Verified JN0-636 dumps Q&As - 100% Pass from DumpsMaterials [Q42-Q65] : Free Exams Dumps Materials : http://exams.dumpsmaterials.com

QUESTION 42
You are requested to enroll an SRX Series device with Juniper ATP Cloud.
Which statement is correct in this scenario?

If a device is already enrolled in a realm and you enroll it in a new realm, the device data or configuration information is propagated to the new realm.

The only way to enroll an SRX Series device is to interact with the Juniper ATP Cloud Web portal.

When the license expires, the SRX Series device is disenrolled from Juniper ATP Cloud without a grace period

Juniper ATP Cloud uses a Junos OS op script to help you configure your SRX Series device to connect to the Juniper ATP Cloud service.

QUESTION 43
Exhibit

Which two statements are correct about the output shown in the exhibit? (Choose two.)

The packet is processed as host inbound traffic.

The packet matches the default security policy.

The packet matches a configured security policy.

The packet is processed in the first path packet flow.

QUESTION 44
You are asked to download and install the IPS signature database to a device operating in chassis cluster mode.
Which statement is correct in this scenario?

You must download and install the IPS signature package on the primary node.

The first synchronization of the backup node and the primary node must be performed manually.

The first time you synchronize the IPS signature package from the primary node to the backup node, the primary node must be rebooted.

The IPS signature package must be downloaded and installed on the primary and backup nodes.

QUESTION 45
You are implementing filter-based forwarding to send traffic from the 172.25.0.0/24 network through ISP-1 while sending all other traffic through your connection to ISP-2.
Your ge-0/0/1 interface connects to two networks, including the 172.25.0.0/24 network.
You have implemented the configuration shown in the exhibit. The traffic from the 172.25.0.0/24 network is being forwarded as expected to 172.20.0.2, however traffic from the other network (172.25.1.0/24) is not being forwarded to the upstream 172.21.0.2 neighbor.
In this scenario, which action will solve this problem?

You must specify that the 172.25.1.1/24 IP address is the primary address on the ge-0/0/1 interface.

You must apply the firewall filter to the lo0 interface when using filter-based forwarding.

You must add another term to the firewall filter to accept the traffic from the 172.25.1.0/24 network.

You must create the static default route to neighbor 172.21.0.2 under the ISP-1 routing instance hierarchy.

QUESTION 46
Exhibit

You are validating bidirectional traffic flows through your IPsec tunnel. The 4546 session represents traffic being sourced from the remote end of the IPsec tunnel. The 4547 session represents traffic that is sourced from the local network destined to the remote network.
Which statement is correct regarding the output shown in the exhibit?

The remote gateway address for the IPsec tunnel is 10.20.20.2

The session information indicates that the IPsec tunnel has not been established

The local gateway address for the IPsec tunnel is 10.20.20.2

NAT is being used to change the source address of outgoing packets

QUESTION 47
Referring to the exhibit, which two statements are true? (Choose two.)

The SRX-1 device can use the Proxy__Nodes feed in another security policy.

You can use the Proxy_Nodes feed as the source-address and destination-address match criteria of another security policy on a different SRX Series device.

The SRX-1 device creates the Proxy_wodes feed, so it cannot use it in another security policy.

You can only use the Proxy_Node3 feed as the destination-address match criteria of another security policy on a different SRX Series device.

QUESTION 48
Regarding IPsec CoS-based VPNs, what is the number of IPsec SAs associated with a peer based upon?

The number of traffic selectors configured for the VPN.

The number of CoS queues configured for the VPN.

The number of classifiers configured for the VPN.

The number of forwarding classes configured for the VPN.

QUESTION 49
Exhibit

Referring to the exhibit, which type of NAT is being performed?

Static NAT

Destination NAT

Persistent NAT

Source NAT

QUESTION 50
You are configuring transparent mode on an SRX Series device. You must permit IP-based traffic only, and BPDUs must be restricted to the VLANs from which they originate.
Which configuration accomplishes these objectives?
A)

B)

C)

D)

Option A

Option B

Option C

Option D

QUESTION 51
Exhibit

Referring to the exhibit, which type of NAT is being performed?

Static NAT

Destination NAT

Persistent NAT

Source NAT

QUESTION 52
Click the Exhibit button.

Referring to the exhibit, which statement is true?

ARP security is securing data across the control interface

IPsec is securing data across the control interface

SSH is securing data across the control interface

MACsec is securing data across the control interface

QUESTION 53
You are connecting two remote sites to your corporate headquarters site.
You must ensure that all traffic is secured and sent directly between sites.
In this scenario, which VPN should be used?

IPsec ADVPN

hub-and-spoke IPsec VPN

Layer 2 VPN

full mesh Layer 3 VPN with EBGP

QUESTION 54
You are trying to configure an IPsec tunnel between SRX Series devices in the corporate office and branch1. You have committed the configuration shown in the exhibit, but the IPsec tunnel is not establishing.
In this scenario, what would solve this problem?

