Free JN0-637: Security - Professional (JNCIP-SEC) Exam Questions and Answers

You are configuring MACsec on the link between an SRX Series device and an access switch. The interfaces are up, but no secure channel is established. Referring to the exhibit, which statement is correct? Exhibit: user@srx# show security macsec connectivity-association ca1 { security-mode static-cak; pre-shared-key { ckn a1b2c3d4e5f60718; cak 228ef255aa23ff6729ee664acb66e91f; } } interfaces { ge-0/0/3 { connectivity-association ca1; } } user@switch# show security macsec connectivity-association ca1 { security-mode static-cak; pre-shared-key { ckn a1b2c3d4e5f60718; cak 228ef255aa23ff6729ee664acb66e91e; } } interfaces { xe-0/0/1 { connectivity-association ca1; } }

• AA. The MKA session forms because the CKN values match, and the peers negotiate a common CAK between themselves.
• BB. The interface forwards frames in clear text because the connectivity association falls back to unprotected mode.
• CC. The MKA session fails because each peer must use a different CKN so that the key server election can complete.
• DD. The MKA session fails because the CAK values differ, even though the CKN values match.

IPv6-only hosts in the trust zone (2001:db8:10::/64) must reach an IPv4 server at 203.0.113.10 in the untrust zone. The DNS64 service returns 64:ff9b::cb00:710a for the server name. Flow traces show that the destination address is translated to 203.0.113.10, but the session is never established. Referring to the exhibit, what is missing from the NAT configuration? Exhibit: user@srx# show security nat static { rule-set nat64-static { from zone trust; rule r1 { match { destination-address 64:ff9b::/96; } then { static-nat { inet; } } } } }

• AA. Proxy NDP entries for the 64:ff9b::/96 prefix on the interface in the untrust zone
• BB. A source NAT rule set that translates the IPv6 source addresses to an IPv4 pool
• CC. A DNS doctoring rule that rewrites the A record returned for the IPv4 server name
• DD. A destination NAT pool that maps the 64:ff9b::/96 prefix to the IPv4 server address 203.0.113.10

Two SRX Series devices run multinode HA in active/backup mode. Node 0 is configured with activeness-priority 100 for SRG1 and node 1 is configured with activeness-priority 200 for SRG1. No preemption is configured. Node 1 was powered off for maintenance, so node 0 became active. Node 1 is now back online, the ICL is up, and all monitored objects on both nodes are healthy. Which statement describes the behavior of SRG1?

• AA. Node 1 becomes active immediately because it has the higher activeness priority.
• BB. Both nodes become active for SRG1 until the ICL finishes synchronizing the session table.
• CC. Node 1 becomes active after the next commit because the priorities are re-evaluated.
• DD. Node 0 remains active because preemption is not configured for the SRG.

You have configured APBR so that YouTube traffic uses ISP-B, while other web traffic uses ISP-A. The profile is applied in the permit action of the matching security policy, but YouTube sessions are still routed through ISP-A. YouTube is a member of the junos:web application group. Referring to the exhibit, what should you do? Exhibit: user@srx> show configuration security advanced-policy-based-routing | display set set security advanced-policy-based-routing profile apbr-prof rule r1 match dynamic-application-group junos:web set security advanced-policy-based-routing profile apbr-prof rule r1 then routing-instance isp-a-ri set security advanced-policy-based-routing profile apbr-prof rule r2 match dynamic-application junos:YOUTUBE set security advanced-policy-based-routing profile apbr-prof rule r2 then routing-instance isp-b-ri

• AA. Configure a firewall filter in isp-b-ri that matches the YouTube destination addresses.
• BB. Apply apbr-prof in a second security policy placed above the existing policy.
• CC. Reorder the rules in the profile so that r2 is evaluated before r1.
• DD. Replace the routing-instance action in r2 with a next-hop interface toward ISP-B.

