2022 Free JNCIP-SEC JN0-635 Practice Exam Questions With Verified Answers

test2022-03-17T06:10:01+00:00

Security, Professional (JNCIP-SEC) JN0-635 exam verifies the candidate’s understanding of advanced security technologies and related platform configuration and troubleshooting skills. If you are preparing for Juniper JN0-635 exam, you should get JN0-635 practice exam questions to pass in the first try. Free demos are particularly important since they allow you to examine the exact quality of the JN0-635 practice material. You can try the free JN0-635 practice exam before purchasing.

To help you prepare for the exam, take a free JN0-635 practice test.

Page 1 of 3

1. Which two statements are true about ADVPN members? (Choose two.)

ADVPN members are authenticated using pre-shared keys

ADVPN members are authenticated using certificates

ADVPN members can use IKEv2

ADVPN members can use IKEv1

2. Click the Exhibit button.

You deployed a site-to-site IPsec VPN connecting two data centers together using SRX5800s. After examining the performance of the IPsec VPN, you decide to enable IPsec performance acceleration to increase the rate of traffic that can be sent through the tunnel.

Referring to the exhibit, which two statements should you add to the configuration to accomplish this task? (Choose two.)

[edit security flow] user@srx# set tcp-mss ipsec-vpn mss 65535

[edit security flow] user@srx# set ipsec-performance-acceleration

[edit security flow] user@srx# set power-mode-ipsec

[edit security flow] user@srx# set load-distribution session-affinity ipsec

3. Click the Exhibit button.

Referring to the exhibit, what is the maximum number of zones that are able to be created within all logical systems?

4. According to the log shown in the exhibit, you notice the IPsec session is not establishing.

What is the reason for this behavior?

Mismatched proxy ID

Mismatched peer ID

Mismatched preshared key

Incorrect peer address.

5. Click the Exhibit button.

Your company has purchased a competitor and now must connect the new network to the existing one. The competitor’s gateway device is receiving its ISP address using DHCP. Communication between the two sites must be secured; however, obtaining a static public IP address for the new site gateway is not an option at this time.

The company has several requirements for this solution:

✑ A site-to-site IPsec VPN must be used to secure traffic between the two sites;

✑ The IKE identity on the new site gateway device must use the hostname option; and

✑ Internet traffic from each site should exit through its local Internet connection.

The configuration shown in the exhibit has been applied to the new site’s SRX, but the secure tunnel is not working.

In this scenario, what configuration change is needed for the tunnel to come up?

Remove the quotes around the hostname

Bind interface st0 to the gateway

Change the IKE policy mode to aggressive

Apply a static address to ge-0/0/2

6. Your organization has multiple Active Directory domains to control user access. You must ensure that security policies are passing traffic based upon the users’ access rights.

What would you use to assist your SRX Series devices to accomplish this task?

JATP Appliance

JIMS

JSA

Junos Space

7. Which three type of peer devices are supported for Cos-Based IPsec VPN?

High-end SRX Series device

cSRX

vSRX

Branch-end SRX Series devics

8. Click the Exhibit button.

You have configured an ADVPN that is operational. However, OSPF will not establish correctly across the ADVPN tunnels.

Referring to the exhibit, which two commands will solve the problem? (Choose two.)

[edit protocols ospf area 0.0.0.0] user@srx# set interface st0.0 dynamic-neighbors

[edit protocols ospf area 0.0.0.0] user@srx# set interface st0.0 topology advpn

[edit protocols ospf area 0.0.0.0] user@srx# set interface st0.0 interface-type nbma

[edit protocols ospf area 0.0.0.0] user@srx# set interface st0.0 demand-circuit

9. Which interface family is required for Layer 2 transparent mode on SRX Series devices?

LLDP

Ethernet switching

inet

VPLS

10. You are trying to get a SSH honeypot set up on a Juniper ATP Appliance collector. The collector is running on hardware with two physical interfaces and two physical CPU cores. The honeypot feature is not working.

Which statement is true in this scenario?

The collector must have at least three physical interfaces

The collector must have at least four physical cores

The collector must have at least four physical interfaces

The collector must have at least six physical cores

Page 2 of 3

11. You correctly configured a security policy to deny certain traffic, but logs reveal that traffic is still allowed.

Which specific traceoption flag will help you troubleshoot this problem?

lookup

configuration

routing-socket

rules

12. Click the Exhibit button.

You have configured tenant systems on your SRX Series device.

