Question 1

Click the Exhibit button.  You are asked to look at a configuration that is designed to take all traffic with a specific source IP address and forward the traffic to a traffic analysis server for further evaluation. The configuration is not working as intended. Referring to the exhibit, which change must be made to correct the configuration?

Accepted Answer

A)   Apply the filter as an input filter on interface xe-0/2/1.0
B)   Create a routing instance named default
C)   Apply the filter as an input filter on interface xe-0/0/1.0
D)   Apply the filter as an output filter on interface xe-0/1/0.0 C

Question 2

Click the Exhibit button.  You have two hosts on the same subnet connecting to an SRX340 on interfaces ge-0/0/4 and ge-0/0/5. However, the two hosts cannot communicate with each other. Referring to the exhibit, what are two actions that would solve this problem? (Choose two.)

Accepted Answer

A)   Set the SRX340 to Ethernet switching mode and reboot
B)   Add an IRB interface to the VLAN
C)   Put the ge-0/0/4 and ge-0/0/5 interfaces in different VLANs
D)   Remove the ge-0/0/4 and ge-0/0/5 interfaces from the L2 security zone A,D

Question 3

Which two VPN features are supported with CoS-based IPsec VPNs? (Choose two.)

Accepted Answer

A)   IKEv2
B)   VPN monitoring
C)   dead peer detection
D)   IKEv1 A,C

Question 4

Click the Exhibit button.  A host is unable to communicate with a webserver. Referring to the exhibit, which statement is correct?

Accepted Answer

A)   The webserver is not listening for traffic on port 80
B)   A policy is denying the traffic between these two hosts
C)   A session is created for this flow
D)   The session table is running out of resources

Question 5

Click the Exhibit button.  Given the command output shown in the exhibit, which two statements are true? (Choose two.)

Accepted Answer

A)   The host 172.31.15.1 is directly connected to interface ge-0/0/3.0
B)   Traffic matching this session has been received since the session was established
C)   The host 10.10.101.10 is directly connected to interface ge-0/0/4.0
D)   Network Address Translation is applied to this session

Question 6

You are asked to configure a new SRX Series CPE device at a remote office. The device must participate in forwarding MPLS and IPsec traffic. Which two statements are true regarding this implementation? (Choose two.)

Accepted Answer

A)   Host inbound traffic must not be processed by the flow module
B)   Host inbound traffic must be processed by the flow module
C)   The SRX Series device can process both MPLS and IPsec with default traffic handling
D)   A firewall filter must be configured to enable packet mode forwarding

Question 7

Which interface family is required for Layer 2 transparent mode on SRX Series devices?

Accepted Answer

A)   LLDP
B)   Ethernet switching
C)   inet
D)   VPLS

Question 8

Click the Exhibit button.  Which type of NAT is shown in the exhibit?

Accepted Answer

A)   NAT46
B)   NAT64
C)   persistent NAT
D)   DS-Lite

Question 9

You configured a security policy permitting traffic from the trust zone to the DMZ zone, inserted the new policy at the top of the list, and successfully committed it to the SRX Series device. Upon monitoring, you notice that the hit count does not increase on the newly configured policy. In this scenario, which two commands would help you to identify the problem? (Choose two.)

Accepted Answer

A)   user@srx> show security zones trust detail
B)   user@srx> show security shadow-policies from zone trust to zone DMZ
C)   user@srx> show security match-policies from-zone trust to-zone DMZ source-ip 192.168.10.100/32 destination-ip 10.10.10.80/32 protocol tcp source-port 5806 destination-port 443
D)   destination-ip 10.10.10.80/32 protocol tcp source-port 5806 destination-port 443 result-count 10

Question 10

Click the Exhibit button.  You deployed a site-to-site IPsec VPN connecting two data centers together using SRX5800s. After examining the performance of the IPsec VPN, you decide to enable IPsec performance acceleration to increase the rate of traffic that can be sent through the tunnel. Referring to the exhibit, which two statements should you add to the configuration to accomplish this task? (Choose two.)

Accepted Answer

A)   [edit security flow] user@srx# set tcp-mss ipsec-vpn mss 65535
B)   user@srx# set ipsec-performance-acceleration
C)   user@srx# set power-mode-ipsec
D)   user@srx# set load-distribution session-affinity ipsec

Question 11

You are asked to merge to corporate network with the network from a recently acquired company. Both networks use the same private IPv4 address space (172.25.126.0/24). An SRX Series device servers as the gateway for each network. Which solution allows you to merge the two networks without modifying the current address assignments?

Accepted Answer

A)   persistent NAT
B)   NAT46
C)   source NAT
D)   double NAT

Question 12

You are asked to secure your network against TOR network traffic. Which two Juniper products would accomplish this task? (Choose two.)

Accepted Answer

A)   Contrail Edge
B)   Contrail Insights
C)   Juniper Sky ATP
D)   Juniper ATP Appliance

Question 13

You are asked to implement the session cache feature on an SRX5400. In this scenario, what information does a session cache entry record? (Choose two.)

