Juniper JN0-696 問題集

質問 1：
You recently configured the antivirus feature profile on your Junos device. The security policy is sending traffic for antivirus scanning. However, the traffic is being blocked and you repeatedly receive the system log message that the scan engine is not ready. You must not allow the traffic to be dropped when the scan engine is not ready.
Which action will resolve this problem?
A. Configure an antivirus fallback option to permit the traffic when the scan engine is not ready.
B. Configure an antivirus content size limit to minimize the scanning of large files.
C. Configure an antivirus file scanning extension list to reduce the number of files for scanning.
D. Configure antivirus trickling to prevent the scan engine from timing out.
正解：A

質問 2：
-- Exhibit --
user@host> show configuration security policies from-zone engineering to-zone hr
policy new-policy {
match {
source-address any;
destination-address server1;
application hr-data-feed;
}
then {
permit;
}
}
policy old-policy {
match {
source-address pc1;
destination-address server1;
application any;
}
then {
deny;
log {
session-init;
}
}
}
user@host> show configuration security policies global
user@host> show configuration security address-book | match server1 | display set set security address-book book2 address server1 172.19.55.20/32 set security address-book book3 address server1 172.20.11.18/32
user@host> show configuration security address-book | match pc1 | display set set security address-book book1 address pc1 172.18.21.213/32
user@host> show configuration applications
application hr-data-feed { protocol tcp; destination-port 38888;
}
user@host> run show log flow-traceoptions | no-more Jun 13 15:54:09 host clear-log[2503]: logfile cleared Jun 13 15:54:10 15:54:10.611915:CID-0:RT:172.18.21.213/38362->172.19.55.20/38888;17>
matched filter filter1:
Jun 13 15:54:10 15:54:10.611915:CID-0:RT:packet [40] ipid = 38364, @423e421c
Jun 13 15:54:10 15:54:10.611915:CID-0:RT:---- flow_process_pkt: (thd 3): flow_ctxt type 15, common flag 0x0, mbuf 0x423e4000, rtbl_idx = 0
Jun 13 15:54:10 15:54:10.611915:CID-0:RT: flow process pak fast ifl 70 in_ifp ge-0/0/8.0
Jun 13 15:54:10 15:54:10.611915:CID-0:RT: find flow: table 0x49175b08, hash 9077(0xffff), sa 172.18.21.213, da 172.19.55.20, sp 38362, dp 38888, proto 17, tok 10
Jun 13 15:54:10 15:54:10.611915:CID-0:RT: flow_first_create_session
Jun 13 15:54:10 15:54:10.611915:CID-0:RT: flow_first_in_dst_nat: in 0/8.0>, out A> dst_adr 172.19.55.20, sp 38362, dp 38888
Jun 13 15:54:10 15:54:10.611915:CID-0:RT: chose interface ge-0/0/8.0 as incoming nat if.
Jun 13 15:54:10 15:54:10.611915:CID-0:RT:flow_first_rule_dst_xlate: DST no-xlate: 0.0.0.0(0) to 172.19.55.20(38888)
Jun 13 15:54:10 15:54:10.611915:CID-0:RT:flow_first_routing: vr_id 0, call flow_route_lookup(): src_ip 172.18.21.213, x_dst_ip 172.19.55.20, in ifp ge-0/0/8.0, out ifp N/A sp 38362, dp 38888, ip_proto 17, tos 0
Jun 13 15:54:10 15:54:10.611915:CID-0:RT:Doing DESTINATION addr route-lookup
Jun 13 15:54:10 15:54:10.611915:CID-0:RT: routed (x_dst_ip 172.19.55.20) from engineering (ge-0/0/8.0 in 0) to ge-0/0/10.0, Next-hop: 172.19.55.20
Jun 13 15:54:10 15:54:10.611915:CID-0:RT:flow_first_policy_search: policy search from zone engineering-> zone hr (0x0,0x95da97e8,0x97e8)
Jun 13 15:54:10 15:54:10.611915:CID-0:RT: app 0, timeout 60s, curr ageout 60s
Jun 13 15:54:10 15:54:10.611915:CID-0:RT: Error : get sess plugin info 0x4c390388
Jun 13 15:54:10 15:54:10.611915:CID-0:RT: Error : get sess plugin info 0x4c390388
Jun 13 15:54:10 15:54:10.612416:CID-0:RT: packet dropped, denied by policy
Jun 13 15:54:10 15:54:10.612416:CID-0:RT: denied by policy old-policy(6), dropping pkt
Jun 13 15:54:10 15:54:10.612416:CID-0:RT: packet dropped, policy deny.
Jun 13 15:54:10 15:54:10.612416:CID-0:RT: flow didn't create session, code=-1.
Jun 13 15:54:10 15:54:10.612416:CID-0:RT: ----- flow_process_pkt rc 0x7 (fp rc -1)
-- Exhibit -
Click the Exhibit button.
A user added the new-policy policy to permit traffic. However, they report that the traffic is still not permitted by the device.
Using the information in the exhibit, why is the device denying the traffic?
A. The traffic is being denied by the more specific old-policy prior to the device evaluating new-policy.
B. The traffic is the first packet in a flow, but is not a SYN.
C. The traffic does not match the application specified in new-policy.
D. The traffic does not match the address book entry used in new-policy.
正解：C

質問 3：
Your SRX Series device has the following configuration:
user@host> show security policies
...
Policy: my-policy, State: enabled, Index: 5, Sequence number: 1
Source addresses: any Destination addresses: any
Applications: snmp
Action: reject
From zone: trust, To zone: untrust
...
When traffic matches my-policy, you want the device to silently drop the traffic; however, you notice that the device is replying with ICMP unreachable messages instead.
What is causing this behavior?
A. the untrust zone
B. the reject action
C. the snmp application
D. the trust zone
正解：D

質問 4：
You have implemented AppTrack on your SRX Series device to track YouTube streaming video usage in your network. However, many of the YouTube videos that your users are watching are shorter than five minutes. You notice that the statistics for starting these short YouTube videos are not being recorded by AppTrack.
Which two actions would allow AppTrack to record the statistics for these sessions? (Choose two.)
A. Change AppTrack to collect session information during shorter intervals.
B. Change AppTrack to collect session information when the session is first created.
C. Change AppTrack to collect session information for nested applications only.
D. Change AppTrack to collect session information for applications only.
正解：A,B