Question 1

You want to block executable files ("exe) from being downloaded onto your network. Which UTM feature would you use in this scenario?

Accepted Answer

C

Explanation: Content filtering is the Unified Threat Management (UTM) feature designed to enforce policies based on the content of network traffic. It inspects data and can block or permit traffic based on specific criteria such as file extension (e.g., .exe), MIME type, or protocol commands. This allows an administrator to create a policy that specifically prevents executable files from being downloaded, regardless of their source or whether they contain known malware.

Question 2

Which three Web filtering deployment actions are supported by Junos? (Choose three.)

Accepted Answer

B, D, E

Explanation: Junos OS supports three primary methods for deploying Web filtering on SRX Series devices. These are: 1. Local Web Filtering: This method uses user-defined lists (blocklists and allowlists) configured directly on the device to control access to specific websites. 2. Websense Redirect: This is an integrated third-party solution where the Junos device redirects HTTP requests to a dedicated external Websense server, which then performs the filtering and enforces policy. 3. Juniper Enhanced Web Filtering: This is a subscription-based, cloud-hosted solution. The Junos device queries a large, dynamically updated Juniper database in the cloud to categorize and filter web traffic. These three options represent the distinct deployment actions available for this feature.

Question 3

Which two statements are correct about IKE security associations? (Choose two.)

Accepted Answer

A, D

Explanation: The Internet Key Exchange (IKE) protocol establishes a security association (SA) in two distinct phases. The IKE SA, also known as the Phase 1 SA, is created during the first phase of negotiations. Its purpose is to provide a secure, authenticated channel for the subsequent Phase 2 negotiations. A key characteristic of this IKE SA is that it is bidirectional, meaning a single SA handles control traffic in both directions between the two IPsec peers. This is in contrast to IPsec SAs (Phase 2), which are unidirectional.

Question 4

Click the Exhibit button. www.dumpsplanet.com Exam Dumps 14/76 Referring to the exhibit, which two statements are correct about the ping command? (Choose two.)

Accepted Answer

A, C

Explanation: The Junos OS ping command syntax is ping [options] host. In the exhibited command, ping routing-instance DMZ 10.10.102.10, the routing-instance DMZ option specifies the routing instance from which the ICMP echo request originates. This means the source interface and routing table used for the ping are those associated with the DMZ routing instance. The host argument, 10.10.102.10, is the target device to which the ICMP echo requests are sent, making it the destination address.

Question 5

www.dumpsplanet.com Exam Dumps 32/76 Which statement is correct about global security policies on SRX Series devices?

Accepted Answer

D

Explanation: Global security policies on SRX Series devices are configured to match traffic between any source zone and any destination zone (from-zone any to-zone any). While the policy's match criteria are zone-agnostic, the Junos OS processing engine is aware of the packet's actual ingress and egress zones. When a packet matches a global policy, a session is created, and the specific zone information is stored in the session table and included in system log messages. Therefore, the application and effect of a global policy inherently include and preserve the zone context of the traffic flow.

Question 6

You are monitoring an SRX Series device that has the factory-default configuration applied. In this scenario, where are log messages sent by default?

Accepted Answer

D

Explanation: In a factory-default configuration, a Juniper SRX Series device running Junos OS is pre-configured to log system messages locally. The [system syslog] stanza in the default configuration directs messages of certain facilities and severities to a file on the device's local storage. The primary file for general system messages, kernel messages, and process notifications is named messages. This ensures that essential diagnostic information is captured on the device itself without requiring any initial user configuration for external logging systems.

Question 7

What information does the show chassis routing-engine command provide?

Accepted Answer

B

Explanation: The show chassis routing-engine command is used to display the current operational status and resource utilization of the Routing Engine (RE). The output includes critical performance metrics such as CPU utilization percentages (separated into user, background, kernel, interrupt, and idle states), memory utilization, and load averages. This information is essential for monitoring the health and performance of the device's control plane.

Question 8

www.dumpsplanet.com Exam Dumps 31/76 Which two statements are correct about screens? (Choose two.)

Accepted Answer

A, D

Explanation: Juniper SRX Series screens are a stateless security feature designed to mitigate various network attacks. They are configured on a security zone and inspect all traffic entering that zone (inbound traffic). To handle high traffic volumes without impacting the device's control plane, screen processing is offloaded to the data plane. Specifically, this processing occurs within the flow module, which is part of the Packet Forwarding Engine (PFE) or Services Processing Unit (SPU), before a formal session is established.

