JN0-633 Exam
The Updated Guide To JN0-633 pack Mar 2021
Benefits of Juniper JN0-633: The particular JN0-633 vouchers associated with Juniper give you the possiblity to work with any kind of the world which is recognized both equally overall areas. It not simply boosts your talent and data nonetheless aids you to build your occupation. Juniper JN0-633 record provides the possiblity to help make skilled and better by using all goods in various problems.
2021 Mar JN0-633 free practice exam
Q31. Click the Exhibit button.
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:<1.1.1.100/51303->1.1.1.30/3389;6>
matched filter MatchTraffic:
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:packet [48] ipid = 5015, @423d7e9e Feb 2
09:00:02 09:00:00.1872004:CID-0:RT:---- flow_process_pkt: (thd 1): flow_ctxt type 13, common flag Ox0, mbuf Ox423d7d00
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: flow process pak fast ifl 72 In_ifp fe-0/0/7.0
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: fe-0/0/7.0:1.1.1.100/51303- >1.1.1.30/3389,
top, flag 2 syn
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: find flow: table Ox5258d7b0, hash 17008(Oxffff), sa 1.1.1.100, da 1.1.1.30, sp 51303, dp 3389, proto 6, tok
448
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: no session found, start first path. in_tunnel - 0, from_cp_flag - 0
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: flow_first_create_session
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: flow first_in_dst_nat: in <fe-0/0/7.0>, out
<N/A> dst_adr 1.1.1.30, sp 51303, dp 3389
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: chose interface fe-0/0/7.0 as incoming nat if. Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_rule_dst_xlate: packet 1.1.1.100-
>1.1.1.30 nsp2 0.0.0.0->192.168.224.30.
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_routing: call flow_route_lookup() src_ip 1.1.1.100, x_dst_ip 192.168.224.30, in ifp fe-0/0/7.0, out ifp N/A sp 51303, dp 3389, ip_proto 6, tos 0
Feb 2 09:00:02 09:00:00.1872004:CID-O:RT:Doing DESTINATION addr route-lookup Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: routed (x_dst_ip 192 168.224.30)
from untrust (fe-0/0/7.0 in 0) to ge-0/0/0.0, Next-hop: 192.168.224.30
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: policy search from zone untrust-> zone trust Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: policy has timeout 900
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: app 0, timeout 1800s, curr ageout 20s
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_src_xlate: src nat 0.0.0.0(51303) to
192.168.224.30(3389) returns status 1, rule/pool id 1/2. Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: dip id = 2/0, 1.1.1.100/51303->192.168.224.3/48810
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: choose interface ge-0/0/0.0 as outgoing phy if Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:is_loop_pak: No loop: on ifp: ge-0/0/0.0, addr:
192.168.224.30, rtt_idx:0
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:sm_flow_interest_check: app_id 0, policy 9, app_svc_en 0, flags Ox2. not interested
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:sm_flow_interest_check: app_id 1, policy 9, app_svc_en 0, flags Ox2. not interested
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT:flow_first_service_lookup():
natp(Ox51ee4680): app_id, 0(0).
Feb 2 09:00:02 09:00:00.1872004:CID-0:RT: service lookup identified service O. Referring to the exhibit, which two statements are correct? (Choose two.)
A. The packet being inspected is a UDP packet.
B. The incoming interface is fe-0/0/7.
C. This traffic matches an existing flow.
D. Source NAT is being used.
Answer: B,C
Q32. Click the Exhibit button.
-- Exhibit–
-- Exhibit --
You are asked to implement NAT to translate addresses between the IPv4 and IPv6 networks shown in the exhibit.
What are three configuration requirements? (Choose three.)
A. Disable SYN checking.
B. Enable IPv6 flow mode.
C. Configure proxy ARP.
D. Configure stateless filtering.
E. Configure proxy NDP.
Answer: B,C,E
Explanation: Reference:http://forums.juniper.net/jnet/attachments/jnet/srx/16228/1/NAT64-Overview.pdf
Q33. Click the Exhibit button.
-- Exhibit–
-- Exhibit --
You have configured an IDP policy as shown in the exhibit. The configuration commits successfully. Which traffic will be examined for attacks?
A. only originating traffic from source to destination in a session
B. only reply traffic from destination to source in a session
C. both originating and reply traffic between hosts in a session
D. recommended traffic between the source and destination hosts
Answer: C
Explanation: Reference:http://www.juniper.net/techpubs/software/junos-security/junos-security96/junos-security-swconfig-security/config-idp-ips-rulebase-section.html#config-idp-ips-rulebase- section
Q34. You are asked to allow access to an external application for an internal host subject to address translation. The application requires multiple sessions initiated from the internal host and expects all the sessions to originate from the same source IP address.
Which Junos feature meets this objective?
A. destination NAT with address persistence
B. source NAT with address persistence
C. static NAT with port translation
D. interface-based persistent NAT
Answer: B
Q35. Click the Exhibit button.
