Juniper JN0-633 問題集

質問 1：
Click the Exhibit button.
-- Exhibit-

-- Exhibit -
An attacker is using a nonstandard port for HTTP for reconnaissance into your network.
Referring to the exhibit, which two statements are true? (Choose two.)
A. The IPS engine will not detect the application due to the nonstandard port.
B. The IPS engine will detect the application regardless of the nonstandard port.
C. The IPS engine will perform application identification until it processes the first 256 bytes of the packet.
D. The IPS engine will perform application identification until the session is established.
正解：B,C
解説: (Topexam メンバーにのみ表示されます)

質問 2：
You are asked to design a solution to verify IPsec peer reachability with data path forwarding.
Which feature would meet the design requirements?
A. VPN monitoring over Phase 2 SA
B. DPD over Phase 2 SA
C. VPN monitoring over Phase 1 SA
D. DPD over Phase 1 SA
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Click the Exhibit button.
user@key-server> show security group-vpn server ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 97 UP bb224408940cc5d 435b9404284083c2 Main 192.168.11.1 98 UP 242c840089404d15 ab19284089408ba8 Main 192.168.11.2
user@key-server> show security group-vpn server ipsec security-associations Group: group-1, Group Id: 1 Total IPsec SAs: 1 IPsec SA Algorithm SPI Lifetime group-l-sa ESP:3des/shal 1343991c 2736 Group: group-2, Group id: 2 Total IPsec SAs: 1 IPsec SA Algorithm SPI Lifetime group-2-sa ESP:3des/shal 13be9e9 2741 Group: group-3, Group Id: 3 Total IPsec SAs: 1 IPsec SA Algorithm SPI Lifetime group-3-sa ESP:3des/shal 20709057 2741 Group: group-4, Group Id: 4 Total IPsec SAs: 1 IPsec SA Algorithm SPI Lifetime group-4-sa ESP:3des/shal 5111c2e1 2741
Which statement is correct regarding the outputs shown in the exhibit?
A. Two established peers are in the group VPNs.
B. No established peer is in the group VPNs.
C. Four established peers are in the group VPNs.
D. One established peer is in the group VPNs.
正解：A

質問 4：
Your company has added a connection to a new ISP and you have been asked to send specific traffic to the new ISP.
You have decided to implement filter-based forwarding. You have configured new routing instances with type forwarding.
You must direct traffic into each instance.Which step would accomplish this goal?
A. Create a static default route for each ISP in inet.0, each pointing to a different forwarding instance.
B. Configure the ingress and egress interfaces in each forwarding instance.
C. Add a firewall filter to the ingress interface that specifies the intended routing instance as the action.
D. Create a routing policy to direct the traffic to the required forwarding instances.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Click the Exhibit button
[edit security]
user@host# show policies
global {
policy new-policy {
match {
source-address any;
destination-address any;
application junos-https;
}
then {
permit {
application-services {
application-firewall {
rule-set appfw;
}
}
}
}
}
}
[edit security]
user@host# show application-firewall
rule-sets appfw {
rule 1 {
match {
dynamic-application junos:SSL;
}
then {
permit;
}
}
rule 2 {
match {
dynamic-application junos:HTTP;
}
then {
reject;
}
}
default-rule {
permit;
}
}
Referring to the exhibit, which two statements are correct? (Choose two.)
A. HTTPS traffic is permitted.
B. HTTPS traffic is dropped.
C. HTTP traffic is permitted.
D. HTTP traffic is dropped.
正解：A,D

質問 6：
Click the Exhibit button.
user@host> show security ike security-associations Index State Initiator cookie Responder cookie ModeRemote Address 3271043 UP7f42284089404673 95fd8408940438d8 Main 172.31.50.2
user@host> show security ipsec security-associations Total active tunnels: 0
user@host> show log phase2
Feb 2 14:21:18 host kmd[1088]: IKE negotiation failed with error: TS unacceptable. IKE Version: 1, VPN: vpn-1 Gateway: gate-1, Local: 172.31.50.1/500, Remote: 172.31.50.2/500, Local IKE-ID: 172.31.50.1, Remote IKE-ID: 172.31.50.2, VR-ID: 0
Feb 2 14:21:18 host kmd[1088]: KMD_VPN_TS_MISMATCH: Traffic-selector mismatch, vpn name: vpn-1, Peer Proposed traffic-selector local-ip: ipv4(2.2.2.2), Peer Proposed traffic-selector remote-ip: ipv4 (1.1.1.1)
Feb 2 14:21:54 host kmd[1088]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1, VPN: vpn-1 Gateway: gate-1, Local:
172.31.50.1/500, Remote: 172.31.50.2/500, Local IKE-ID: 172.31.50.1, Remote IKE-ID: 172.31.50.2, VR-ID: 0
Feb 2 14:22:19 host kmd[1088]: KMD_VPN_TS_MISMATCH: Traffic-selector mismatch, vpn name: vpn-1, Peer Proposed traffic-selector local-ip:
ipv4 (2.2.
2.2), Peer Proposed traffic-selector remote-ip: ipv4(1.1.1.1)
You have recently configured an IPsec VPN between an SRX Series device and another non-Junos security device. The phase one tunnel is up but the phase two tunnel is not present.
Referring to the exhibit, what is the cause of this problem?
A. preshared key mismatch
B. proposal mismatch
C. mode mismatch
D. proxy-ID mismatch
正解：D

質問 7：
You are asked to implement an IPsec VPN between your main office and a new remote office. The remote office receives its IKE gateway address from their ISP dynamically.
Regarding this scenario, which statement is correct?
A. Configure the dynamic-host-address option as the IKE identity.
B. Configure a dynamic host configuration name (DHCN) as the IKE identity.
C. Configure the unnumbered option as the IKE identity.
D. Configure a fully qualified domain name (FQDN) as the IKE identity.
正解：D