Get Juniper JN0-636 Dumps Questions Study Exam Guide Oct 18, 2023
JN0-636 Premium Exam Engine - Download Free PDF Questions
NEW QUESTION # 37
The show network-access aaa radius-servers command has been issued to solve authentication issues.
Referring to the exhibit, to which two authentication servers will the SRX Series device continue to send requests? (Choose two.)
- A. 192.168.30.191
- B. 192.168.30.190
- C. 192.168.30.188
- D. 200l:DB8:0:f101::2
Answer: A,C
NEW QUESTION # 38
Referring to the exhibit. You configure a traceoptions file called radius on your returns the output shown in the exhibit. What is the source of the problem?
- A. The authentication order is misconfigured.
- B. The RADIUS server IP address is unreachable.
- C. The RADIUS server suffered a hardware failure.
- D. An incorrect password is being used.
Answer: C
NEW QUESTION # 39
You are asked to provide single sign-on (SSO) to Juniper ATP Cloud. Which two steps accomplish this goal? (Choose two.)
- A. Configure Juniper ATP Cloud as the identity provider (IdP).
- B. Configure Microsoft Azure as the identity provider (IdP).
- C. Configure Juniper ATP Cloud as the service provider (SP).
- D. Configure Microsoft Azure as the service provider (SP).
Answer: B,D
NEW QUESTION # 40
Exhibit
You are asked to establish an IBGP peering between the SRX Series device and the router, but the session is not being established. In the security flow trace on the SRX device, packet drops are observed as shown in the exhibit.
What is the correct action to solve the problem on the SRX device?
- A. Modify the security policy to allow the BGP traffic.
- B. Create a firewall filter to accept the BGP traffic
- C. Add BGP to the Allowed host-inbound-traffic for the interface
- D. Configure destination NAT for BGP traffic.
Answer: B
NEW QUESTION # 41
Click the Exhibit button.
Which type of NAT is shown in the exhibit?
- A. persistent NAT
- B. NAT46
- C. NAT64
- D. DS-Lite
Answer: C
NEW QUESTION # 42
Click the Exhibit button.
You are asked to look at a configuration that is designed to take all traffic with a specific source IP address and forward the traffic to a traffic analysis server for further evaluation. The configuration is not working as intended.
Referring to the exhibit, which change must be made to correct the configuration?
- A. Apply the filter as an input filter on interface xe-0/2/1.0
- B. Apply the filter as an output filter on interface xe-0/1/0.0
- C. Apply the filter as an input filter on interface xe-0/0/1.0
- D. Create a routing instance named default
Answer: C
NEW QUESTION # 43
Referring to the exhibit, which two statements are true? (Choose two.)
- A. The c-1 TSYS has a reservation for the security flow resource.
- B. The c-1 TSYS has no reservation for the security flow resource.
- C. The c-1 TSYS cannot use any security flow resources.
- D. The c-1 TSYS can use security flow resources up to the system maximum.
Answer: B,C
NEW QUESTION # 44
A hub member of an ADVPN is not functioning correctly.
Referring the exhibit, which action should you take to solve the problem?
- A. [edit interfaces]
user@hub-1# delete ipsec vpn advpn-vpn traffic-selector - B. [edit security]
user@hub-1# set ike gateway advpn-gateway advpn suggester disable - C. [edit interfaces]
root@vSRX-1# delete st0.0 multipoint - D. [edit security]
user@hub-1# delete ike gateway advpn-gateway advpn partner
Answer: A
NEW QUESTION # 45
You are using destination NAT to translate the address of your HTTPS server to a private address on your SRX Series device. You have decided to implement IDP SSL decryption.
Upon enabling the decryption, you notice sessions are not decrypted.
Which action resolves the problem?
- A. Replace the server SSL certificate to use the public address.
- B. Enable the IDPsensor-configurationdetector to detect address translation.
- C. Reboot the SRX Series device.
- D. Increase the SSLsession-id-cache-timeoutvalue to any value greater than 5000 seconds.
Answer: B
NEW QUESTION # 46
Click the Exhibit button.
The IKE policy and proposal are configured properly on both devices as shown in the exhibit.
Which configuration snippet will complete the IKE configuration on the branch SRX Series device?
- A.
- B.
- C.
- D.
Answer: A
NEW QUESTION # 47
Click the Exhibit button.
You have recently committed the IPS policy shown in the exhibit. When evaluating the expected behavior, you notice that you have a session that matches all the rules in your IPS policy.
In this scenario, which action would be taken?
- A. ignore-connection
- B. close-client-and-server
- C. drop packet
- D. no-action
Answer: D
Explanation:
https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-idp-policy-rules- and-rulebases.html
NEW QUESTION # 48
What is the purpose of the Switch Microservice of Policy Enforcer?
- A. to isolate infected hosts
- B. to enroll SRX Series devices with Juniper ATP Cloud
- C. to synchronize security policies to SRX Series devices
- D. to inspect traffic for malware
Answer: B
NEW QUESTION # 49
Exhibit
You are using ATP Cloud and notice that there is a host with a high number of ETI and C&C hits sourced from the same investigation and notice that some of the events have not been automatically mitigated.
