we provide Certified Juniper JN0-633 exam topics which are the best for clearing JN0-633 test, and to get certified by Juniper Security, Professional (JNCIP-SEC). The JN0-633 Questions & Answers covers all the knowledge points of the real JN0-633 exam. Crack your Juniper JN0-633 Exam with latest dumps, guaranteed!
♥♥ 2017 NEW RECOMMEND ♥♥
Free VCE & PDF File for Juniper JN0-633 Real Exam (Full Version!)
★ Pass on Your First TRY ★ 100% Money Back Guarantee ★ Realistic Practice Exam Questions
Q91. You are asked to merge the corporate network with the network from a recently acquired company. Both networks use the same private IPv4 address space (172.25.126.0/24). An SRX device serves as the gateway for each network.Which solution allows you to merge the two networks without adjusting the current address assignments?
A. source NAT
B. persistent NAT
C. double NAT
Q92. Click the Exhibit button.
-- Exhibit --
Based on the output shown in the exhibit, what are two results? (Choose two.)
A. The output shows source NAT.
B. The output shows destination NAT.
C. The port information is changed.
D. The port information is unchanged.
Q93. Which QoS function is supported in transparent mode?
C. IP precedence
D. MPLS EXP
Explanation: Reference: http://chimera.labs.oreilly.com/books/1234000001633/ch06.html
Q94. You are working as a security administrator and must configure a solution to protect against distributed botnet attacks on your company's central SRX cluster.
How would you accomplish this goal?
A. Configure AppTrack to inspect and drop traffic from the malicious hosts.
B. Configure AppQoS to block the malicious hosts.
C. Configure AppDoS to rate limit connections from the malicious hosts.
D. Configure AppID with a custom application to block traffic from the malicious hosts.
Reference :Page No 2 Figure 1 http://www.juniper.net/us/en/local/pdf/datasheets/1000327-en.pdf
Q95. Which statement is true regarding dual-stack lite?
A. The softwire is an IPv4 tunnel over an IPv6 network.
B. The softwire initiator (SI) encapsulates IPv6 packets in IPv4.
C. The softwire concentrator (SC) decapsulates softwire packets.
D. SRX devices support the softwire concentrator and softwire initiator functionality.
Explanation: Reference:http://www.juniper.net/techpubs/en_US/junos/topics/concept/ipv6-ds-lite- overview.html
Q96. Which three match condition objects are required when creating IPS rules? (Choose three.)
A. attack objects
B. address objects
C. terminal objects
D. IP action objects
E. zone objects
Explanation: Reference: http://www.juniper.net/techpubs/software/junos-security/junos-security10.2/junos-security-swconfig-security/topic-42453.html#understand-rule-match- cond-section
Q97. You are performing AppSecure traffic processing to enforce AppFW.
What happens when traffic matching an established security session is newly detected as a different application?
A. The security processing facility of the data plane re-examines the whitelist or blacklist referenced in the security policy to see if the new application is permitted.
B. The newly detected application will not be permitted and session will be torn down unless a specific match exists against the exempt rulebase.
C. Zone-based firewall rules will be re-parsed to determine if a rule exists that permits the newly detected application.
D. The application will not be permitted if doing so would violate the session limit in the screen properties applied to that zone.
Q98. Click the Exhibit button.