-- Exhibit --
user@srx> show security flow session
Session ID.7724, Policy namE.default-permit/4, Timeout: 2 In: 1.1.70.6/17 --> 100.0.0.1/2326;icmp, IF.ge-0/0/3
Out: 10.1.10.5/2326 --> 1.1.70.6/17;icmp, IF.ge-0/0/2
Session ID.18408, Policy namE.default-permit/4, Timeout: 2 In: 10.1.10.5/64513 --> 1.1.70.6/512;icmp, IF.ge-0/0/2.0 Out: 1.1.70.6/512 --> 100.0.0.1/64513;icmp, IF.ge-0/0/3.10
-- Exhibit --
A user has reported a traffic drop issue between a host with the 10.1.10.5 internal IP address and a host with the 1.1.70.6 IP address. The traffic transits an SRX240 acting as a NAT translator. You are investigating the issue on the SRX240 using the output shown in the exhibit.
Regarding this scenario, which two statements are true? (Choose two.)
A. The sessions shown indicate interface-based NAT processing.
B. The sessions shown indicate static NAT processing.
C. ICMP traffic is passing in both directions.
D. ICMP traffic is passing in one direction.
Answer: B,C
Refresh JN0-633 download:
Q36. Click the Exhibit button.
-- Exhibit–
-- Exhibit --
Based on the output shown in the exhibit, what are two results? (Choose two.)
A. The output shows source NAT.
B. The output shows destination NAT.
C. The port information is changed.
D. The port information is unchanged.
Answer: B,D
Explanation: Reference:http://junos.com/techpubs/software/junos-security/junos-security10.2/junos-security-cli-reference/index.html?show-security-flow-session.html
Q37. Your company's network has seen an increase in Facebook-related traffic. You have been asked to restrict the amount of Facebook-related traffic to less than 100 Mbps regardless of congestion.
What are three components used to accomplish this task? (Choose three.)
A. IDP policy
B. application traffic control
C. application firewall
A. D. security policy
E. application signature
Answer: B,D,E
Explanation:
An IDP policy defines how your device handles the networktraffic.It will not limit the rate. Reference:http://www.juniper.net/techpubs/software/junos-security/junos-security96/junos-security-swconfig-security/idp-policy-overview-section.html)
Application Firewallenforces protocol and policy control at Layer 7. It inspects the actual content of the payload and ensures that it conforms to the policy, rather thanlimiting the rate.
Reference:http://www.juniper.net/techpubs/en_US/junos12.1x44/topics/concept/application-firewall-overview.html
Q38. Your company has added a connection to a new ISP and you have been asked to send specific traffic to the new ISP. You have decided to implement filter-based forwarding. You have configured new routing instances with type forwarding. You must direct traffic into each instance.Which step would accomplish this goal?
A. Add a firewall filter to the ingress interface that specifies the intended routing instance as the action.
B. Create a routing policy to direct the traffic to the required forwarding instances.
C. Configure the ingress and egress interfaces in each forwarding instance.
D. Create a static default route for each ISP in inet.0, each pointing to a different forwarding instance.
Answer: A
Explanation:
Reference :http://kb.juniper.net/InfoCenter/index?page=content&id=KB17223
Q39. What are two AppSecure modules? (Choose two.)
A. AppDoS
B. AppFlow
C. AppTrack
D. AppNAT
Answer: A,C
Explanation:
Reference :Page No 2 Figure 1 http://www.juniper.net/us/en/local/pdf/datasheets/1000327-en.pdf
Q40. Click the Exhibit button.
userehost# run show route
inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
0.0.0.0/0 *[Static/5] 00:05:06
> to 172.16.1.1 via ge-0/0/1.0 172.16.1.0/24 *[Direct/O] 00:05:06
> via ge-0/0/1.0
172.16.1.3/32 *[Local/0] 00:05:07
Local via ge-0/0/1.0 192.168.200.2/32 *[Local/0] 00:05:07
Reject
vr-a.inet.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both
192.168.1.1 /24 *[Direct/0] 00:01:05
> via ge-0/0/2.0
192.168.1.2 /32 *[Local/0] 00:01:05
Local via ge-0/0/2.0
vr-b.inet.0: 2 destinations, 2 routes (2 active, 0 holddcwn, 0 hidden) + = Active Route, - = Last Active, * = Both
192.168.1.1 /24 *[Direct/O] 00:01:05
> via go-0/0/3.0
192.168.1.2 /32 *[Local/0] 00:01:05
Local via ge-0/0/3.0
User 1 will access Server 1 using IP address 10.2.1.1. You need to ensure that return traffic is able to reach User 1 from Server 1.
Referring to the exhibit, which two configurations allow this communication (Choose two.)
A. [edit security nat static] user@host# show
rule-set server-nat { from zone [ untrust ]; rule 1 {
match {
destination-address 10.2.1.1/32;
}
then { static-nat { prefix {
192.168.1.2/32;
}
}
}
}
}
B. [edit security nat static] user@host# show
rule-set server-nat {
from zone [ junos-host untrust ]; rule 1 {
match {
destination-address 10.2.1.1/32;
}
then { static-nat { prefix {
192.168.1.2/32;
routing-instance vr-b;
}
}
}
}
}
C. [edit security nat static] user@host# show
rule-set server-nat { from zone untrust; rule 1 {
match {
destination-address 10.2.1.1/32;
}
then { static-nat { prefix {
192.168.1.2/32;
routing-instance vr-a;
}
}
}
}
}
D. [edit security nat static] user@host# show
rule-set in {
from zone untrust; to zone cust-a; rule overload { match {
source-address 0.0.0.0/0;
}
then { source-nat { interface;
}
}
}
}
Answer: B