThe active sessions allowed by the policy will continue

Answer : A

When a security policy is deleted, the active sessions allowed by the policy will be dropped. The default behavior is that all active sessions allowed by the policy will be terminated and the traffic will no longer be forwarded. There is no way to mark the active sessions as a legacy flow or to reevaluate them by the cached rules.

According to Juniper Networks Security, Specialist (JNCIS-SEC) Study Guide, when a security policy is deleted, the active sessions allowed by that policy will be dropped. This behavior is the default behavior of the device. There is no way to mark the active sessions as a legacy flow or to re-evaluate them against cached rules. The device will terminate the active sessions and will no longer forward traffic for those sessions.

Question 6

How does the SSL proxy detect if encryption is being used?

AIt uses application identity services.

BIt verifies the length of the packet

CIt queries the client device.

DIt looks at the destination port number.

Answer : D

The SSL proxy can detect if encryption is being used by looking at the destination port number of the packet. If the port number is 443, then the proxy can assume that the packet is being sent over an encrypted connection. If the port number is different, then the proxy can assume that the packet is not encrypted. For more information, please refer to the Juniper Networks JNCIS-SEC Study Guide.

The SSL proxy is a security feature that provides visibility and control over SSL/TLS encrypted traffic. When SSL proxy is enabled, it intercepts SSL/TLS traffic and decrypts it to allow visibility into the content of the encrypted traffic. However, before decrypting the traffic, the SSL proxy must first determine if the traffic is encrypted.

To detect if encryption is being used, the SSL proxy looks at the destination port number. If the destination port number is a known SSL/TLS port (e.g., TCP port 443), the SSL proxy assumes that encryption is being used and intercepts the traffic. If the destination port is not a known SSL/TLS port, the SSL proxy does not intercept the traffic and allows it to pass through the device unmodified.

Question 7

Which two statements are correct about SSL proxy server protection? (Choose two.)

AYou do not need to configure the servers to use the SSL proxy the function on the SRX Series device.

BYou must load the server certificates on the SRX Series device.

CThe servers must be configured to use the SSL proxy function on the SRX Series device.

DYou must import the root CA on the servers.

Answer : B, C

You must load the server certificates on the SRX Series device and configure the servers to use the SSL proxy function on the SRX Series device. This is done to ensure that the SSL proxy is able to decrypt the traffic between the client and server. Additionally, you must import the root CA on the servers in order for the SSL proxy to properly validate the server certificate.

Juniper Security, Specialist JN0-335 Exam Questions