Question 1

Exhibit https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Juniper_JN0-335_Dumps/page_22_img_1.jpg Which two statements are correct about the configuration shown in the exhibit? (Choose two.)

Accepted Answer

Explanation: The configuration shown in the exhibit is for a Juniper SRX Series firewall. The session-init parameter is used to control how the firewall processes unknown traffic flows. With the session-init parameter set to 300, any traffic flows that the firewall does not recognize will be dropped after 300 milliseconds. Additionally, every session that enters the device, whether it is known or unknown, will generate an event, which can be used for logging and troubleshooting purposes. The session-lose parameter is used to control how the firewall handles established sessions that are terminated.

Question 2

You are asked to reduce the load that the JIMS server places on your Which action should you take in this situation?

Accepted Answer

A

Explanation: The question implies a need to reduce the operational load that the Juniper Identity Management Service (JIMS) places on its primary data source, the Domain Controllers (DCs). JIMS's default method of polling DC event logs for user-to-IP address mappings can be resource-intensive. To mitigate this, JIMS can be configured to use alternative data sources. Connecting JIMS to a RADIUS server allows it to collect user-to-IP mappings directly from RADIUS accounting reports. This is a highly efficient and direct method for obtaining identity information at the point of network access (e.g., 802.1X or VPN), thereby reducing or eliminating the need to poll the DCs and lowering their processing load.

Question 3

When a security policy is modified, which statement is correct about the default behavior for active sessions allowed by that policy?

Accepted Answer

D

Explanation: By default, when a security policy on a Juniper SRX Series device is modified and committed, the changes only apply to new sessions. Existing, active sessions that were permitted by the original policy are not affected and will continue to pass traffic until they time out or are closed normally. This default behavior ensures stateful session continuity and prevents service disruption for established connections. The device does not re-evaluate active sessions against the modified policy rules; those rules are only consulted for session initiation requests that occur after the policy change.

Question 4

Which two statements are correct about AppTrack? (Choose two.)

Accepted Answer

A, C

Explanation: AppTrack is the application tracking feature within Junos OS for SRX Series devices. Its primary purpose is to identify applications and collect detailed statistics about their traffic flows. This includes data such as byte and packet counts, and the duration of the session, which directly supports option C. Furthermore, AppTrack functionality is not restricted to the primary routing instance; it can be configured and utilized within user-defined logical systems on an SRX Series device, making option A correct. This allows for granular application visibility and reporting on a per-logical-system basis.

Question 5

You want to be alerted if the wrong password is used more than three times on a single device within five minutes. Which Juniper Networks solution will accomplish this task?

Accepted Answer

B

Explanation: The scenario describes a classic Security Information and Event Management (SIEM) use case: correlating specific events (failed password attempts) from a device over a defined time window (five minutes) and triggering an alert when a threshold (three times) is met. Juniper Secure Analytics (JSA) is Juniper's SIEM and network security management platform. It is specifically designed to collect, process, and correlate event and flow data from disparate sources to detect and alert on threats, such as the brute-force or password-guessing activity described in the question.

Question 6

Which two devices would you use for DDoS protection with Policy Enforcer? (Choose two.)

Accepted Answer

B, D

Explanation: Policy Enforcer, a component of Juniper's Security Director, automates threat mitigation by integrating with Juniper networking devices. For a comprehensive DDoS protection strategy, Policy Enforcer utilizes: 1. MX Series Routers: These act as the primary enforcement point at the network edge. They are designed to handle high traffic volumes and can apply advanced filtering, such as flowspec rules, pushed by Policy Enforcer to block DDoS attack traffic before it enters the network. 2. QFX Series Switches: These are used as enforcement points within the data center or campus. They provide a second layer of defense by blocking malicious traffic closer to the protected servers or endpoints, preventing lateral movement and mitigating attacks that bypass edge defenses.

Question 7

Which two statements are correct about the cSRX? (Choose two.)

Accepted Answer

A, C

Explanation: The cSRX Container Firewall is a virtualized security appliance designed for containerized environments. It provides core security services, including a stateful firewall, Network Address Translation (NAT), and an Intrusion Prevention System (IPS), as stated in option A. While the inclusion of "UTM services" is an overstatement (as most UTM features like anti-virus and web filtering are unsupported), the option correctly identifies the primary security functions. Additionally, the cSRX integrates advanced routing capabilities, supporting dynamic routing protocols such as BGP, OSPF, and IS-IS, making option C correct. These features allow it to be deployed in complex network topologies within a container ecosystem.

Question 8

Which statement regarding Juniper Identity Management Service (JIMS) domain PC probes is true?

Accepted Answer

B

Explanation: Juniper Identity Management Service (JIMS) primarily gathers user-to-IP address mappings by reading security event logs from domain controllers. The domain PC probe is a supplementary mechanism. It is triggered only when JIMS receives a query for an IP address for which it has no user mapping from the event logs. In this scenario, JIMS actively probes the PC at that IP address to determine the logged-in user, thereby resolving the identity.

