Question 1

You have deployed automated threat mitigation using Security Director with Policy Enforcer, Juniper ATP

Cloud, SRX Series devices, and EX Series switches.

In this scenario, which device is responsible for blocking the infected hosts?

Options :

A : Policy Enforcer

B : Security Director

C : Juniper ATP Cloud

D : EX Series switch

Answer: A

Question 2

Exhibit:

You are configuring NAT64 on your SRX Series device. You have committed the configuration shown in the

exhibit. Unfortunately, the communication with the 10.10.201.10 server is not working. You have verified

that the interfaces, security zones, and security policies are all correctly configured.

In this scenario, which action will solve this issue?

Options :

A :

Configure source NAT to translate return traffic from IPv4 address to the IPv6 address of your source device.

B : Configure proxy-ARP on the external IPv4 interface for the 10.10.201.10/32 address.

C : Configure proxy-NDP on the IPv6 interface for the 2001:db8::1/128 address.

D :

Configure destination NAT to translate return traffic from the IPv4 address to the IPv6 address of your source device.

Answer: A

Question 3

You are deploying IPsec VPNs to securely connect several enterprise sites with ospf for dynamic

routing. Some of these sites are secured by third-party devices not running Junos.

Which two statements are true for this deployment? (Choose two.)

Options :

A : OSPF over IPsec can be used for intersite dynamic routing.

B : Sites with overlapping address spaces can be supported.

C : OSPF over GRE over IPsec is required to enable intersite dynamic routing

D : Sites with overlapping address spaces cannot be supported.

Answer: B,C

Question 4

Your IPsec tunnel is configured with multiple security associations (SAs). Your SRX Series device supports the CoS-based IPsec VPNs with multiple IPsec SAs feature. You are asked to configure CoS for this tunnel. Which two statements are true in this scenario? (Choose two.)

Options :

A : The local and remote gateways do not need the forwarding classes to be defined in the same order.

B : A maximum of four forwarding classes can be configured for a VPN with the multi-sa forwardingclasses statement.

C : The local and remote gateways must have the forwarding classes defined in the same order.

D : A maximum of eight forwarding classes can be configured for a VPN with the multi-sa forwardingclasses statement.

Answer: C,D

Question 5

You want to bypass IDP for traffic destined to social media sites using APBR, but it is not working and IDP is

dropping the session.

What are two reasons for this problem? (Choose two.)

Options :

A : The session did not properly reclassify midstream to the correct APBR rule.

B : IDP disable is not configured on the APBR rule.

C : The application services bypass is not configured on the APBR rule.

D : The APBR rule does a match on the first packet.

Answer: A,C