JN0-333 시험 - Juniper실제시험문제와 답 - 75문항

Question No : 1

Which statement is true about high availability (HA) chassis clusters for the SRX Series device?

A.Cluster nodes require an upgrade to HA compliant Routing Engines.
B.Cluster nodes must be connected through a Layer 2 switch.
C.There can be active/passive or active/active clusters.
D.HA clusters must use NAT to prevent overlapping subnets between the nodes.

정답:

Question No : 2

You need to configure an IPsec tunnel between a remote site and a hub site. The SRX Series device at the remote site receives a dynamic IP address on the external interface that you will use for IPsec.
Which feature would you need to configure in this scenario?

A.NAT-T
B.crypto suite B
C.aggressive mode
D.IKEv2

정답:

Question No : 3

You want to trigger failover of redundancy group 1 currently running on node 0 and make node 1 the primary node the redundancy group 1.
Which command would be used accomplish this task?

A.user@host# set chassis cluster redundancy-group 1 node 1
B.user@host> request chassis cluster failover redundancy-group 1 node 1
C.user@host# set chassis cluster redundancy-group 1 preempt
D.user@host> request chassis cluster failover reset redundancy-group 1

정답:

Question No : 4

Click the Exhibit button.

Users at a remote office are unable to access an FTP server located at the remote corporate data center as expected. The remote FTP server is listening on the non-standard TCP port 2121.
Referring to the exhibit, what is causing the problem?

A.The FTP clients must be configured to listen on non-standard client ports for the FTP data channel negotiations to succeed.
B.Two custom FTP applications must be defined to allow bidirectional FTP communication through the SRX Series device.
C.The custom FTP application definition does not have the FTP ALG enabled.
D.A new security policy must be defined between the untrust and trust zones.

정답:

Question No : 5

100.75.75. The external DNS server address is 75.75.76.76. Traffic from the inside server to the DNS server fails.
Referring to the exhibit, what is causing the problem?

A.The security policy must match the translated destination address.
B.Source and static NAT cannot be configured at the same time.
C.The static NAT rule must use the global address book entry name for the DNS server.
D.The security policy must match the translated source and translated destination address.

정답:

Question No : 6

Which SRX5400 component is responsible for performing first pass security policy inspection?

A.Routing Engine
B.Switch Control Board
C.Services Processing Unit
D.Modular Port Concentrator

정답:

Question No : 7

Which three statements describes traditional firewalls? (Choose three.)

A.A traditional firewall performs stateless packet processing.
B.A traditional firewall offers encapsulation, authentication, and encryption.
C.A traditional firewall performs stateful packet processing.
D.A traditional firewall forwards all traffic by default.
E.A traditional firewall performs NAT and PA

정답:

Question No : 8

Which interface is used exclusively to forward Ethernet-switching traffic between two chassis cluster nodes?

A.swfab0
B.fxp0
C.fab0
D.me0

정답:

Question No : 9

You must verify if destination NAT is actively being used by users connecting to an internal server from the Internet.
Which action will accomplish this task on an SRX Series device?

A.Examine the destination NAT translations table.
B.Examine the installed routes in the packet forwarding engine.
C.Examine the NAT translation table.
D.Examine the active security flow sessions.

정답:

Question No : 10

After an SRX Series device processes the first packet of a session, how are subsequent packets for the same session processed?

A.They are processed using fast-path processing.
B.They are forwarded to the control plane for deep packet inspection.
C.All packets are processed in the same manner.
D.They are queued on the outbound interface until a matching security policy is found.

정답:

Question No : 11

You want to protect your SRX Series device from the ping-of-death attack coming from the untrust security zone.
How would you accomplish this task?

A.Configure the host-inbound-traffic system-services ping except parameter in the untrust security zone.
B.Configure the application tracking parameter in the untrust security zone.
C.Configure a from-zone untrust to-zone trust security policy that blocks ICMP traffic.
D.Configure the appropriate screen and apply it to the [edit security zone security-zone untrust] hierarchy.

정답:

Question No : 12

Which statement describes the function of screen options?

A.Screen options encrypt transit traffic in a tunnel.
B.Screen options protect against various attacks on traffic entering a security device.
C.Screen options translate a private address to a public address.
D.Screen options restrict or permit users individually or in a group.

정답:

Question No : 13

What is the function of redundancy group 0 in a chassis cluster?

A.Redundancy group 0 identifies the node controlling the cluster management interface IP addresses.
B.The primary node for redundancy group 0 identifies the first member node in a chassis cluster.
C.The primary node for redundancy group 0 determines the interface naming for all chassis cluster nodes.
D.The node on which redundancy group 0 is primary determines which Routing Engine is active in the cluster.

정답:

Question No : 14