[2023] JN0-231 All-in-One Exam Guide Practice To your JN0-231 Exam!
Preparations of JN0-231 Exam 2023 JNCIA-SEC Unlimited 103 Questions
NEW QUESTION 30
Click the Exhibit button
You have configured source ... Being received By the SRX series Which features must be configured
- A. Port Forwarding
- B. Reverse static NAT
- C. Destination NAT
- D. Proxy ARP
Answer: D
NEW QUESTION 31
Which two segments describes IPsec VPNs? (Choose two.)
- A. IPsec VPNs use security to secure traffic over a public network between two remote sites.
- B. IPsec VPNs are dedicated physical connections between two private networks.
- C. IPsec VPN traffic is always encrypted.
- D. IPsec VPN traffic is always authenticated.
Answer: A,D
NEW QUESTION 32
You are assigned a project to configure SRX Series devices to allow connections to your webservers. The webservers have a private IP address, and the packets must use NAT to be accessible from the Internet. The webservers must use the same address for both connections from the Internet and communication with update servers.
Which NAT type must be used to complete this project?
- A. source NAT
- B. static NAT
- C. destination NAT
- D. hairpin NAT
Answer: B
Explanation:
Only static NAT with pool ensures both traffic initiated from inside and outside networks use the same IP address.
NEW QUESTION 33
Which two components are part of a security zone? (Choose two.)
- A. ge-0/0/0.0
- B. address book
- C. inet.0
- D. fxp0
Answer: A,D
NEW QUESTION 34
Referring to the exhibit.
You have configured antispam to allow e-mail from example.com, however the logs you see that [email protected] is blocked What are two ways to solve this problem?
- A. Delete [email protected] from the profile antispam address blacklist
- B. Add [email protected] to the profile antispam address whitelist.
- C. Verify connectivity with the SBL server.
- D. Delete [email protected] from the profile antispam address whitelist
Answer: A,B
NEW QUESTION 35
Which statement about NAT is correct?
- A. Source NAT is processed before security policy lookup.
- B. Static NAT takes precedence over destination NAT.
- C. Destination NAT takes precedence over static NAT.
- D. Static NAT is processed after forwarding lookup.
Answer: B
NEW QUESTION 36
Which statements about NAT are correct? (Choose two.)
- A. Source NAT translates the source port and destination IP address.
- B. When multiple NAT rules have overlapping match conditions, the rule listed first is chosen.
- C. Source NAT translates the source IP address of packet.
- D. When multiple NAT rules have overlapping match conditions, the most specific rule is chosen.
Answer: B,C
NEW QUESTION 37
Which statement about IPsec is correct?
- A. IPsec can provide encryption but not data integrity.
- B. IPsec must use certificates to provide data encryption
- C. IPsec support both tunnel and transport modes.
- D. IPsec support packet fragmentation by intermediary devices.
Answer: C
NEW QUESTION 38
What must you do first to use the Monitor/Alarms/Policy Log workspace in J-Web?
- A. You must enable security logging that uses the TLS transport mode.
- B. You must enable event mode security logging on the SRX Series device.
- C. You must enable logging that uses the SD-Syslog format.
- D. You must enable stream mode security logging on the SRX Series device.
Answer: B
NEW QUESTION 39
You are asked to verify that a license for AppSecure is installed on an SRX Series device.
In this scenario, which command will provide you with the required information?
- A. user@srx> show system license
- B. user@srx> show configuration system
- C. user@srx> show chassis firmware
- D. user@srx> show services accounting
Answer: A
NEW QUESTION 40
Which statement about global NAT address persistence is correct?
- A. The same IP address from a source NAT pool is not guaranteed to be assigned for all sessions from a given host.
- B. The same IP address from a destination NAT pool is not guaranteed to be assigned for all sessions for a given host.
- C. The same IP address from a source NAT pool will be assigned for all sessions from a given host.
- D. The same IP address from a destination NAT pool will be assigned for all sessions for a given host.
Answer: C
Explanation:
Use the persistent-nat feature to ensure that all requests from the same internal transport address are mapped to the same reflexive transport address (the public IP address and port created by the NAT device closest to the STUN server). The source NAT rule action can use a source NAT pool (with or without port translation) or an egress interface.
NEW QUESTION 41
What does IPsec use to negotiate encryption algorithms?
- A. AH
- B. IKE
- C. TLS
- D. ESP
Answer: D
NEW QUESTION 42
You have configured a UTM feature profile.
Which two additional configuration steps are required for your UTM feature profile to take effect? (Choose two.)
- A. Associate the UTM policy with a firewall filter.
- B. Associate the UTM policy with an address book.