Question 9

Which two services does Juniper Connected Security provide? (Choose two.)

Accepted Answer

A, D

Explanation: Juniper Connected Security is a framework designed to provide threat-aware networking by integrating security services across all points of connection. A core component of this framework is the Juniper Advanced Threat Prevention (ATP) Cloud, which specifically provides protection against unknown, or "zero-day," threats using machine learning and sandboxing. This service integrates with SRX Series firewalls to enable real-time, inline blocking of malware once it is identified. These two capabilities—detecting previously unseen threats and actively blocking them in the data path—are central services of the Juniper Connected Security architecture.

Question 10

Which IPsec protocol is used to encrypt the data payload?

Accepted Answer

A

Explanation: The Encapsulating Security Payload (ESP) protocol is a core component of the IPsec suite designed to provide confidentiality for data. It achieves this by encrypting the IP packet's payload. In addition to encryption, ESP can also optionally provide data origin authentication, connectionless integrity, and anti-replay services. The primary function that distinguishes ESP from other IPsec protocols like Authentication Header (AH) is its ability to encrypt the data, thus ensuring it remains confidential during transit across the network.

Question 11

When are Unified Threat Management services performed in a packet flow?

Accepted Answer

D

Explanation: On Juniper SRX Series devices, the packet processing order is a well-defined sequence. Unified Threat Management (UTM) services, such as antivirus, web filtering, and content filtering, are applied during the services processing stage of the packet flow. This stage occurs after a security policy has permitted the session and after Network Address Translation (NAT) has been performed on the packet. Applying UTM after NAT ensures that the security services inspect the traffic with its final, post-translation IP addresses, which is crucial for accurate policy enforcement and logging.

Question 12

What are two Juniper ATP Cloud feed analysis components? (Choose two.)

Accepted Answer

B, C

Explanation: Juniper Advanced Threat Prevention (ATP) Cloud performs deep analysis on files and traffic to uncover malicious activity. Based on this analysis, it generates and distributes several proprietary threat intelligence feeds to be used by enforcement points like SRX Series firewalls. The official Juniper documentation explicitly identifies the "Command and Control (C&C) server feed" and the "Infected host feed" as primary outputs. The C&C feed lists known malicious command and control servers, while the infected host feed lists internal devices that are believed to be compromised, enabling automated blocking and quarantine actions.

Question 13

Which two statements are true about Juniper ATP Cloud? (Choose two.)

Accepted Answer

B, C

Explanation: Juniper Advanced Threat Prevention (ATP) Cloud is a licensed, cloud-hosted service that integrates with Juniper SRX Series firewalls to provide protection against advanced malware and zero-day threats. It functions as a subscription-based service (C). A key feature of Juniper ATP Cloud is its ability to generate threat intelligence feeds, including Command and Control (C&C) server lists. Administrators can also configure custom allow and block lists for specific IP addresses and URLs within the ATP Cloud portal. This intelligence is then used by the SRX firewall for enforcement, meaning ATP Cloud is directly used to facilitate the blocking and allowing of IPs (B).

Question 14

You are assigned a project to configure SRX Series devices to allow connections to your webservers.
The webservers have a private IP address, and the packets must use NAT to be accessible from the
Internet. You do not want the webservers to initiate connections with external update servers on the
Internet using the same IP address as customers use to access them.
Which two NAT types must be used to complete this project? (Choose two.)

Accepted Answer

C, D

Explanation: This scenario requires two distinct Network Address Translation (NAT) functions. First, to allow external users on the Internet to access the internal webservers, the SRX device must translate the public destination IP address of incoming packets to the private IP address of the webserver. This function is Destination NAT. Second, for the webservers to initiate their own connections to the Internet (e.g., for updates), their private source IP address must be translated into a public IP address. This function is Source NAT. The requirement that this public IP be different from the one used for inbound access is a configuration detail within source and destination NAT rules, but the fundamental types required are source and destination NAT.

Question 15

www.dumpsplanet.com Exam Dumps 5/76 SRX Series devices have a maximum of how many rollback configurations?

Accepted Answer

C

Explanation: Junos OS, the operating system for SRX Series devices, automatically saves the currently active configuration and the 49 most recent previously committed configurations. The active configuration is referenced as rollback index 0, and the previous versions are indexed from 1 to 49. This provides a total of 50 configuration files (0 through 49) that a user can revert to using the rollback command. The system stores these files in the /config directory as juniper.conf, juniper.conf.1.gz, through juniper.conf.49.gz.

Free Juniper JN0-231 Actual Exam Questions