Master the JN0-633 Security, Professional (JNCIP-SEC) content and be ready for exam day success quickly with this Pass4sure JN0-633 free practice questions. We guarantee it!We make it a reality and give you real JN0-633 questions in our Juniper JN0-633 braindumps.Latest 100% VALID Juniper JN0-633 Exam Questions Dumps at below page. You can use our Juniper JN0-633 braindumps and pass your exam.

Q21. You are asked to ensure that your IPS engine blocks attacks. You must ensure that your system continues to drop additional malicious traffic without additional IPS processing for up to 30 minutes. You must ensure that the SRX Series device does send a notification packet when the traffic is dropped.

Which statement is correct?

A. Use the IP-Block action.

B. Use the Drop Packet action.

C. Use the Drop Connection action.

D. Use the IP-Close action.

Answer: D


Q22. Click the Exhibit button.

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:<1.1.1.100/51303->1.1.1.30/3389;6>

matched filter MatchTraffic:

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:packet [48] ipid = 5015, @423d7e9e Feb 2

09:00:02 09:00:00.1872004:CID-0:RT:---- flow_process_pkt: (thd 1): flow_ctxt type 13, common flag Ox0, mbuf Ox423d7d00

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: flow process pak fast ifl 72 In_ifp fe-0/0/7.0

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: fe-0/0/7.0:1.1.1.100/51303- >1.1.1.30/3389,

top, flag 2 syn

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: find flow: table Ox5258d7b0, hash 17008(Oxffff), sa 1.1.1.100, da 1.1.1.30, sp 51303, dp 3389, proto 6, tok

448

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: no session found, start first path. in_tunnel - 0, from_cp_flag - 0

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: flow_first_create_session

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: flow first_in_dst_nat: in <fe-0/0/7.0>, out

<N/A> dst_adr 1.1.1.30, sp 51303, dp 3389

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: chose interface fe-0/0/7.0 as incoming nat if. Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_rule_dst_xlate: packet 1.1.1.100-

>1.1.1.30 nsp2 0.0.0.0->192.168.224.30.

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_routing: call flow_route_lookup() src_ip 1.1.1.100, x_dst_ip 192.168.224.30, in ifp fe-0/0/7.0, out ifp N/A sp 51303, dp 3389, ip_proto 6, tos 0

Feb 2 09:00:02 09:00:00.1872004:CID-O:RT:Doing DESTINATION addr route-lookup Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: routed (x_dst_ip 192 168.224.30)

from untrust (fe-0/0/7.0 in 0) to ge-0/0/0.0, Next-hop: 192.168.224.30

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: policy search from zone untrust-> zone trust Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: policy has timeout 900

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: app 0, timeout 1800s, curr ageout 20s

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_src_xlate: src nat 0.0.0.0(51303) to

192.168.224.30(3389) returns status 1, rule/pool id 1/2. Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: dip id = 2/0, 1.1.1.100/51303->192.168.224.3/48810

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: choose interface ge-0/0/0.0 as outgoing phy if Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:is_loop_pak: No loop: on ifp: ge-0/0/0.0, addr:

192.168.224.30, rtt_idx:0

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:sm_flow_interest_check: app_id 0, policy 9, app_svc_en 0, flags Ox2. not interested

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:sm_flow_interest_check: app_id 1, policy 9, app_svc_en 0, flags Ox2. not interested

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_service_lookup():

natp(Ox51ee4680): app_id, 0(0).

Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: service lookup identified service O. Referring to the exhibit, which two statements are correct? (Choose two.)

A. The packet being inspected is a UDP packet.

B. The incoming interface is fe-0/0/7.

C. This traffic matches an existing flow.

D. Source NAT is being used.

Answer: B,C


Q23. You want to implement an IPsec VPN on an SRX device using PKI certificates for authentication. As part of the implementation, you are required to ensure that the certificate submission, renewal, and retrieval processes are handled automatically from the certificate authority.Regarding this scenario, which statement is correct?