Question 9

Exhibit https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Juniper_JN0-335_Dumps/page_13_img_1.jpg Referring to the exhibit, what do you determine about the status of the cluster.

Accepted Answer

C

Explanation: The exhibit shows the output of the CLI command show chassis cluster status. • Redundancy-group 0 and 1 list Node 1 as PRIMARY and Node 2 as “lost heartbeat/unknown.” • In Juniper chassis-cluster terminology, a node that does not exchange control-plane keepalives is marked lost-heartbeat (or unknown) and is treated as down; the surviving node automatically assumes the PRIMARY role for every redundancy group. Therefore, the cluster is operating in a degraded, single-node state because Node 2 is down.

Question 10

Which two statements are true about application identification? (Choose two.)

Accepted Answer

A, D

Explanation: Juniper's Application Identification (AppID) service uses advanced deep packet inspection (DPI) techniques to analyze Layer 7 traffic. This capability allows it to identify specific applications that are tunneled or "nested" within other protocols, such as identifying a specific social media function within general web traffic. While both AppID and Intrusion Detection and Prevention (IDP) rely on signatures, their signature packages are separate and serve distinct functions. The AppID signature package is designed specifically to identify and classify applications for policy enforcement. In contrast, the IDP signature database contains patterns to detect attacks and malicious activity within network traffic.

Question 11

Exhibit https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Juniper_JN0-335_Dumps/page_35_img_1.jpg You are trying to create a security policy on your SRX Series device that permits HTTP traffic from your private 172 25.11.0/24 subnet to the Internet You create a policy named permit-http between the trust and untrust zones that permits HTTP traffic. When you issue a commit command to apply the configuration changes, the commit fails with the error shown in the exhibit. Which two actions would correct the error? (Choose two.)

Accepted Answer

C, D

Explanation: The commit error application or application-set not defined: http explicitly states that the Junos OS configuration checker cannot find a defined application or application-set named http. To resolve this, the administrator must provide a valid application definition that the security policy can reference. There are two ways to achieve this: 1. Correct the policy to use the existing, predefined Junos application for HTTP traffic, which is named junos-http. 2. Create a new, custom application specifically named http under the [edit applications] hierarchy, defining its protocol (TCP) and destination port (80). Both actions resolve the reference error and allow the commit to succeed.

Question 12

You are deploying a new SRX Series device and you need to log denied traffic. In this scenario, which two policy parameters are required to accomplish this task? (Choose two.)

Accepted Answer

A, C

Explanation: To log traffic that is denied by a security policy on an SRX Series device, two specific parameters are required within the policy configuration. First, the policy's action must be set to deny to instruct the device to block the matching traffic. Second, the log session-init parameter must be configured. For policies with a deny action, Junos OS generates a log entry when the initial packet is processed and dropped. A full session is never established, so only the session-init log is created.

Question 13

You need to deploy an SRX Series device in your virtual environment. In this scenario, what are two benefits of using a CSRX? (Choose two.)

Accepted Answer

C, D

Explanation: The cSRX Container Firewall is designed to bring a full suite of security services to containerized and virtualized environments. A primary benefit is its support for advanced security features, including stateful firewall, Network Address Translation (NAT), Intrusion Prevention System (IPS), and AppSecure services, all within a container. Another key advantage is its lightweight design. As a container, the cSRX has a significantly smaller footprint and lower memory and CPU requirements compared to a full virtual machine-based firewall like the vSRX. This resource efficiency makes it ideal for high-density, scalable, and agile deployments in cloud-native architectures.

Question 14

What are two types of system logs that Junos generates? (Choose two.)

Accepted Answer

B, D

Explanation: Junos OS architecture is fundamentally divided into a control plane and a data plane. Consequently, logging is also separated between these two planes. Control Plane Logs: Generated by the Routing Engine (RE), these logs capture events related to system management, user interface, chassis operations, and routing protocol daemons. These are typically processed by the syslogd process and are often referred to as event logs. Data Plane Logs: Generated by the Packet Forwarding Engine (PFE) or Services Processing Unit (SPU), these logs capture traffic-related information. On SRX Series devices, this is known as security logging (or stream mode logging), recording details of traffic sessions as they are processed against security policies.

Question 15

Which two statements about unified security policies are correct? (Choose two.)

Accepted Answer

C, D

Explanation: Unified security policies on Juniper SRX devices integrate traditional 5-tuple matching with dynamic application identification (AppID). When a new session starts, the application is not yet known. The device performs an initial lookup and may identify multiple policies that could potentially match the traffic based on source/destination addresses and ports. This makes option C correct. Once AppID inspects the traffic and identifies the specific application, the SRX performs a final, more specific policy lookup using the AppID result. This determines the definitive policy that will be applied to the session for its duration, making option D correct.

Free Juniper JN0-335 Actual Exam Questions