Accepted Answer

A)   The type of processing to do for ingress traffic
B)   The type of processing to do for egress traffic
C)   To which SPU the traffic of the session should be forwarded
D)   To which NPU the traffic of the session should be forwarded

Question 14

Click the Exhibit button.  Branch 1 and Branch 2 have an active VPN tunnel configured, but internal hosts cannot communicate with each other. Referring to the exhibit, which type of configuration should be applied to solve the problem?

Accepted Answer

A)   Configure destination NAT on both Branch 1 and Branch 2
B)   Configure source NAT on Branch 1
C)   Configure destination NAT on Branch 2 only
D)   Configure static NAT on both Branch 1 and Branch 2

Question 15

Click the Exhibit button.  Referring to the exhibit, which statement is true?

Accepted Answer

A)   Source NAT with PAT is occurring
B)   Destination NAT is occurring
C)   Static NAT without PAT is occurring
D)   Source NAT without PAT is occurring

Question 16

You have a remote access VPN where the remote users are using the NCP client. The remote users can access the internal corporate resources as intended; however, traffic that is destined to all other Internet sites is going through the remote access VPN. You want to ensure that only traffic that is destined to the internal corporate resources use the remote access VPN. Which two actions should you take to accomplish this task? (Choose two.)

Accepted Answer

A)   Enable the split tunneling feature within the VPN configuration on the SRX Series device
B)   Enable IKEv2 within the VPN configuration on the SRX Series device
C)   Configure the necessary traffic selectors within the VPN configuration on the SRX Series device
D)   Configure split tunneling on the NCP profile on the remote client

Question 17

Which two VPN features are supported with CoS-based IPsec VPNs? (Choose two.)

Accepted Answer

A)   IKEv2
B)   VPN monitoring
C)   dead peer detection
D)   IKEv1

Question 18

Click the Exhibit button.  The IKE policy and proposal are configured properly on both devices as shown in the exhibit. Which configuration snippet will complete the IKE configuration on the branch SRX Series device?

Accepted Answer

A)   
B)   
C)   
D)

Question 19

Which feature of Sky ATP is deployed with Policy Enforcer?

Accepted Answer

A)   zero-day threat mitigation
B)   software image snapshot support
C)   device inventory management
D)   service redundancy daemon configuration support

Question 20

Click the Exhibit button.  You have two hosts on the same subnet connecting to an SRX340 on interfaces ge-0/0/4 and ge-0/0/5. However, the two hosts cannot communicate with each other. Referring to the exhibit, what are two actions that would solve this problem? (Choose two.)

Accepted Answer

A)   Set the SRX340 to Ethernet switching mode and reboot
B)   Add an IRB interface to the VLAN
C)   Put the ge-0/0/4 and ge-0/0/5 interfaces in different VLANs
D)   Remove the ge-0/0/4 and ge-0/0/5 interfaces from the L2 security zone

Exam 10: Service Provider Routing and Switching, Specialist

Click the Exhibit button. You have two hosts on the same subnet connecting to an SRX340 on interfaces ge-0/0/4 and ge-0/0/5. However, the two hosts cannot communicate with each other. Referring to the exhibit, what are two actions that would solve this problem? (Choose two.)

Which two VPN features are supported with CoS-based IPsec VPNs? (Choose two.)

Click the Exhibit button. A host is unable to communicate with a webserver. Referring to the exhibit, which statement is correct?

Click the Exhibit button. Given the command output shown in the exhibit, which two statements are true? (Choose two.)

You are asked to configure a new SRX Series CPE device at a remote office. The device must participate in forwarding MPLS and IPsec traffic. Which two statements are true regarding this implementation? (Choose two.)

Which interface family is required for Layer 2 transparent mode on SRX Series devices?

Click the Exhibit button. Which type of NAT is shown in the exhibit?

You are asked to secure your network against TOR network traffic. Which two Juniper products would accomplish this task? (Choose two.)

You are asked to implement the session cache feature on an SRX5400. In this scenario, what information does a session cache entry record? (Choose two.)

Click the Exhibit button. Branch 1 and Branch 2 have an active VPN tunnel configured, but internal hosts cannot communicate with each other. Referring to the exhibit, which type of configuration should be applied to solve the problem?

Click the Exhibit button. Referring to the exhibit, which statement is true?

Which two VPN features are supported with CoS-based IPsec VPNs? (Choose two.)

Click the Exhibit button. The IKE policy and proposal are configured properly on both devices as shown in the exhibit. Which configuration snippet will complete the IKE configuration on the branch SRX Series device?

Which feature of Sky ATP is deployed with Policy Enforcer?

Click the Exhibit button. You have two hosts on the same subnet connecting to an SRX340 on interfaces ge-0/0/4 and ge-0/0/5. However, the two hosts cannot communicate with each other. Referring to the exhibit, what are two actions that would solve this problem? (Choose two.)