[2026] Juniper Security, Professional (JNCIP-SEC)

문제1

You are asked to ensure that your IPS engine blocks attacks. You must ensure that your system continues to drop additional malicious traffic without additional IPS processing for up to 30 minutes. You must ensure that the SRX Series device does send a notification packet when the traffic is dropped.
Which statement is correct?

A. Use the Drop Packet action.

B. Use the IP-Close action.

C. Use the IP-Block action.

D. Use the Drop Connection action.

정답: B

문제2

Click the Exhibit button.
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:<1.1.1.100/51303->1.1.1.30/3389;6>
matched filter MatchTraffic:
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:packet [48] ipid = 5015, @423d7e9e Feb 2
09:00:02 09:00:00.1872004:CID-0:RT:---- flow_process_pkt: (thd 1): flow_ctxt type 13, common flag Ox0, mbuf Ox423d7d00 Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: flow process pak fast ifl 72
In_ifp fe-0/0/7.0 Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: fe-0/0/7.0:1.1.1.100/51303- >1.1.1.30/3389, top, flag 2 syn
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: find flow: table Ox5258d7b0, hash 17008(Oxffff), sa 1.1.1.100, da 1.1.1.30, sp 51303, dp 3389, proto 6, tok
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: no session found, start first
path. in_tunnel - 0, from_cp_flag - 0
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: flow_first_create_session
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: flow first_in_dst_nat: in <fe-0/0/7.0>, out
<N/A> dst_adr 1.1.1.30, sp 51303, dp 3389
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: chose interface fe-0/0/7.0 as incoming nat if.
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_rule_dst_xlate: packet 1.1.1.100-
>1.1.1.30 nsp2 0.0.0.0->192.168.224.30.
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_routing: call flow_route_lookup()
src_ip 1.1.1.100, x_dst_ip 192.168.224.30, in ifp fe-0/0/7.0, out ifp N/A sp 51303, dp 3389, ip_proto 6, tos 0 Feb 2 09:00:02 09:00:00.1872004:CID-O:RT:Doing DESTINATION addr route-lookup Feb
2 09:00:02 09:00:00.1872004:CID-0:RT: routed (x_dst_ip 192 168.224.30) from untrust (fe-0/0/7.0 in 0) to ge-0/0/0.0, Next-hop: 192.168.224.30 Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: policy search from zone untrust-> zone trust Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: policy has timeout 900 Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: app 0, timeout 1800s, curr ageout 20s
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_src_xlate: src nat 0.0.0.0(51303) to 192.168.224.30(3389) returns status 1, rule/pool id 1/2. Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: dip id = 2/0, 1.1.1.100/51303->192.168.224.3/48810
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: choose interface ge-0/0/0.0 as outgoing phy if
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:is_loop_pak: No loop: on ifp: ge-0/0/0.0, addr: 192.168.224.30, rtt_idx:0
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:sm_flow_interest_check: app_id 0, policy 9, app_svc_en 0, flags Ox2. not interested
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:sm_flow_interest_check: app_id 1, policy 9, app_svc_en 0, flags Ox2. not interested
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_service_lookup(): natp(Ox51ee4680): app_id, 0(0).
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: service lookup identified service O.
Referring to the exhibit, which two statements are correct? (Choose two.)

A. The incoming interface is fe-0/0/7.

B. This traffic matches an existing flow.

C. The packet being inspected is a UDP packet.

D. Source NAT is being used.

정답: A,B

문제3

You are asked to implement an IPsec VPN between your main office and a new remote office. The remote office receives its IKE gateway address from their ISP dynamically.
Regarding this scenario, which statement is correct?

A. Configure the dynamic-host-address option as the IKE identity.

B. Configure a dynamic host configuration name (DHCN) as the IKE identity.

C. Configure a fully qualified domain name (FQDN) as the IKE identity.

D. Configure the unnumbered option as the IKE identity.

정답: C

문제4

Which action will allow an administrator to connect in band to an SRX Series device in transparent mode over SSH?

A. Use the loopback interface.

B. Use an irb interface.

C. Use a logical interface.

D. Use a VLAN interface.

정답: B

문제5

Which statement is true about Layer 2 zones when implementing transparent mode security?

A. All interfaces in the zone must be configured with the protocol family inet6.

B. All interfaces in the zone must be configured with the protocol family mpls.

C. All interfaces in the zone must be configured with the protocol family bridge.

D. All interfaces in the zone must be configured with the protocol family inet.

정답: C

설명: (Fast2test 회원만 볼 수 있음)

문제6

Click the Exhibit button. -- Exhibit-

-- Exhibit -Referring to the exhibit, AppTrack is only logging the session closure messages for sessions that last 1 to 3 minutes.
What is causing this behavior?

A. AppTrack only generates session update messages.

B. AppTrack only generates session closure messages.

C. AppTrack is not properly configured under the [edit security application-tracking] hierarchy.

D. AppTrack generates other messages only when the update interval is surpassed.

정답: D

설명: (Fast2test 회원만 볼 수 있음)

문제7

You are asked to merge the corporate network with the network from a recently acquired company. Both networks use the same private IPv4 address space (172.25.126.0/24). An SRX device serves as the gateway for each network.Which solution allows you to merge the two networks without adjusting the current address assignments?

A. double NAT

B. NAT444

C. persistent NAT

D. source NAT

정답: A

설명: (Fast2test 회원만 볼 수 있음)

문제8

Click the Exhibit button. -- Exhibit-

-- Exhibit -
Referring to the exhibit, which feature allows the hosts in the Trust and DMZ zones to route to either ISP, based on source address?

