Juniper JN0-333 問題集

質問 1：
Click the Exhibit button.

Users at a remote office are unable to access an FTP server located at the remote corporate data center as expected. The remote FTP server is listening on the non-standard TCP port 2121.
Referring to the exhibit, what is causing the problem?
A. The custom FTP application definition does not have the FTP ALG enabled.
B. Two custom FTP applications must be defined to allow bidirectional FTP communication through the SRX Series device.
C. The FTP clients must be configured to listen on non-standard client ports for the FTP data channel negotiations to succeed.
D. A new security policy must be defined between the untrust and trust zones.
正解：D

質問 2：
Which statement describes the function of screen options?
A. Screen options protect against various attacks on traffic entering a security device.
B. Screen options restrict or permit users individually or in a group.
C. Screen options encrypt transit traffic in a tunnel.
D. Screen options translate a private address to a public address.
正解：A

質問 3：
Click the Exhibit button.

Referring to the exhibit, which action will be taken for traffic coming from the untrust zone going to the trust zone?
A. Source address 10.1.1.5 will be translated to 2001:db8::8.
B. Source address 10.1.1.8 will be translated to 2001:db8::8.
C. Source address 2001:db8::8 will be translated to 10.1.1.5.
D. Source address 2001:db8::8 will be translated to 10.1.1.8.
正解：D

質問 4：
After an SRX Series device processes the first packet of a session, how are subsequent packets for the same session processed?
A. They are forwarded to the control plane for deep packet inspection.
B. They are processed using fast-path processing.
C. All packets are processed in the same manner.
D. They are queued on the outbound interface until a matching security policy is found.
正解：B

質問 5：
Which statement is true about Perfect Forward Secrecy (PFS)?
A. PFS is used to resolve compatibility issues with third-party IPsec peers.
B. PFS increases the IPsec VPN encryption key length and uses RSA or DSA certificates.
C. PFS is implemented during Phase 1 of IKE negotiations and decreases the amount of time required for IKE negotiations to complete.
D. PFS increases security by forcing the peers to perform a second DH exchange during Phase 2.
正解：D

質問 6：
You are asked to change when your SRX high availability failover occurs. One network interface is considered more important than others in the high availability configuration. You want to prioritize failover based on the state of that interface.
Which configuration would accomplish this task?
A. Configure interface monitor inside the redundancy group that contains the important physical interface; adjust the weight associated with the monitored interface to 255.
B. Create a VRRP group configuration that lists the reth's IP address as the VIP while using each physical interface that make up the reth definition of each SRX HA pair.
C. Configure IP monitoring of the important interface's IP address and adjust the heartbeat interval and heartbeat threshold to the shortest settings.
D. Create a separate redundancy group to isolate the important interface; set the priority of the new redundancy group to 255.
正解：A

質問 7：
Clients at a remote office are accessing a website that is against your company Internet policy. You change the action of the security policy that controls HTTP access from permit to deny on the remote office SRX Series device. After committing the policy change, you notice that new users cannot access the website but users that have existing sessions on the device still have access. You want to block all user sessions immediately.
Which change would you make on the SRX Series device to accomplish this task?
A. Add the set security flow tcp-session rst-invalidate-session option to the configuration and commit the change.
B. Add the security flow tcp-session strict-syn-check option to the configuration and commit the change.
C. Add the set security policies policy-rematch parameter to the configuration and commit the change.
D. Issue the commit full command from the top of the configuration hierarchy.
正解：C

質問 8：
You are asked to support source NAT for an application that requires that its original source port not be changed.
Which configuration would satisfy the requirement?
A. Configure the egress interface to source NAT fixed-port status.
B. Configure a source NAT rule that sets the egress interface to the overload status.
C. Configure a source NAT rule that references an IP address pool with interface proxy ARP enabled.
D. Configure a source NAT rule that references an IP address pool with the port no-translation parameter enabled.
正解：D