Referring to the exhibit, what is a reason for this behavior?
- A. The infected host score is globally set above a threat level of 5.
- B. The ETI events are false positives.
- C. The C&C events are false positives.
- D. The infected host score is globally set bellow a threat level of 5.
Answer: B
NEW QUESTION # 50
Exhibit
An administrator wants to configure an SRX Series device to log binary security events for tenant systems.
Referring to the exhibit, which statement would complete the configuration?
- A. Configure the tenant as master for the pi security profile.
- B. Configure the tenant as local for the pi security profile
- C. Configure the tenant as TSYS1 for the pi security profile.
- D. Configure the tenant as root for the pi security profile.
Answer: D
NEW QUESTION # 51
Regarding IPsec CoS-based VPNs, what is the number of IPsec SAs associated with a peer based upon?
- A. The number of forwarding classes configured for the VPN.
- B. The number of classifiers configured for the VPN.
- C. The number of CoS queues configured for the VPN.
- D. The number of traffic selectors configured for the VPN.
Answer: D
NEW QUESTION # 52
You have set up Security Director with Policy Enforcer and have configured 12 third-party feeds and a Sky ATP feed. You are also injecting 16 feeds using the available open API. You want to add another compatible feed using the available open API, but Policy Enforcer is not receiving the new feed.
What is the problem in this scenario?
- A. You cannot add more than 16 feeds with the available open API
- B. You have reached the maximum limit of 29 total feeds
- C. You must wait 48 hours for the feed to update
- D. You cannot add more than 16 feeds through the available open API
Answer: B
Explanation:
https://www.juniper.net/documentation/en_US/release-independent/sky-atp/information- products/pathway-pages/sky-atp-admin-guide.pdf page 110
NEW QUESTION # 53
Exhibit.
Referring to the exhibit, a spoke member of an ADVPN is not functioning correctly.
Which two commands will solve this problem? (Choose two.)
- A. [edit security ike gateway advpn-gateway]
user@srx# set version v1-only - B. [edit security ike gateway advpn-gateway]
user@srx# set advpn suggester disable - C. [edit interfaces]
user@srx# delete st0.0 multipoint - D. [edit security ike gateway advpn-gateway]
user@srx# delete advpn partner
Answer: B,D
Explanation:
https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-auto-discovery-vpns.html
NEW QUESTION # 54
Exhibit
You are using traceoptions to verity NAT session information on your SRX Series device Referring to the exhibit, which two statements are correct? (Choose two.)
- A. The SRX device is changing the destination address on this packet 10.0.1 1 to 172 20.101.10.
- B. This packet is part of an existing session.
- C. The SRX device is changing the source address on this packet from
- D. This is the first packet in the session
Answer: A,D
NEW QUESTION # 55
Click the Exhibit button.
A user is trying to reach a company's website, but the connection errors out. The security policies are configured correctly.
Referring to the exhibit, what is the problem?
- A. Static NAT is missing a rule for DNS server
- B. DNS ALG must be disabled
- C. Persistent NAT must be enabled
- D. The action for rule 1 must change to static-nat inet
Answer: A
NEW QUESTION # 56
Exhibit
The highlighted incident (arrow) shown in the exhibit shows a progression level of "Download" in the kill chain.
What are two appropriate mitigation actions for the selected incident? (Choose two.)
- A. Immediate response required: Block malware IP addresses (download server or CnC server)
- B. Immediate response required: Deploy IVP integration (if configured) to confirm if the endpoint has executed the malware and is infected.
- C. Not an urgent action: Use IVP to confirm if machine is infected.
- D. Immediate response required: Wipe infected endpoint hosts.
Answer: C,D
NEW QUESTION # 57
Referring to the exhibit, which two statements are true? (Choose two.)
- A. The configured solution allows IPv4 to IPv6 translation.
- B. The configured solution allows IPv6 to IPv4 translation.
- C. External hosts cannot initiate contact.
- D. The IPv6 address is invalid.
Answer: B,D
NEW QUESTION # 58
When would you use the port-overloading-factor 1 setting?
- A. to set the maximum port-overloading capacity to 65,536
- B. to map ports with 1:1 ratio for port-overloading
- C. to disable the port-overloading
- D. to enable the port-overloading
Answer: C
Explanation:
https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration- statement/security-edit-port-overloading-interface-source-nat.html
NEW QUESTION # 59
Click the Exhibit button.
When attempting to enroll an SRX Series device to JATP, you receive the error shown in the exhibit.
What is the cause of the error?
- A. The SRX Series device does not have an IP address assigned to the interface that accesses JATP
- B. The SRX Series device certificate does not match the JATP certificate
- C. A firewall is blocking HTTPS on fxp0
- D. The fxp0 IP address is not routable
Answer: A
NEW QUESTION # 60
......
Free JN0-636 Exam Braindumps Juniper Pratice Exam: https://www.ipassleader.com/Juniper/JN0-636-practice-exam-dumps.html
Instant Download JN0-636 Free Updated Test Dumps: https://drive.google.com/open?id=1JW2u0xy8hS1EGN3K6UmmKfKg7BgSX37t