http://https://www.lead1pass.com/Juniper/JN0-333-practice-exam-dumps.html (65 Q&As Dumps, 30%OFF Special Discount: 30free )

NEW QUESTION NO: 6
What are three characteristics of session-based forwarding, compared to packet-based forwarding, on an SRX Series device? (Choose three.)
A. Session-based forwarding requires less memory.
B. Session-based forwarding uses six tuples of information.
C. Session-based forwarding performs faster processing of existing session.
D. Session-based forwarding uses stateless packet processing,
E. Session-based forwarding uses stateful packet processing.
Answer: B,C,E

NEW QUESTION NO: 7
Which SRX5400 component is responsible for performing first pass security policy inspection?
A. Modular Port Concentrator
B. Routing Engine
C. Services Processing Unit
D. Switch Control Board
Answer: C

NEW QUESTION NO: 8
You must verify if destination NAT is actively being used by users connecting to an internal server from the Internet.
Which action will accomplish this task on an SRX Series device?
A. Examine the destination NAT translations table.
B. Examine the installed routes in the packet forwarding engine.
C. Examine the active security flow sessions.
D. Examine the NAT translation table.
Answer: A

NEW QUESTION NO: 9
Your internal webserver uses port 8088 for inbound connections. You want to allow external HTTP traffic to connect to the webserver.
Which two actions would accomplish this task? (Choose two.)
A. Use destination NAT to remap incoming traffic from port 80 to port 8088.
B. Create a custom application for port 8088 and create a security policy that permits the custom-http application.
C. Create an Application Layer Gateway to permit HTTP traffic on port 8088.
D. Remap port 80 to port 8088 in the junos-httpapplication and create a security policy that permits the junos-httpapplication.
Answer: A,B

NEW QUESTION NO: 10
Click the Exhibit button.

Which statement would explain why the IP-monitoring feature is functioning incorrectly?
A. The secondary IP address should be on a different subnet than the reth IP address.
B. The global weight value is too large for the configured global threshold.
C. The monitored IP address is not on the same subnet as the reth IP address.
D. The secondary IP address is the same as the reth IP address.
Answer: D

NEW QUESTION NO: 11
Which three statements describes traditional firewalls? (Choose three.)
A. A traditional firewall forwards all traffic by default.
B. A traditional firewall offers encapsulation, authentication, and encryption.
C. A traditional firewall performs stateless packet processing.
D. A traditional firewall performs NAT and PAT.
E. A traditional firewall performs stateful packet processing.
Answer: B,D,E

NEW QUESTION NO: 12
Which statement is true about Perfect Forward Secrecy (PFS)?
A. PFS increases the IPsec VPN encryption key length and uses RSA or DSA certificates.
B. PFS increases security by forcing the peers to perform a second DH exchange during Phase 2.
C. PFS is used to resolve compatibility issues with third-party IPsec peers.
D. PFS is implemented during Phase 1 of IKE negotiations and decreases the amount of time required for IKE negotiations to complete.
Answer: B

NEW QUESTION NO: 13
What are two fields that an SRX Series device examines to determine if a packet is associated with an existing flow? (Choose two.)
A. type of service
B. protocol
C. source MAC address
D. source IP address
Answer: B,D

NEW QUESTION NO: 14
You want to protect your SRX Series device from the ping-of-death attack coming from the untrust security zone.
How would you accomplish this task?
A. Configure the application trackingparameter in the untrust security zone.
B. Configure the appropriate screen and apply it to the [edit security zone security-zone untrust]hierarchy.
C. Configure a from-zone untrust to-zone trustsecurity policy that blocks ICMP traffic.
D. Configure the host-inbound-traffic system-services ping except parameter in the untrust security zone.
Answer: B

NEW QUESTION NO: 15
You want to implement IPsec on your SRX Series devices, but you do not want to use a preshared key.
Which IPsec implementation should you use?
A. tunnel mode
B. aggressive mode
C. public key infrastructure
D. next-hop tunnel binding
Answer: C

NEW QUESTION NO: 16
You recently configured an IPsec VPN between two SRX Series devices. You notice that the Phase 1 negotiation succeeds and the Phase 2 negotiation fails.
Which two configuration parameters should you verify are correct? (Choose two.)
A. Verify that the IPsec policy references the correct IKE proposals.
B. Verify that the VPN tunnel configuration references the correct IKE gateway.
C. Verify that the IKE initiator is configured for main mode.
D. Verify that the IKE gateway proposals on the initiator and responder are the same.
Answer: A,D