Free Juniper JN0-335 Practice Exam with Questions & Answers | Set: 3

The SRX Series device will drop packets from the infected hosts with a threat level of 8 and no log message will be generated. This is because the security intelligence profile “ATP_Infected-Hosts” has a rule “Rule-1” that matches packets with a threat level of 8 and the action is to block and drop them. There is no log option specified in the action, so no log message will be generated. Options A and B are not correct because the rule only matches packets with a threat level of 8, not 8 or above. Option C is not correct because the action is to drop, not permit, the packets. References: The answer can be verified from Juniper’s official documentation on security intelligence available on their website. Here are some relevant links:

• Security Intelligence Feature Guide for Security Devices
• security-intelligence | Junos OS
• Configure the Security Intelligence Policy on the SRX Series Device

An Application Layer Gateway (ALG) is a software component that is designed to manage specific protocols such as Session Initiation Protocol (SIP) or FTP on Juniper Networks devices running Junos OS. The ALG module is responsible for Application-Layer aware packet processing on switches1. The ALG can perform various functions such as modifying the payload and header of packets, opening secondary connections, translating addresses and ports, and applying security policies1. The ALG does not use software processes for permitting or disallowing specific IP address ranges, as this is the function of firewall filters or security zones2. The ALG does not use software that is used by a single TCP session using the same port numbers as the application, as this is the definition of a stateful firewall3. The ALG does not contain protocols that use one application session for each TCP session, as this is the characteristic of some application protocols such as HTTP or SMTP4. References:

• 1: ALG Overview | Junos OS | Juniper Networks
• 2: Firewall Filters Overview | Junos OS | Juniper Networks
• 3: Stateful Firewall Overview | Junos OS | Juniper Networks
• 4: Application Layer Protocols | Junos OS | Juniper Networks

 AppQoE is an AppSecure component that provides application quality of experience by monitoring the network performance and dynamically adjusting the traffic routing based on predefined policies1. AppQoE can detect excessive packet loss on a WAN link and route the traffic to another link that has better performance2. AppQoE can also prioritize the traffic based on the application type and user group3. AppQoE is suitable for accomplishing the task of routing traffic from the degraded link to the working link.

The other options are not correct for the following reasons:

• AppFW is an AppSecure component that provides application firewalling by enforcing granular policies to allow, deny, or limit access to applications based on user roles, locations, and devices4. AppFW does not monitor or adjust the traffic routing based on network performance.
• AppQoS is an AppSecure component that provides application quality of service by allocating bandwidth and shaping traffic based on application priority and user group. AppQoS does not monitor or adjust the traffic routing based on network performance.
• APBR is an AppSecure component that provides application-based routing by selecting the best path for each application based on predefined criteria such as latency, jitter, packet loss, and cost. APBR does not monitor the network performance dynamically or adjust the traffic routing automatically.

References: AppSecure Overview Understanding AppQoE Configuring AppQoE Understanding AppFW [Understanding AppQoS] [Understanding APBR]

vSRX is a virtual firewall that runs on various hypervisors, such as VMware ESXi, Microsoft Hyper-V, and KVM. vSRX provides security and networking services at the perimeter or edge of virtualized environments. vSRX supports different versions of VMware ESXi, Hyper-V, and KVM, depending on the Junos OS release and the vSRXflavor. Citrix Hypervisor and Oracle VM are not supported hypervisors for vSRX. References:

• vSRX Overview
• Understand vSRX with Microsoft Hyper-V
• Requirements for vSRX Virtual Firewall on VMware
• vSRX Deployment Guide for Microsoft Hyper-V
• vSRX Chassis Cluster/High Availability support for vSRX

References:

• [SRX] Behavior of active sessions when modifying a security policy1

The fab interface is the data link between the nodes of a chassis cluster and is used to forward traffic between the chassis and to synchronize the data plane software’s dynamic runtime state. Real-time objects (RTOs) are exchanged on the fab interface to maintain session synchronization for operations such as authentication, NAT, ALGs, and IPsec. In an active/active configuration, inter-chassis transit traffic is sent over the fab interface, as traffic arriving on a node that needs to be processed on the other or traffic processed on a node that needs to exit through an interface on the other is forwarded over the fabric. The fab interface does not enable configuration synchronization, as this is done by the control link. Heartbeat signals sent on the fab interface monitor the health of the data plane link, not the control plane link. References: Chassis Cluster Fabric Interfaces, HA Chassis cluster, difference between Swfab and Fab

• A: In the vSwitch security settings, accept promiscuous mode. This is a true statement. Promiscuous mode allows the vSwitch to forward all frames to the vSRX control interface, regardless of the destination MAC address1. This is necessary for the control link to function properly and exchange heartbeat messages between the cluster nodes2.
• C: In the vSwitch security settings, reject forged transmits. This is also a true statement. Forged transmits are frames that have a source MAC address that is different from the one that is assigned to the vNIC by the host operating system1. Rejecting forged transmits prevents spoofing attacks and ensures that the control link traffic is authentic2.
• B: In the vSwitch properties settings, set the VLAN ID to None. This is a false statement. The VLAN ID for the vSwitch can be any value as long as it matches the VLAN ID for the vSRX control interface1. The VLAN ID is used to tag the control link traffic and separate it from other traffic on the same vSwitch2.
• D: In the vSwitch security settings, reject MAC address changes. This is also a false statement. MAC address changes are allowed for the vSRX control interface, as the vSRX uses the MAC address of the control link to identify the cluster nodes1. Rejecting MAC address changes would prevent the cluster formation and synchronization2.

References:

• 1: vSRX Virtual Firewall Cluster Staging and Provisioning for VMware
• 2: Configuring Chassis Clustering on SRX Series Devices

 To create a security policy that will automatically add infected hosts to the infected hosts feed and block further communication through the SRX Series device, you need to add a security intelligence policy to the permit portion of the security policy. A security intelligence policy is a set of rules that defines the actions to be taken for traffic thatmatches a specific category of threat feeds, such as infected hosts, command and control servers, or botnets. By adding a security intelligence policy to the permit portion of the security policy, you can enable the SRX Series device to dynamically update the infected hosts feed based on the advanced anti-malware policy results, and block the traffic from or to the infected hosts. Options B, C, and D are not correct because they do not enable the automatic addition of infected hosts to the feed or the blocking of their communication. References: The answer can be verified from Juniper’s official documentation on security intelligence and advanced anti-malware available on their website. Here are some relevant links:

• Security Intelligence Feature Guide for Security Devices
• Advanced Anti-Malware Feature Guide for Security Devices
• Configuring Security Intelligence Policy on the SRX Series Device
• [Configuring Advanced Anti-Malware Policy on the SRX Series Device]

 The error occurred because the “http” application is not defined in this context of Juniper SRX Series device configuration. One solution is to create a custom application named “http” at the [edit applications] hierarchy level (Option C). Another solution is to modify the security policy to use the built-in “junos-http” application which is predefined and doesn’t need an explicit definition (Option D). Options A and B are not correct because they do not address the root cause of the error, which is the undefined application “http”. References: The answers can be verified from Juniper’s official documentation on security policies and applications available on their website. Here are some relevant links:

• Security Policies Feature Guide for Security Devices
• Understanding Applications and Application Sets for SRX Series Devices
• Configuring Custom Applications for SRX Series Devices
• Predefined Applications for SRX Series Devices