user @host> show bgp summary logical-system LSYS1 Groups : 11 Peers : 10 Down peers: 1
Table Tot. Paths Act Paths Suppressed History Damp State Pending
inet.0 141 129 0 0 0 Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
192.168.64.12 65008 11153 11459 0 26 3d
3:10:43 9/10/10/0 0/0/0/0
192.168.72.12 65009 11171 11457 0 26 3d
3:10:39 11/12/12/0 0/0/0/0
192.168.80.12 65010 9480 9729 0 27 3d
3:10:42 11/12/12/0 0/0/0/0
192.168.88.12 65011 11171 11457 0 25 3d
3:10:31 12/13/13/0 0/0/0/0
192.168.96.12 65012 9479 9729 0 26 3d
3:10:34 12/13/13/0 0/0/0/0
192.168.10.12 65013 111689 11460 0 27 3d
3:10:46 9/10/10/0 0/0/0/0
192.168.11.12 65014 111688 11458 0 25 3d
3:10:42 9/10/10/0 0/0/0/0
192.168.12.12 65015 111687 11457 0 25 3d
3:10:38 9/10/10/0 0/0/0/0
188.8.131.52 650168 9478 9729 0 25 3d
3:10:42 9/10/10/0 0/0/0/0
192.168.13.12 65017 111687 11457 0 27 3d
3:10:30 9/10/10/0 0/0/0/0
192.168.16.12 65017 111687 11457 0 27 1w3d2h
user@host> show interfaces ge-0/0/7.0 extensive
Logical interface ge-0/0/7.0 (Index 76) (SNMP ifIndex 548) (Generation 141)
Security: Zone: log
Allowed host-inbound traffic : bootp dns dhcp finger ftp tftp ident-reset http https ike netconf ping reverse-telnet reverse-ssh rloqin rpm rsh snmp
snmp-trap ssh telnet traceroute xnm-clear-text xnm-ssl lsping ntp sip r2cp
Flow Statistics: Flow Input statistics: Self packets: 0
ICMP packets: 0
VPN packets: 0
Multicast packets: 0
Bytes permitted by policy: 0
Connections established: 0 Flow Output statistics: Multicast packets: 0
Bytes permitted by policy: 0
Flow error statistics (Packets dropped due to): Address spoofing: 0
Authentication failed: 0 Incoming NAT errors: 0
Invalid zone received packet: 0 Multiple user authentications: 0 Multiple incoming NAT: 0
No parent for a gate: 0
No one interested in self pakets: 0 No minor session: 0
No more sessions: 589723 No NAT gate: 0
No route present: 0
No SA for incoming SPI: 0 No tunnel found: 0
No session for a gate: 0
No zone or NULL zone binding 0 Policy denied: 0
Security association not active: 0
TCP sequence number out of window: 0 Syn-attack protection: 0
User authentication errors: 0
Protocol inet, MTU: 1500, Generation: 1685, Route table: 0 Flags: Sendbcast-pkt-to-re
Addresses, F1ags: Is-Preferred Is-Primary
Destination: 10.5.123/24, Local: 10.5.123.3, Broadcast: 10.5.123.255, Generation: 156
Protocol multiservice, MTU: Unlimited, Generation: 1686, Route table: 0 Policer: Input: default_arp_policer
An SRX Series device has been configured with a logical system LSYS1. One of the BGP peers is down.
Referring to the exhibit, which statement explains this problem?
A. The LSYS license only allows up to ten BGP peerings.
B. The maximum number of allowed flows is set to low.
C. The allocated memory is not sufficient for this LSYS.
D. The minimum number of flows is set to high.
Q99. Click the Exhibit button.
-- Exhibit --
You receive complaints from users that their Web browsing sessions keep dropping prematurely. Upon investigation, you find that the IDP policy shown in the exhibit is detecting the users' sessions as HTTP:WIN-CMD:WIN-CMD-EXE attacks, even though their sessions are not actual attacks. You must allow these sessions but still inspect for all other relevant attacks.
How would you configure your SRX device to meet this goal?
A. Create a new security policy that allows HTTP for all users and does not apply IDP.
B. Modify the security policy to add an application exception.
C. Modify the IDP policy to delete this particular attack from the IDP rulebase.
D. Modify the IDP policy to add an exempt rulebase rule to not inspect for this attack.
Q100. Referring to the following output, which command would you enter in the CLI to produce this result?
Ruleset Application Client-to-server Rate(bps) Server-to-client Rate(bps) http-App-QoS HTTP ftp-C2S 200 ftp-C2S 200
http-App-QoS HTTP ftp-C2S 200 ftp-C2S 200
ftp-App-QoS FTP ftp-C2S 100 ftp-C2S 100
A. show class-of-service interface ge-2/1/0
B. show interface flow-statistics ge-2/1/0
C. show security flow statistics
D. show class-of-service applications-traffic-control statistics rate-limiter