Practice with JN0-637 Dumps for JNCIP-SEC Certified Exam Questions & Answer [Q13-Q36]

4/5 - (1 vote)

Practice with JN0-637 Dumps for JNCIP-SEC Certified Exam Questions & Answer

REAL JN0-637 Exam Questions With 100% Refund Guarantee

NEW QUESTION 13
You are asked to detect domain generation algorithms
Which two steps will accomplish this goal on an SRX Series firewall? (Choose two.)

Define an advanced-anti-malware policy under [edit services].

Attach the security-metadata-streaming policy to a security

Define a security-metadata-streaming policy under [edit

Attach the advanced-anti-malware policy to a security policy.

NEW QUESTION 14
What is the purpose of the Switch Microservice of Policy Enforcer?

to isolate infected hosts

to enroll SRX Series devices with Juniper ATP Cloud

to inspect traffic for malware

to synchronize security policies to SRX Series devices

NEW QUESTION 15
You are connecting two remote sites to your corporate headquarters site.You must ensure that all traffic is secured and sent directly between sites In this scenario, which VPN should be used?

IPsec ADVPN

hub-and-spoke IPsec VPN

Layer 2 VPN

full mesh Layer 3 VPN with EBGP

NEW QUESTION 16
You are deploying a virtualization solution with the security devices in your network Each SRX Series device must support at least 100 virtualized instances and each virtualized instance must have its own discrete administrative domain.
In this scenario, which solution would you choose?

VRF instances

virtual router instances

logical systems

tenant systems

NEW QUESTION 17
You are required to secure a network against malware. You must ensure that in the event that a compromised host is identified within the network.
In this scenario after a threat has been identified, which two components are responsible for enforcing MAC-level infected host?

SRX Series device

Juniper ATP Appliance

Policy Enforcer

EX Series device

You are required to secure a network against malware. You must ensure that in the event that a compromised host is identified within the network, the host is isolated from the rest of the network.
In this scenario, after a threat has been identified, the two components that are responsible for enforcing MAC-level infected host are:
C) Policy Enforcer. Policy Enforcer is a software solution that integrates with Juniper ATP Cloud and Juniper ATP Appliance to provide automated threat remediation across the network. Policy Enforcer can receive threat intelligence feeds from Juniper ATP Cloud or Juniper ATP Appliance and apply them to the security policies on the SRX Series devices and the EX Series devices. Policy Enforcer can also enforce MAC-level infected host, which is a feature that allows you to quarantine a compromised host by blocking its MAC address on the switch port. Policy Enforcer can communicate with the EX Series devices and instruct them to apply the MAC-level infected host policy to the infected host1.
D) EX Series device. EX Series devices are Ethernet switches that can provide Layer 2 and Layer 3 switching capabilities and security features. EX Series devices can integrate with Policy Enforcer and Juniper ATP Cloud or Juniper ATP Appliance to provide automated threat remediation across the network. EX Series devices can support MAC-level infected host, which is a feature that allows them to quarantine a compromised host by blocking its MAC address on the switch port. EX Series devices can receive instructions from Policy Enforcer and apply the MAC-level infected host policy to the infected host2.
The other options are incorrect because:
A) SRX Series device. SRX Series devices are high-performance firewalls that can provide Layer 3 and Layer 4 security features and integrate with Juniper ATP Cloud or Juniper ATP Appliance to provide advanced threat prevention. SRX Series devices can receive threat intelligence feeds from Juniper ATP Cloud or Juniper ATP Appliance and apply them to the security policies. However, SRX Series devices cannot enforce MAC-level infected host, which is a feature that requires Layer 2 switching capabilities and is supported by EX Series devices3.
B) Juniper ATP Appliance. Juniper ATP Appliance is a hardware solution that provides advanced threat prevention by detecting and blocking malware, ransomware, and other cyberattacks. Juniper ATP Appliance can analyze the network traffic and identify the compromised hosts based on their behavior and communication patterns. Juniper ATP Appliance can also send threat intelligence feeds to Policy Enforcer and SRX Series devices to enable automated threat remediation across the network. However, Juniper ATP Appliance cannot enforce MAC-level infected host, which is a feature that requires Layer 2 switching capabilities and is supported by EX Series devices.
Reference: Policy Enforcer Overview EX Series Switches Overview
SRX Series Services Gateways Overview [Juniper ATP Appliance Overview]

NEW QUESTION 18
Exhibit

Which two statements are correct about the output shown in the exhibit? (Choose two.)

