Free JN0-1332: Security Design. Specialist (JNCDS-SEC) Exam Questions and Answers

A service provider wants to drop a DDoS attack aimed at a single customer address at every edge router, without editing the firewall filters on each router individually. Which technique should you include in the design?

• AA. A policing firewall filter applied to the lo0 interface of each edge router
• BB. Remotely triggered black hole filtering using a BGP-advertised discard route
• CC. Class-based forwarding that maps the attack traffic into a low-priority queue
• DD. Strict-mode unicast reverse path forwarding on every customer-facing interface

A company wants its SRX Series devices to apply IPS and content filtering to HTTPS sessions that employees start to Internet websites. The devices currently cannot see inside the encrypted sessions. Which feature should you include in the design?

• AA. Unified threat management antivirus using the default profile on the zone
• BB. Application tracking with AppTrack logging for each HTTPS session
• CC. SSL reverse proxy with the web server certificate loaded on the SRX device
• DD. SSL forward proxy with a trusted root CA certificate deployed to client devices

Refer to the exhibit. Exhibit: [edit security policies from-zone trust to-zone dmz] policy block-web { match { source-address any; destination-address any; application junos-http; } then { deny; } } policy allow-hr-web { match { source-address hr-subnet; destination-address web-srv; application junos-http; } then { permit; } } Users in hr-subnet cannot reach web-srv over HTTP. Only HR users must reach web-srv, and all other trust users must remain blocked. Which design change meets the requirements?

• AA. Place allow-hr-web ahead of block-web in the policy order
• BB. Add a global policy that permits hr-subnet to web-srv for junos-http
• CC. Change the application in allow-hr-web from junos-http to any
• DD. Change the default policy to permit-all for the trust to dmz zone pair

Which BGP capability allows a service provider to distribute traffic-matching and rate-limiting rules between routers for DDoS mitigation?

• AA. BGP Flow Specification using the inet flow family
• BB. BGP labeled unicast using the inet labeled-unicast family
• CC. BGP Monitoring Protocol with a BMP station
• DD. Route target constraint using the route-target family

Which EX Series feature should be enabled on an access VLAN so that only trusted ports can send DHCP server replies?

• AA. Dynamic ARP inspection
• BB. DHCP snooping
• CC. MAC address limiting
• DD. IP source guard

A retail company is deploying Wi-Fi in 40 branch offices. Employees must authenticate with their individual directory credentials, and each session must use unique encryption keys so that one employee cannot decrypt another employee's traffic. Which wireless security design should you recommend?

• AA. WPA2-Personal with a pre-shared key that is changed every month on all of the access points
• BB. WPA2-Personal with MAC address filtering and a hidden SSID configured on every access point
• CC. WPA2-Enterprise with 802.1X authentication and a RADIUS server backed by the directory
• DD. An open SSID with a captive portal that collects directory credentials over HTTPS from each user

A company lets employees use personal tablets on the branch Wi-Fi network. The SRX Series firewall must apply user-based security policies, but the tablets are not members of the Active Directory domain. How should you obtain the user identity?

• AA. Configure the integrated user firewall to read the security event logs of the domain controllers
• BB. Configure firewall authentication with a captive portal so that users log in before traffic is permitted
• CC. Use the DHCP lease table on the SRX to map each tablet's hostname to an employee name
• DD. Enter static IP-to-user mappings on the SRX for each tablet in the branch office

Two data centers are joined by a dedicated dark fiber pair. The customer requires all Ethernet frames between the 100GbE switches at each site to be encrypted at line rate with minimal added latency. Which technology should you recommend?

• AA. An IPsec site-to-site VPN established between SRX firewalls at each site
• BB. MACsec enabled on the interconnect links between the switches
• CC. 802.1X port authentication enabled on the interconnect switch ports
• DD. GRE tunnels with keepalives configured between the border routers

A company must publish an HTTPS web application on the Internet. The web servers query a database server on the internal network, and the Internet must never have direct access to the database. Which design should you recommend for the SRX Series firewall at the Internet edge?

• AA. Place the web servers in the trust zone and use a security policy to permit only HTTPS from the Internet
• BB. Place the web servers in the untrust zone and permit the database port from the untrust zone to the database server
• CC. Place the web servers in a DMZ zone and permit only the database port from the DMZ to the internal database server
• DD. Place the web servers in the same zone as the database server and use destination NAT to publish them

A service provider peers with enterprise customers using eBGP. After one customer misconfigured its router and advertised more than 400,000 routes, the provider's edge router ran low on memory. You must prevent this from happening again. What should you include in the design?

• AA. A maximum prefix limit on each customer BGP neighbor with a defined action
• BB. BGP graceful restart enabled on all of the provider edge routers
• CC. BGP route dampening on all of the customer eBGP sessions
• DD. Unicast reverse path forwarding in strict mode on customer-facing interfaces