http://https://www.examslabs.com/Juniper/JNCIP/best-JN0-634-exam-dumps.html (65 Q&As Dumps, 30%OFF Special Discount: bmzblwH7 )

NEW QUESTION NO: 6
After downloading the new IPS attack database, the installation of the new database fails.
What caused this condition?
A. The new attack database was revoked between the time it was downloaded and installed.
B. The new attack database no longer contained an attack entry that was in use.
C. The new attack database was too large for the device on which it was being installed.
D. Some of the new attack entries were already in use and had to be deactivated before installation.
Answer: B

NEW QUESTION NO: 7
Your network includes SRX Series devices at the headquarters location. The SRX Series devices at this
location are part of a high available chassis cluster and are configured for IPS. There has been a node
failover.
In this scenario, which two statements are true? (Choose two.)
A. Cached SSL session ID information for existing sessions is not synchronized between nodes.
B. The IP action table is synchronized between the chassis cluster nodes.
C. The IP action table is not synchronized between the chassis cluster nodes.
D. Cached SSL session ID information for existing session is synchronized between nodes.
Answer: C,D

NEW QUESTION NO: 8
Which two statements about enabling MACsec using static CAK security mode keys are true? (Choose
two.)
A. SAK secures the data plane traffic.
B. CAK secures the data plane traffic.
C. SAK secures the control plane traffic.
D. CAK secures the control plane traffic.
Answer: A,D

NEW QUESTION NO: 9
Click the Exhibit button.

You have configured integrated user firewall on the SRX Series devices in your network. However, you
noticed that no users can access the servers that are behind the SRX Series devices.
Referring to the exhibit, what is the problem?
A. The Kerberos service is not configured correctly on the Active Directory server.
B. There are no authentication entries in the SRX Series device for the users.
C. The security policy on the SRX Series device is configured incorrectly.
D. The SAML service is not configured correctly on the Active Directory server.
Answer: C
Explanation/Reference:

NEW QUESTION NO: 10
You are scanning files that are being transferred from the Internet to hosts on your internal network with
Sky ATP. However, you notice that files that are 1 GB in size are not being scanned by Sky ATP.
In this scenario, which two statements are true? (Choose two.)
A. The Sky ATP failback option is set to permit.
B. The 1 GB file size is larger than the scan size limit for Sky ATP.
C. The Sky ATP engine or the SRX Series device is too busy.
D. The Sky ATP policy on the SRX Series device is misconfigured.
Answer: B,D

NEW QUESTION NO: 11
Your network includes SRX Series devices at the headquarters location. The SRX Series devices at this
location are part of a high availability chassis cluster and are configured for IPS. There has been a node
failover.
In this scenario, which statement is true?
A. Existing sessions are dropped and must be reestablished so IPS processing can occur.
B. Existing session continue to be processed by IPS as long as GRES is configured.
C. Existing sessions continue to be processed by IPS because of table synchronization.
D. Existing sessions are no longer processed by IPS and become firewall sessions.
Answer: C

NEW QUESTION NO: 12
Click the Exhibit button.

A customer submits a service ticket complaining that access to http://www.example.com/ has been
blocked.
Referring to the log message shown in the exhibit, why was access blocked?
A. The URI matched a profile entry.
B. The user/role permissions were exceeded.
C. All illegal source port was utilized.
D. There was a website category infraction.
Answer: A

NEW QUESTION NO: 13
Click the Exhibit button.

Referring to the security policy shown in the exhibit, which two actions will happen as the packet is
processed? (Choose two.)
A. It passes unmatched traffic after modifying the DSCP priority.
B. It marks and passes matched traffic with a high DSCP priority.
C. It passes unmatched traffic without modifying DSCP priority.
D. It marks and passes matched traffic with a low DSCP priority.
Answer: B,C

NEW QUESTION NO: 14
Click the Exhibit button.

Two hosts on the same subnet are connected to an SRX340 using interfaces ge-0/0/4 and ge-0/0/5. The
two hosts can communicate with each other, but they cannot communicate with hosts outside of their
subnet.
Referring to the exhibit, which three actions would you take to solve this problem? (Choose three.)
A. Remove the irb.0 interface from the L2 zone.
B. Reboot the SRX340.
C. Set the SRX340 to Ethernet switching mode.
D. Add the ge-0/0/4 and ge-0/0/5 interfaces to the L2 zone.
E. Configure a security policy to permit the traffic.
Answer: B,C,E

NEW QUESTION NO: 15
You have configured a log collector VM and Security Director. System logging is enabled on a branch SRX
Series device, but security logs do not appear in the monitor charts.
How would you solve this problem?
A. Configure J-Flow on the SRX Series device.
B. Configure a security policy to forward logs to the collector.
C. Configure security logging on the SRX Series device.
D. Configure application identification on the SRX Series device.
Answer: C

NEW QUESTION NO: 16
After using Security Director to add a new firewall policy rule on an SRX Series device, you notice that the
hit count on the policy is not increasing. Upon further investigation, you find that the devices listed in the
new rule are able to communicate as expected. Your firewall policy consists of hundreds of rules.
Using only Security Director, how do you find the rule that is allowing the communication to occur in this
scenario?
A. Generate a Policy Analysisreport.
B. Generate a Top Firewall Rulesreport.
C. Generate a Top Source IPsreport.
D. Generate a Top Firewall Eventsreport.
Answer: D