Juniper JN0-633 問題集

質問 1：
Which configuration statement would allow the SRX Series device to match a signature only on the first match, and not subsequent signature matches in a connection?
A. user@host# set security idp idp-policy test rulebase-ips rule 1 then action no-action
B. user@host# set security idp idp-policy test rulebase-ips rule 1 then action recommended
C. user@host# set security idp idp-policy test rulebase-ips rule 1 then action drop-
connection
D. user@host# set security idp idp-policy test rulebase-ips rule 1 then action ignore-connection
正解：D

質問 2：
Click the Exhibit button.
-- Exhibit --
[edit security]
user@srx# show
idp {
idp-policy NewPolicy {
rulebase-exempt {
rule 1 {
description AllowExternalRule;
match {
source-address any;
destination-address
}
}
}
}
}
-- Exhibit -
You are performing the initial IDP installation on your new SRX device. You have configured the IDP exempt rulebase as shown in the exhibit, but the commit is not successful.
Referring to the exhibit, what solves the issue?
A. You must configure the IPS rulebase.
B. You must configure the IPS engine flow action to ignore.
C. You must configure the destination zone match.
D. You must configure the IPS exempt accept action.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Click the Exhibit button.

-- Exhibit --
CID-0:RT: flow process pak fast ifl 71 in_ifp ge-0/0/5.0
CID-0:RT: ge-0/0/5.0:10.0.0.2/55892->192.168.1.2/80, tcp, flag 2 syn
CID-0:RT: find flow: table 0x5a386c90, hash 50728(0xffff), sa 10.0.0.2, da 192.168.1.2, sp
55892, dp 80, proto 6, tok 7
CID-0:RT: no session found, start first path. in_tunnel - 0x0, from_cp_flag - 0
CID-0:RT: flow_first_create_session
CID-0:RT: flow_first_in_dst_nat: in <ge-0/0/5.0>, out <N/A> dst_adr 192.168.1.2, sp 55892,
dp 80
CID-0:RT: chose interface ge-0/0/5.0 as incoming nat if.
CID-0:RT:flow_first_rule_dst_xlatE.DST no-xlatE.0.0.0.0(0) to 192.168.1.2(80)
CID-0:RT:flow_first_routinG.vr_id 0, call flow_route_lookup(): src_ip 10.0.0.2, x_dst_ip
192.168.1.2, in ifp ge-0/0/5.0, out ifp N/A sp 55892, dp 80, ip_proto 6, tos 10
CID-0:RT:Doing DESTINATION addr route-lookup
CID-0:RT: routed (x_dst_ip 192.168.1.2) from LAN (ge-0/0/5.0 in 0) to ge-0/0/1.0, Next-
hop: 172.16.32.1 CID-0:RT:flow_first_policy_searcH.policy search from zone LAN-> zone WAN (0x0,0xda540050,0x50)
CID-0:RT:Policy lkup: vsys 0 zone(7:LAN) -> zone(6:WAN) scope:0
CID-0:RT: 10.0.0.2/55892 -> 192.168.1.2/80 proto 6
CID-0:RT:Policy lkup: vsys 0 zone(5:Unknown) -> zone(5:Unknown) scope:0
CID-0:RT: 10.0.0.2/55892 -> 192.168.1.2/80 proto 6
CID-0:RT: app 6, timeout 1800s, curr ageout 20s
CID-0:RT: packet dropped, denied by policy
CID-0:RT: denied by policy default-policy-00(2), dropping pkt
CID-0:RT: packet dropped, policy deny.
CID-0:RT: flow find session returns error.
CID-0:RT: ----- flow_process_pkt rc 0x7 (fp rc -1)
CID-0:RT:jsf sess close notify
CID-0:RT:flow_ipv4_del_flow: sess , in hash 32
-- Exhibit --
A host is not able to communicate with a Web server.
Based on the logs shown in the exhibit, what is the problem?
A. A NAT policy is translating the address to a private address.
B. The session table is running out of resources.
C. A session has not been created for this flow.
D. A policy is denying the traffic between these two hosts.
正解：D

質問 4：
Click the Exhibit button. [edit]
user@host# show interfaces
ge-0/0/1 {
unit 0 {
family bridge {
interface-mode access;
vlan-id 20;
}
}
}
ge-0/0/10 {
unit 0 {
family bridge {
interface-mode access;
vlan-id 20;
}
}
}
[edit]
user@host# show bridge-domains
d1 {
domain-type bridge;
vlan-id 20;
}
[edit]
user@host# show security flow bridge
[edit]
user@host# show security zones
security-zone 12 {
host-inbound-traffic {
system-services {
any-service;
}
}
interfaces {
ge-0/0/1.0;
ge-0/0/10.0;
}
}
Referring to the exhibit, which statement is true?
A. Packets sent tom the SRX Series device are sent to the RE.
B. Only frames that do not have any VLAN tags are accepted.
C. Only frames that have a VLAN ID of 20 are accepted.
D. Packets sent to the SRX Series device are discarded.
正解：C

質問 5：
What are three techniques to mark DSCP values on an SRX Series device? (Choose three.)
A. 802.11Q
B. ALG-based DSCP rewriters
C. VLAN rewrite
D. Layer 7 application-based DSCP rewriters.
E. IDP attack action-based DSCP rewriters
正解：B,D,E

質問 6：
Which two statements about AppQoS are true? (Choose two.)
A. AppQoS remarking supersedes interface remarking.
B. AppQoS supports forwarding class assignment.
C. AppQoS supports bandwidth reservation.
D. AppQoS supports rate limiting.
正解：B,D

質問 7：
Click the Exhibit button.
-- Exhibit -user@srx240< show route summary Router ID. inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden) Direct: 1 routes, 1 active Local: 1 routes, 1 active StatiC.1 routes, 1 active customer-A.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden) Direct: 1 routes, 1 active Local: 1 routes, 1 active StatiC.1 routes, 1 active customer-B.inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden) Direct: 1 routes, 1 active Local: 1 routes, 1 active OSPF.1 routes, 1 active StatiC.1 routes, 1 active customer-B.inet6.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden) Direct: 2 routes, 2 active Local: 2 routes, 2 active StatiC.1 routes, 1 active -- Exhibit -
In the output, how many user-configured routing instances have active routes?
A. 2
B. 3
C. 4
D. 1
正解：A
解説: (Topexam メンバーにのみ表示されます)