A. You can use SCEP to accomplish this behavior.

B. You can use OCSP to accomplish this behavior.

C. You can use CRL to accomplish this behavior.

D. You can use SPKI to accomplish this behavior.

Answer: A

Explanation: Reference: Page 9

http://www.juniper.net/techpubs/en_US/junos/information-products/topic-collections/nce/pki-conf-trouble/configuring-and-troubleshooting-public-key- infrastructure.pdf


Q24. At which two times does the IPS rulebase inspect traffic on an SRX device? (Choose two.)

A. When traffic matches the active IDP policy.

B. When traffic first matches an IDP rule with the terminal parameter.

C. When traffic uses the application layer gateway.

D. When traffic is established in the firewall session table.

Answer: A,B

Explanation: Reference: http://books.google.co.in/books?id=2HSLsTJIgEQC&pg=PA814&lpg=PA814&dq=what+time+IPS+rulebase+inspects+traffic+on+SRX&source=bl&ots=_eDe_vLNBA&sig=1I4yX_S0OvkQVP-rqL273laMCyE&hl=en&sa=X&ei=nqvzUfn1Is-rrAf71oHYBA&ved=0CC4Q6AEwAQ#v=onepage&q=what%20time%20IPS%20rulebase% 20inspects%20traffic%20on%20SRX&f=false


Q25. Your company is providing multi-tenant security services on an SRX5800 cluster. You have been asked to create a new logical system (LSYS) for a customer. The customer must be able to access and manage new resources within their LSYS.

How do you accomplish this goal?

A. Create the new LSYS, allocate resources, and then create the user administrator role so that the customer can manage their allocated resources.

B. Create the new LSYS, and then create the user administrator role so that the customer can allocate and manage resources.

C. Create the new LSYS, and then create the master adminstrator role for the LSYS so that the customer can allocate and manage resources.

D. Create the new LSYS, then request the required resources from the customer, and create the required resources.

Answer: A

Explanation:

Reference

http://www.juniper.net/techpubs/en_US/junos12.1/topics/task/configuration/logical-system-security-user-lsys-overview-configuring.html


Q26. In the IPS packet processing flow on an SRX Series device, when does application identification occur?

A. before fragmentation processing

B. after protocol decoding

C. before SSL decryption

D. after attack signature matching

Answer: A


Q27. In which situation is NAT proxy NDP required?

A. when translated addresses belong to the same subnet as the ingress interface

B. when filter-based forwarding and static NAT are used on the same interface

C. when working with static NAT scenarios

D. when the security device operates in transparent mode

Answer: C

Explanation:

WhenIP addressesarein the same subnet of the ingressinterface,NAT proxy ARPconfigured

Reference :http://www.juniper.net/techpubs/en_US/junos12.1x44/information- products/pathway-pages/security/security-nat.pdf

Reference :http://www.juniper.net/techpubs/en_US/junos-space12.2/topics/concept/junos- space-security-designer-whiteboard-nat-overview.html


Q28. Which statement is true about NAT?

A. When you implement destination NAT, the router does not apply ALG services.

B. When you implement destination NAT, the router skips source NAT rules for the initiating traffic flow.

C. When you implement static NAT, each packet must go through a route lookup.

D. When you implement static NAT, the router skips destination NAT rules for the initiating traffic flow.

Answer: D

Explanation: The NAT type determines the order in which NAT rules are processed. During the first packet processing for a flow, NAT rules are applied in the following order:

✑ Static NAT rules

✑ Destination NAT rules

✑ Route lookup

Reference :http://www.juniper.net/techpubs/software/junos-security/junos-security10.2/junos-security-swconfig-security/topic-42804.html


Q29. As an SRX administrator, you must find all encrypted sessions on an SRX Series device. Which command would you use to accomplish this task?

A. show security flow session tunnel

B. show security ike tunnel-map

C. show security ike security-associations

D. show security flow session encrypted

Answer: D


Q30. Which three match condition objects are required when creating IPS rules? (Choose three.)

A. attack objects

B. address objects

C. terminal objects

D. IP action objects

E. zone objects

Answer: A,B,E

Explanation: Reference: http://www.juniper.net/techpubs/software/junos-security/junos-security10.2/junos-security-swconfig-security/topic-42453.html#understand-rule-match- cond-section