The packet is processed as host inbound traffic.

The packet matches the default security policy.

The packet matches a configured security policy.

The packet is processed in the first path packet flow.

NEW QUESTION 19
To analyze and detect malware, Juniper ATP Cloud performs which two functions? (Choose two.)

cache lookup: to see if the file is seen already and known to be malicious

antivirus scan: with a single vendor solution to see if the file contains any potential threats

dynamic analysis: to see what happens if you execute the file in a real environment

static analysis: to see what happens if you execute the file in a real environment

NEW QUESTION 20
Exhibit

Referring to the exhibit, which two statements are true? (Choose two.)

The data that traverses the ge-0/070 interface is secured by a secure association key.

The data that traverses the ge-070/0 interface can be intercepted and read by anyone.

The data that traverses the ge-070/0 interface cannot be intercepted and read by anyone.

The data that traverses the ge-O/0/0 interface is secured by a connectivity association key.

NEW QUESTION 21
you must find an infected host and where the aack came from using the Juniper ATP Cloud.
Which two monitor workspaces will return the requested information? (Choose Two)

Hosts

File Scanning

Threat Sources

Encrypted Traffic

To find an infected host and where the attack came from using the Juniper ATP Cloud, you need to use the Hosts and Threat Sources monitor workspaces.
The other options are incorrect because:
B) The File Scanning monitor workspace shows the files that have been scanned by the Juniper ATP Cloud and their verdicts (clean, malicious, or unknown). It does not show the infected hosts or the attack sources1.
D) The Encrypted Traffic monitor workspace shows the encrypted traffic that has been decrypted by the Juniper ATP Cloud and the certificates that have been used. It does not show the infected hosts or the attack sources2.
Therefore, the correct answer is A and C. You need to use the Hosts and Threat Sources monitor workspaces to find an infected host and where the attack came from using the Juniper ATP Cloud.
To do so, you need to perform the following steps:
For Hosts, you need to access the Hosts monitor workspace in the Juniper ATP Cloud WebUI by selecting Monitor > Hosts. You can see the list of hosts that have been detected by the Juniper ATP Cloud and their risk scores, infection levels, and threat categories. You can filter the hosts by various criteria, such as IP address, hostname, domain, or threat category. You can also drill down into each host to see the details of the files, applications, and incidents associated with the host. You can identify the infected host by looking for the host with the highest risk score, infection level, or threat category3.
For Threat Sources, you need to access the Threat Sources monitor workspace in the Juniper ATP Cloud WebUI by selecting Monitor > Threat Sources. You can see the list of threat sources that have been detected by the Juniper ATP Cloud and their risk scores, threat categories, and geolocations.
You can filter the threat sources by various criteria, such as IP address, domain, or threat category.
You can also drill down into each threat source to see the details of the files, applications, and incidents associated with the threat source. You can identify the attack source by looking for the threat source with the highest risk score, threat category, or geolocation that matches the infected host.
Reference: File Scanning
Encrypted Traffic
Hosts
[Threat Sources]

NEW QUESTION 22
Refer to the exhibit,

which two potential violations will generate alarm ? (Choose Two)

the number of policy violations by a source network identifier

the ratio of policy violation traffic compared to accepted traffic.

the number of policy violation by a destination TCP port

the number of policy violation to an application within a specified period

NEW QUESTION 23
What are two important function of the Juniper Networks ATP appliance solution? (Choose two.).

