Free Juniper JN0-633 Exam Dumps Questions & Answers

You have an existing group VPN established in your internal network using the group-id 1. You have been asked to configure a second group using the group-id 2. You must ensure that the key server for group 1 participates in group 2 but is not the key server for that group.Which statement is correct regarding the group configuration on the current key server for group 1?

• A.  You must configure both groups at the [edit security ike] hierarchy.
• B.  You must configure both groups at the [edit security group-vpn member] hierarchy.
• C.  You must configure both groups at the [edit security ipsec vpn] hierarchy.
• D.  You must configure both groups at the [edit security group-vpn] hierarchy.

Click the Exhibit button.
[edit security application-firewall]
user@host# show
rule-sets web {
rule one {
match {
dynamic-application junos:HTTP;
}
then {
permit;
}
}
default-rule {
reject;
}
}
What will happen to non-HTTP traffic that matches the application-firewall policy shown in the exhibit?

• A.  It will be denied because this is a blacklist policy.
• B.  It will be allowed because this is a whitelist policy.
• C.  It will be silently dropped.
• D.  It will be dropped and an error will be sent to the source.

HostA (1.1.1.1) is sending TCP traffic to HostB (2.2.2.2). You need to capture the TCP packets locally on the SRX240. Which configuration would you use to enable this capture?

• A.  [edit security flow]
  user@srx# show
  traceoptions {
  file dump;
  flag basic-datapath;
  }
• B.  [edit security]
  user@srx# show
  application-tracking {
  enable;
  }
  flow {
  traceoptions {
  file dump;
  flag basic-datapath;
  }
  }
• C.  [edit firewall filter capture term one]
  user@srx# show
  from {
  source-address {
  1.1.1.1;
  }
  destination-address {
  2.2.2.2;
  }
  protocol tcp;
  }
  then {
  port-mirror;
  accept;
  }
• D.  [edit firewall filter capture term one]
  user@srx# show
  from {
  source-address {
  1.1.1.1;
  }
  destination-address {
  2.2.2.2;
  }
  protocol tcp;
  } then { sample; accept; }

Click the Exhibit button.
-- Exhibit --
security {
nat {
destination {
pool Web-Server {
address 10.0.1.5/32;
}
rule-set From-Internet {
from zone Untrust;
rule To-Web-Server {
match {
source-address 0.0.0.0/0;
destination-address 172.16.1.7/32;
}
then {
destination-nat pool Web-Server;
}
}
}
}
}
zones {
security-zone Untrust {
address-book {
address Web-Server-External 172.16.1.7/32;
address Web-Server-Internal 10.0.1.5/32;
}
interfaces {
ge-0/0/0.0;
}
}
security-zone DMZ {
address-book {
address Web-Server-External 172.16.1.7/32;
address Web-Server-Internal 10.0.1.5/32;
}
interfaces {
ge-0/0/1.0;
}
}
}
}
-- Exhibit -
You are migrating from one external address block to a different external address block. You want to enable a smooth transition to the new address block. You temporarily want to allow external users to contact the Web server using both the existing external address as well as the new external address 192.168.1.1.
How do you accomplish this goal?

• A.  Create a new rule for the new address in the [edit security nat destination rule-set From-Internet] hierarchy.
• B.  Change the address Web-Server-Ext objects to be address-set objects that include both addresses.
• C.  Change the destination address under [edit security nat destination rule-set From-Internet rule To-Web-Server match] to include both 172.16.1.7/32 and 192.168.1.2/32.
• D.  Add address 192.168.1.1/32 under [edit security nat destination pool Web-Server].

You have initiated the download of the IPS signature database on your SRX Series device.
Which command would you use to confirm the download has completed?

• A.  request security idp security-package install
• B.  request security idp security-package download
• C.  request security idp security-package install status
• D.  request security idp security-package download status