Referring to the exhibit, which two actions should you take to facilitate inter-TSYS communication? (Choose two.)

Place the logical tunnel interfaces in a virtual router routing instance in the interconnect switch

Place the logical tunnel interfaces in a VPLS routing instance in the interconnect switch

Connect each TSYS with the interconnect switch by configuring INET configured logical tunnel interfaces in the interconnect switch

Connect each TSYS with the interconnect switch by configuring Ethernet VPLS configured logical tunnel interfaces in the interconnect switch

13. You configured a security policy permitting traffic from the trust zone to the DMZ zone, inserted the new policy at the top of the list, and successfully committed it to the SRX Series device. Upon monitoring, you notice that the hit count does not increase on the newly configured policy.

In this scenario, which two commands would help you to identify the problem? (Choose two.)

user@srx> show security zones trust detail

user@srx> show security shadow-policies from zone trust to zone DMZ

user@srx> show security match-policies from-zone trust to-zone DMZ source-ip 192.168.10.100/32 destination-ip 10.10.10.80/32 protocol tcp source-port 5806 destination-port 443

user@srx> show security match-policies from-zone trust to-zone DMZ source-ip 192.168.10.100/32 destination-ip 10.10.10.80/32 protocol tcp source-port 5806 destination-port 443 result-count 10

14. Exhibit.

Referring to the exhibit, which two statements are true? (Choose two.)

Juniper Networks will not investigate false positives generated by this custom feed.

The custom infected hosts feed will not overwrite the Sky ATP infected host’s feed.

The custom infected hosts feed will overwrite the Sky ATP infected host’s feed.

Juniper Networks will investigate false positives generated by this custom feed.

15. You issue the command shown in the exhibit.

Which policy will be active for the identified traffic?

Policy p4

Policy p7

Policy p1

Policy p12

16. You are asked to configure an SRX Series device to bypass all security features for IP traffic from the engineering department.

Which firewall filter will accomplish this task?

A)

Option A

Option B

Option C

Option D

17. Click the Exhibit button.

The IKE policy and proposal are configured properly on both devices as shown in the exhibit .

Which configuration snippet will complete the IKE configuration on the branch SRX Series device?

A)

Option A

Option B

Option C

Option D

18. In a Juniper ATP Appliance, what would be a reason for the mitigation rule to be in the failed-remove state?

The Juniper ATP Appliance received a commit error message from the SRX Series device

The Juniper ATP Appliance received an unknown error message from the SRX Series device

The Juniper ATP Appliance was not able to communicate with the SRX Series device

The Juniper ATP Appliance was not able to obtain the config lock

19. The monitor traffic interface command is being used to capture the packets destined to and the from the SRX Series device.

In this scenario, which two statements related to the feature are true? (Choose two.)

This feature does not capture transit traffic.

This feature captures ICMP traffic to and from the SRX Series device.

This feature is supported on high-end SRX Series devices only.

This feature is supported on both branch and high-end SRX Series devices.

20. You are asked to merge to corporate network with the network from a recently acquired company. Both networks use the same private IPv4 address space (172.25.126.0/24). An SRX Series device servers as the gateway for each network.

Which solution allows you to merge the two networks without modifying the current address assignments?

persistent NAT

NAT46

source NAT

double NAT

Page 3 of 3

21. You have downloaded and initiated the installation of the application package for the JATP Appliance on an SRX1500. You must confirm that the installation of the application package has completed successfully.

In this scenario, which command would you use to accomplish this task?

show services application-identification version

show services application-identification application detail

show services application-identification application version

show services application-identification status

22. You are connecting two remote sites to your corporate headquarters site; you must ensure that all traffic is secured and only uses a single Phase 2 SA for both sites.

In this scenario, which VPN should be used?

An IPsec group VPN with the corporate firewall acting as the hub device.

Full mesh IPsec VPNs with tunnels between all sites.

A hub-and-spoke IPsec VPN with the corporate firewall acting as the hub device.

A full mesh Layer 3 VPN with the corporate firewall acting as the hub device.