- C. Associate the UTM policy with a security policy.
- D. Associate the UTM feature profile with a UTM policy.
Answer: C,D
Explanation:
For the UTM feature profile to take effect, it must be associated with a security policy and a UTM policy. The security policy defines the traffic flow and the actions that should be taken on the traffic, while the UTM policy defines the security features to be applied to the traffic, such as antivirus, intrusion prevention, and web filtering. The UTM feature profile provides the necessary configuration for the security features defined in the UTM policy.
Reference:
Juniper Networks SRX Series Services Gateway UTM Configuration Guide: https://www.juniper.net/documentation/en_US/release-independent/junos/topics/topic-map/security-services-utm.html
NEW QUESTION 43
Which statements is correct about global security policies?
- A. Global security require you to identify a source and destination zone.
- B. Global policies allow you to regulate traffic with addresses and applications, regardless of their security zones.
- C. Global policies eliminate the need to assign interface to security zones.
- D. Traffic matching global is not added to the session table.
Answer: B
NEW QUESTION 44
Which two traffic types are considered exception traffic and require some form of special handling by the PFE? (Choose two.)
- A. SSH sessions
- B. ICMP reply messages
- C. traceroute packets
- D. HTTP sessions
Answer: B,C
NEW QUESTION 45
Which statements describes stateless firewalls on SRX series devices?
- A. Each packet is analyzed by firewall filters
- B. Each packet is analyzed based on source zone
- C. Each packet is analyzed based on application layer security
- D. Each packet is analyzed as part of a session.
Answer: A
NEW QUESTION 46
You want to deploy a NAT solution.
In this scenario, which solution would provide a static translation without PAT?
- A. pool-based NAT with address shifting
- B. pool-based NAT without PAT
- C. pool-based NAT with PAT
- D. interface-based source NAT
Answer: A
Explanation:
Translation of the original source IP address to an IP address from a user-defined address pool by shifting the IP addresses. This type of translation is one-to-one, static, and without port address translation. If the original source IP address range is larger than the IP address range in the user-defined pool, untranslated packets are dropped. https://www.juniper.net/documentation/us/en/software/junos/nat/topics/topic-map/nat-security-source-and-source-pool.html
NEW QUESTION 47
Which two statements are correct about IPsec security associations? (Choose two.)
- A. IPsec security associations are established during IKE Phase 2 negotiations.
- B. IPsec security associations are unidirectional.
- C. IPsec security associations are bidirectional.
- D. IPsec security associations are established during IKE Phase 1 negotiations.
Answer: A,C
Explanation:
The two statements that are correct about IPsec security associations are that they are bidirectional and that they are established during IKE Phase 2 negotiations. IPsec security associations are bidirectional, meaning that they provide security for both incoming and outgoing traffic. IPsec security associations are established during IKE Phase 2 negotiations, which negotiates the security parameters and establishes the security association between the two peers. For more information, please refer to the Juniper Networks IPsec VPN Configuration Guide, which can be found on Juniper's website.
NEW QUESTION 48
Which two statements are true regarding zone-based security policies? (Choose two.)
- A. Zone-based policies must reference a URL category in the match criteria.
- B. Zone-based policies must reference a destination address in the match criteria
- C. Zone-based policies must reference a dynamic application in the match criteria.
- D. Zone-based policies must reference a source address in the match criteria.
Answer: B,D
NEW QUESTION 49
You want to deploy a NAT solution.
In this scenario, which solution would provide a static translation without PAT?
- A. pool-based NAT without PAT
- B. pool-based NAT with PAT
- C. interface-based source NAT
- D. pool-based NAT with address shifting
Answer: A
NEW QUESTION 50
Click the Exhibit button.
Referring to the exhibit, a user is placed in which hierarchy when the exit command is run?
- A. [edit security policies from-zone trust to-zone dmz]
user@vSRX-1# - B. user@vSRX-1>
- C. [edit security policies]
user@vSRX-1# - D. [edit]
user@vSRX-1#
Answer: C
NEW QUESTION 51
What are three Junos UTM features? (Choose three.)
- A. screens
- B. antivirus
- C. content filtering
- D. Web filtering
- E. IDP/IPS
Answer: B,C,D
NEW QUESTION 52
Which two match conditions would be used in both static NAT and destination NAT rule sets? (Choose two.)
- A. Source zone
- B. Destination interface
- C. Destination zone
- D. Source interface
Answer: A,B
NEW QUESTION 53
......
Focus on JN0-231 All-in-One Exam Guide For Quick Preparation: https://prep4sure.vcedumps.com/JN0-231-examcollection.html