Add multipoint to the st0.0 interface configuration on the branch1 device.

Change the IKE proposal-set to compatible on the branch1 and corporate devices.

Change the local identity to inet advpn on the branch1 device.

Change the IKE mode to aggressive on the branch1 and corporate devices.

QUESTION 55
Exhibit

Which two statements are correct about the output shown in the exhibit. (Choose two.)

The source address is translated.

The packet is an SSH packet

The packet matches a user-configured policy

The destination address is translated.

QUESTION 56
Exhibit

You are using traceoptions to verity NAT session information on your SRX Series device Referring to the exhibit, which two statements are correct? (Choose two.)

This packet is part of an existing session.

The SRX device is changing the source address on this packet from

This is the first packet in the session

The SRX device is changing the destination address on this packet 10.0.1 1 to 172 20.101.10.

QUESTION 57
Exhibit

You are implementing filter-based forwarding to send traffic from the 172.25.0.0/24 network through ISP-1 while sending all other traffic through your connection to ISP-2. Your ge-0/0/1 interface connects to two networks, including the 172.25.0.0/24 network. You have implemented the configuration shown in the exhibit. The traffic from the 172.25.0.0/24 network is being forwarded as expected to 172.20.0.2, however traffic from the other network (172.25.1.0/24) is not being forwarded to the upstream 172.21.0.2 neighbor.
In this scenario, which action will solve this problem?

You must specify that the 172.25.1.1/24 IP address is the primary address on the ge-0/0/1 interface.

You must apply the firewall filter to the lo0 interface when using filter-based forwarding.

You must add another term to the firewall filter to accept the traffic from the 172.25.1.0/24 network.

You must create the static default route to neighbor 172.21 0.2 under the ISP-1 routing instance hierarchy.

QUESTION 58
Exhibit

You are using ATP Cloud and notice that there is a host with a high number of ETI and C&C hits sourced from the same investigation and notice that some of the events have not been automatically mitigated.
Referring to the exhibit, what is a reason for this behavior?

The C&C events are false positives.

The infected host score is globally set bellow a threat level of 5.

The infected host score is globally set above a threat level of 5.

The ETI events are false positives.

QUESTION 59
Which two additional configuration actions are necessary for the third-party feed shown in the exhibit to work properly? (Choose two.)

You must create a dynamic address entry with the IP filter category and the ipfilter_office365 value.

You must create a dynamic address entry with the C&C category and the cc_offic365 value.

You must apply the dynamic address entry in a security policy.

You must apply the dynamic address entry in a security intelligence policy.

QUESTION 60
You are asked to deploy filter-based forwarding on your SRX Series device for incoming traffic sourced from the 10.10 100 0/24 network in this scenario, which three statements are correct? (Choose three.)

You must create a forwarding-type routing instance.

You must create and apply a firewall filter that matches on the source address 10.10.100.0/24 and then sends this traffic to your routing

You must create and apply a firewall filter that matches on the destination address 10 10.100.0/24 and then sends this traffic to your routing instance.

You must create a RIB group that adds interface routes to your routing instance.

You must create a VRF-type routing instance.

QUESTION 61
Exhibit

The exhibit shows a snippet of a security flow trace.
In this scenario, which two statements are correct? (Choose two.)

This packet arrived on interface ge-0/0/4.0.

Destination NAT occurs.

The capture is a packet from the source address 172.20.101.10 destined to 10.0.1.129.

An existing session is found in the table.

QUESTION 62
SRX Series device enrollment with Policy Enforcer fails To debug further, the user issues the following commandshow configuration services security-intelligence url
https : //cloudfeeds . argon . juniperaecurity . net/api/manifeat. xml
and receives the following output:
What is the problem in this scenario?

The device is directly enrolled with Juniper ATP Cloud.

The device is already enrolled with Policy Enforcer.

The SRX Series device does not have a valid license.

Junos Space does not have matching schema based on the

QUESTION 63
You have designed the firewall filter shown in the exhibit to limit SSH control traffic to yours SRX Series device without affecting other traffic.
Which two statement are true in this scenario? (Choose two.)

The filter should be applied as an output filter on the loopback interface.

Applying the filter will achieve the desired result.

Applying the filter will not achieve the desired result.

The filter should be applied as an input filter on the loopback interface.

QUESTION 64
SRX Series device enrollment with Policy Enforcer fails. To debug further, the user issues the following command show configuration services security–intelligence url
https://cloudfeeds.argon.juniperaecurity.net/api/manifeat.xml and receives the following output:
What is the problem in this scenario?

The device is directly enrolled with Juniper ATP Cloud.

The device is already enrolled with Policy Enforcer.

The SRX Series device does not have a valid license.

Junos Space does not have matching schema based on the

QUESTION 65
You are asked to configure an SRX Series device to bypass all security features for IP traffic from the engineering department.
Which firewall filter will accomplish this task?