A. filter-based forwarding

B. static NAT

C. source NAT

D. source-based routing

정답: A

설명: (Fast2test 회원만 볼 수 있음)

문제9

Which statement is true regarding destination NAT?

A. Destination NAT changes the content of the destination IP address field.

B. Destination NAT matches on the destination IP address and changes the source port.

C. Destination NAT changes the content of the source IP address field.

D. Destination NAT matches on the destination IP address and changes the source IP address.

정답: A

문제10

Click the Exhibit button.
-- Exhibit-

-- Exhibit -
You have configured an IDP policy as shown in the exhibit. The configuration commits successfully. Which traffic will be examined for attacks?

A. only originating traffic from source to destination in a session

B. recommended traffic between the source and destination hosts

C. both originating and reply traffic between hosts in a session

D. only reply traffic from destination to source in a session

정답: C

설명: (Fast2test 회원만 볼 수 있음)

문제11

Which two statements are true about persistent NAT? (Choose two.)

A. Thepermit target-host-portstatement allows an external host to initiate a session to an internal host on any port, provided the internal host previously sent a packet to the external host.

B. Port overloading must be disabled for Interface-based persistent NAT.

C. Port overloading must be enabled for Interface-based persistent NAT.

D. Thepermit target-hoststatement allows an external host to initiate a session to an internal host on any port, provided the internal host previously sent a packet to the external host.

정답: B,D

문제12

Click the Exhibit button.
user @host> show bgp summary logical-system LSYS1 Groups : 11 Peers : 10 Down peers: 1 Table Tot. Paths Act Paths Suppressed History Damp State Pending inet.0 141 129 0 0 0 Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn
State|#Active/Received/Accepted/Damped...
192.168.64.12 65008 11153 11459 0 26 3d
3:10:43 9/10/10/0 0/0/0/0
192.168.72.12 65009 11171 11457 0 26 3d
3:10:39 11/12/12/0 0/0/0/0
192.168.80.12 65010 9480 9729 0 27 3d
3:10:42 11/12/12/0 0/0/0/0
192.168.88.12 65011 11171 11457 0 25 3d
3:10:31 12/13/13/0 0/0/0/0
192.168.96.12 65012 9479 9729 0 26 3d
3:10:34 12/13/13/0 0/0/0/0
192.168.10.12 65013 111689 11460 0 27 3d
3:10:46 9/10/10/0 0/0/0/0
192.168.11.12 65014 111688 11458 0 25 3d
3:10:42 9/10/10/0 0/0/0/0
192.168.12.12 65015 111687 11457 0 25 3d
3:10:38 9/10/10/0 0/0/0/0
192.68.11.12 650168 9478 9729 0 25 3d
3:10:42 9/10/10/0 0/0/0/0
192.168.13.12 65017 111687 11457 0 27 3d
3:10:30 9/10/10/0 0/0/0/0
192.168.16.12 65017 111687 11457 0 27 1w3d2h Connect
user@host> show interfaces ge-0/0/7.0 extensive Logical interface ge-0/0/7.0 (Index 76) (SNMP ifIndex 548) (Generation 141) ... Security: Zone: log Allowed host-inbound traffic : bootp dns dhcp finger ftp tftp ident-reset http https ike netconf
ping reverse-telnet reverse-ssh rloqin rpm rsh snmp snmp-trap ssh telnet traceroute xnm-clear-text xnm-ssl lsping ntp sip r2cp Flow Statistics: Flow Input statistics: Self packets: 0 ICMP packets: 0 VPN packets: 0 Multicast packets: 0 Bytes permitted by policy: 0 Connections established: 0 Flow Output statistics: Multicast packets: 0 Bytes permitted by policy: 0 Flow error statistics (Packets dropped due to): Address spoofing: 0 Authentication failed: 0 Incoming NAT errors: 0 Invalid zone received packet: 0 Multiple user authentications: 0 Multiple incoming NAT: 0 No parent for a gate: 0 No one interested in self pakets: 0 No minor session: 0 No more sessions: 589723 No NAT gate: 0 No route present: 0 No SA for incoming SPI: 0 No tunnel found: 0 No session for a gate: 0 No zone or NULL zone binding 0 Policy denied: 0 Security association not active: 0 TCP sequence number out of window: 0 Syn-attack protection: 0 User authentication errors: 0 Protocol inet, MTU: 1500, Generation: 1685, Route table: 0 Flags: Sendbcast-pkt-to-re Addresses, F1ags: Is-Preferred Is-Primary Destination: 10.5.123/24, Local: 10.5.123.3, Broadcast: 10.5.123.255, Generation: 156 Protocol multiservice, MTU: Unlimited, Generation: 1686, Route table: 0 Policer: Input: __default_arp_policer__ ...
An SRX Series device has been configured with a logical system LSYS1. One of the BGP peers is down.
Referring to the exhibit, which statement explains this problem?

A. The allocated memory is not sufficient for this LSYS.

B. The LSYS license only allows up to ten BGP peerings.

C. The minimum number of flows is set to high.

D. The maximum number of allowed flows is set to low.

정답: D

문제13

Your manager asks you to show which attacks have been detected on your SRX Series device using the IPS feature.
Which command would you use to accomplish this task?

A. show security idp attack detail

B. show security idp memory

C. show security idp counters

D. show security idp attack table

정답: D

Juniper Security, Professional (JNCIP-SEC) - JN0-633무료 덤프문제 풀어보기

우리와 연락하기

유용한 링크

최신 업데이트