An SRX Series device is enrolled with Juniper ATP Cloud. You created a security-intelligence profile named cc-profile that blocks high threat-level command-and-control (C&C) servers, and a security-intelligence policy named si-pol that references it. Outbound connections to known C&C servers are still permitted by security policy p1 from the trust zone to the untrust zone. What is missing?

• AA. A UTM antivirus profile that is applied to policy p1 to inspect the outbound C&C traffic
• BB. An IDP policy that is set as active and includes the C&C signature category
• CC. The si-pol security-intelligence policy referenced in the permit action of policy p1
• DD. A static address-book entry listing the C&C server addresses, referenced in the match criteria of policy p1

An SRX Series device hosts a user logical system named LSYS-A. The LSYS-A administrator logs in and attempts to commit a change that raises the security policy resource reservation defined in the security profile bound to LSYS-A. What is the result?

• AA. The commit succeeds because a user logical system administrator has full control over resources in that logical system.
• BB. The commit succeeds but takes effect only after the root-logical-system synchronizes the change.
• CC. The commit succeeds if the new total stays below the maximum supported by the device.
• DD. The commit fails because only the primary administrator can configure security profiles.

Users in the trust zone report that TCP port 443 connections from host 10.20.4.37 to a server at 172.16.80.12 in the dmz zone time out. No policy between these zones matches the traffic, no logging is configured in any policy, and you suspect the SRX Series device is dropping the packets under the default deny behavior. You need to collect evidence of the drop on the device. In this scenario, which two actions would accomplish this task? (Choose two.)

Select 2 answers.

• AA. Run show security flow session with source-prefix and destination-prefix filters and look for the entry showing the dropped session
• BB. Create an explicit deny policy for this traffic from trust to dmz with log session-init, then review the security log
• CC. Configure security log mode stream and a syslog host, without enabling logging in any security policy
• DD. Configure security flow traceoptions with a packet-filter for the source and destination addresses and the basic-datapath flag, then review the trace file

Referring to the exhibit, the ge-0/0/4 interfaces on SRX-1 and SRX-2 are directly connected. The administrator confirms that the same CAK string was entered on both devices, but the MACsec session does not come up. Exhibit: user@srx-1# show security macsec connectivity-association ca-core { cipher-suite gcm-aes-128; security-mode static-cak; pre-shared-key { ckn 37c9c2c45ddd012a; cak "$9$Hk5FCtu1hrK8xIEhSyKMWLxNb2aZjHqm"; ## SECRET-DATA } } interfaces { ge-0/0/4 { connectivity-association ca-core; } } user@srx-2# show security macsec connectivity-association ca-core { cipher-suite gcm-aes-128; security-mode static-cak; pre-shared-key { ckn 37c9c2c45ddd012b; cak "$9$wX2aUjHqfT3iH5Qz6tOBEhyKvWX7dsYg"; ## SECRET-DATA } } interfaces { ge-0/0/4 { connectivity-association ca-core; } } What should you do to solve the problem?

• AA. Configure include-sci on both devices
• BB. Set a lower MKA key-server-priority on SRX-1
• CC. Change the CKN on SRX-2 to 37c9c2c45ddd012a
• DD. Change the security mode to dynamic on both devices

You want to create a connection for communication between tenant systems without using physical revenue ports on the SRX Series device. What are two ways to accomplish this task? (Choose two.)

Select 2 answers.

• AA. Use an external router.
• BB. Use an interconnect VPLS switch.
• CC. Use a secure wire.
• DD. Use a point-to-point logical tunnel.

Exhibit: Referring to the exhibit, which two statements are correct? (Choose two.)

Select 2 answers.

• AA. The ge-0/0/3.0 and ge-0/0/4.0 interfaces are not active and will not respond to ARP requests to the virtual IP MAC address.
• BB. This device is the backup node for SRG1.
• CC. The ge-0/0/3.0 and ge-0/0/4.0 interfaces are active and will respond to ARP requests to the virtual IP MAC address.
• DD. This device is the active node for SRG1.