Statistics

Analysis

Detection

Filtration

NEW QUESTION 24
You want to use selective stateless packet-based forwarding based on the source address.
In this scenario, which command will allow traffic to bypass the SRX Series device flow daemon?

set firewall family inet filter bypas3_flowd term t1 then virtual-channel stateless

set firewall family inet filter bypass__f lowd term t1 then packet-mode

set firewall family inet filter bypass_flowd term t1 then routing-instance stateless

set firewall family inet filter bypaa3_flowd term t1 then skip-services accept

NEW QUESTION 25
You are asked to determine if the 203.0.113.5 IP address has been added to the third-party security feed, DS hield, from Juniper Seclnte1. You have an SRX Series device that is using Seclnte1 feeds from Juniper ATP Cloud Which command will return this information?

show security dynamic-address category-name CC | match 203.0.113.5

show security dynamic-address category-name Infected-Hosts | match 203.0.113.5

show security dynamic-address category-name IPFilter I match 203.0.113.5

show Security dynamic-address category-name JWAS | match 203.0.113.5

NEW QUESTION 26
You configured a chassis cluster for high availability on an SRX Series device and enrolled this HA cluster with the Juniper ATP Cloud.
Which two statements are correct in this scenario? (Choose two.)

You must use different license keys on both cluster nodes.

When enrolling your devices, you only need to enroll one node.

You must set up your HA cluster after enrolling your devices with Juniper ATP Cloud

You must use the same license key on both cluster nodes.

NEW QUESTION 27
Exhibit

Which two statements are correct about the output shown in the exhibit? (Choose two.)

The packet is silently discarded.

The packet is part of an existing session.

The packet is part of a new session.

The packet is explicitly rejected.

NEW QUESTION 28
Exhibit

The highlighted incident (arrow) shown in the exhibit shows a progression level of “Download” in the kill chain.
What are two appropriate mitigation actions for the selected incident? (Choose two.)

Immediate response required: Block malware IP addresses (download server or CnC server)

Immediate response required: Wipe infected endpoint hosts.

Immediate response required: Deploy IVP integration (if configured) to confirm if the endpoint has executed the malware and is infected.

Not an urgent action: Use IVP to confirm if machine is infected.

NEW QUESTION 29
You issue the command shown in the exhibit.
Which policy will be active for the identified traffic?

Policy p4

Policy p7

Policy p1

Policy p12

NEW QUESTION 30
Exhibit

Referring to the exhibit, which statement is true?

This custom block list feed will be used before the Juniper Seclntel

This custom block list feed cannot be saved if the Juniper Seclntel block list feed is configured.

This custom block list feed will be used instead of the Juniper Seclntel block list feed

This custom block list feed will be used after the Juniper Seclntel block list feed.

NEW QUESTION 31
Exhibit

Which two statements are correct about the output shown in the exhibit. (Choose two.)

The source address is translated.

The packet is an SSH packet

The packet matches a user-configured policy

The destination address is translated.

NEW QUESTION 32
Which two types of source NAT translations are supported in this scenario? (Choose two.)

translation of IPv4 hosts to IPv6 hosts with or without port address translation

translation of one IPv4 subnet to one IPv6 subnet with port address translation

translation of one IPv6 subnet to another IPv6 subnet without port address translation

translation of one IPv6 subnet to another IPv6 subnet with port address translation

NEW QUESTION 33
You want to identify potential threats within SSL-encrypted sessions without requiring SSL proxy to decrypt the session contents.
Which security feature achieves this objective?

infected host feeds

encrypted traffic insights

DNS security

Secure Web Proxy

NEW QUESTION 34
Click the Exhibit button.

Which type of NAT is shown in the exhibit?

NAT46

NAT64

persistent NAT

DS-Lite

NEW QUESTION 35
Your organization has multiple Active Directory domain to control user access. You must ensure that security polices are passing traffic based upon the user’s access rights.
What would you use to assist your SRX series devices to accomplish this task?

JIMS

Junos Space

JSA

JATP Appliance

NEW QUESTION 36
Exhibit

The exhibit shows a snippet of a security flow trace.
In this scenario, which two statements are correct? (Choose two.)