Juniper JN0-696 問題集

質問 1：
Two SRX Series devices are having problems establishing an IPsec VPN session. One of the devices has a firewall filter applied to its gateway interface that rejects UDP traffic.
What would resolve the problem?
A. Disable the IKE Phase 2 part of the session establishment.
B. Edit the firewall filter to allow UDP port 500.
C. Disable the IKE Phase 1 part of the session establishment.
D. Change the configuration so that session establishment uses TCP.
正解：C

質問 2：
You are asked to troubleshoot a user communication problem. Users connected to the Trust zone cannot communicate with other devices connected to the same zone. These users are able to communicate with other devices in all other zones.
How should you resolve this problem?
A. You must enable the all parameter for host inbound traffic for the zone.
B. You must put each device in a separate subzone to allow internal communication.
C. You must configure a security policy to allow intrazone communication.
D. You must enable the allow-internal parameter under the Trust security zone.
正解：C

質問 3：
-- Exhibit --
user@host> show configuration security utm
custom-objects {
url-pattern {
block-juniper {
value *.spammer.com;
}
}
custom-url-category {
blacklist {
value block-juniper;
}
}
}
feature-profile {
anti-spam {
address-blacklist block-juniper;
sbl {
profile myprofile {
no-sbl-default-server;
spam-action block;
}
}
}
}
utm-policy wildcard-policy {
anti-spam { smtp-profile myprofile; }
} -- Exhibit -
Click the Exhibit button.
You added a blacklist to your antispam policy to block any e-mails from the spammer.com domain. However, your users are complaining that they are still receiving spam e-mails from that domain. You run the utm test-string test and confirm that the blacklist is not working.
Referring to the exhibit, what is causing this problem?
A. The protocol-command smtp value sender: needs to be added under custom-objects.
B. The wildcard character * cannot be used for the e-mail pattern match.
C. The pattern needs to be preceded by an @ symbol.
D. url-pattern is not supported for antispam.
正解：B

質問 4：
-- Exhibit --
user@host> show configuration
...
security {
nat {
destination {
pool server {
address 10.100.100.1/32 port 5555;
}
rule-set rule1 {
from zone UNTRUST;
rule 1 {
match {
destination-address 192.168.100.1/32;
destination-port 5000;
}
then {
destination-nat pool server;
}
}
}
}
proxy-arp {
interface ge-0/0/1.0 {
address {
192.168.100.1/32;
}
}
}
}
policies {
from-zone UNTRUST to-zone TRUST {
policy allow {
match {
source-address any;
destination-address any;
application [ junos-ping tcp-5000 ];
}
then {
permit;
}
}
}
}
zones {
security-zone TRUST {
interfaces {
ge-0/0/2.0 {
host-inbound-traffic {
protocols {
all;
}
}
}
}
}
security-zone UNTRUST {
interfaces {
ge-0/0/1.0 {
host-inbound-traffic {
system-services {
ping;
}
}
}
}
}
}
}
applications { application tcp-5000 { protocol tcp; destination-port 5000; }
}
-- Exhibit -
Click the Exhibit button.
Your customer is attempting to reach a new server that should be accessible publicly using
192.168.100.100 on TCP port 5000, and internally using 10.100.100.1 on TCP port 5555. You notice no sessions form when the customer attempts to access the server.
Referring to the exhibit, what will resolve this problem?
A. The NAT rule set rule1 must match on port 5555.
B. There must be a TRUST-to-UNTRUST security policy to allow return traffic.
C. The NAT pool server must use port 5000.
D. The UNTRUST-to-TRUST security policy must allow port 5555.
正解：D